Bug 1378440
| Summary: | IPA forwards enterprise principal to ipa-otpd and not the plain principal | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Sumit Bose <sbose> |
| Component: | krb5 | Assignee: | Robbie Harwood <rharwood> |
| Status: | CLOSED ERRATA | QA Contact: | Patrik Kis <pkis> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.3 | CC: | abokovoy, dpal, mrogers, pkis, pvoborni, rcritten |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | krb5-1.15.1-7.el7 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: krb5 does not canonicalize principal before handing off to otpd
Consequence: 2fa will mysteriously fail in sssd for users with it enabled
Fix: Use the canonical client principal name for OTP in krb5
Result: IPA forwards the correct principal name
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 17:58:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Sumit Bose
2016-09-22 12:21:53 UTC
This looks like an issue in OTP preauth plugin in MIT krb5 because it takes a principal that came in as ((krb5_kdc_req*)request)->client and passes it down to the code that talks to the RADIUS server. The src/plugins/preauth/otp/otp_state.c:token_decode() either takes the user name from the OTP config or unparses the passed Kerberos principal, optionally striping its realm, if token type requires to do so. So to support enteprise principals we need to unparse the principal and see if we need to normalize it for our own realms. Then the resulting principal would be sent to the RADIUS server. I also wonder if we actually get KDC_OPT_CANONICALIZE in the request->kdc_options. If so, we need to do canonicalization before talking to RADIUS server. (In reply to Alexander Bokovoy from comment #2) > I also wonder if we actually get KDC_OPT_CANONICALIZE in the > request->kdc_options. If so, we need to do canonicalization before talking > to RADIUS server. kinit does not seem to set canonicalize with just -E, though it still fails even when canonicalization is requested. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1891 |