Bug 144064

Description of problem:
I have a Windows Active Directory that I am trying to authenticate
against with either pam_krb5 or pam_winbind.  Both fail with similar
Kerberos errors, so I'll only discuss pam_krb5 for now for simplicity.
 I have followed all the instructions I can find on the subject and
the advice from various mailing lists and believe something is not
working as advertised.

I used samba with use kerberos keytab = yes to join the domain and
create /etc/krb5.keytab.  This worked fine, and kinit works fine.  I
can access fileshares via Kerberos and can use gssftp and ktelnet off
my local machine with Kerberos ticket authentication.

However, login via anything using PAM -- like ssh or gdm -- fails. 
The PAM auth section works fine, but the PAM account section fails on
the line:

account     [default=bad success=ok user_unknown=ignore]
/lib/security/$ISA/pam_krb5.so

If I comment this line out, login proceeds fine with Kerberos ticket
authentication.

The user I am trying to login as exists in /etc/passwd and has
password set to "*" in /etc/shadow.  ~user contains a .k5login.


Version-Release number of selected component (if applicable):

pam_krb5-2.1.2-1
krb5-devel-1.3.6-2
krb5-libs-1.3.6-2
krb5-workstation-1.3.6-2
samba-common-3.0.10-1.fc3
samba-client-3.0.10-1.fc3


How reproducible:
Always

Steps to Reproduce:
1. setup authconfig for Kerberos.
2. Use samba "net ads join" to join domain, create /etc/krb5.keytab --
works fine
3. kinit and "smbclient -k '\\server\share'" -- works fine
4. ssh localhost, login at gdm, etc. -- fails

I have removed /var/cache/samba/*, /etc/samba/*.tdb and
/etc/rb5.keytab and tried "net ads join" many times.  "net ads join";
does not report any errors (completely clean).


Actual Results:  Login via ssh with pam_krb5:

Jan  4 17:39:54 fedora sshd[8761]: Authorized to user, krb5 principal
user (krb5_kuserok)
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: configured realm
'COMPANY.COM'
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: flags: forwardable
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: flag: no ignore_afs
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: flag: user_check
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: flag: no krb4_convert
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: flag: warn
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: ticket lifetime: 36000
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: renewable lifetime:
36000
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: banner: Kerberos 5
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: ccache dir: /tmp
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: keytab:
/etc/krb5.keytab
Jan  4 17:39:54 fedora sshd[8761]: pam_krb5[8761]: authenticating
'user' to 'krbtgt/COMPANY.COM'
Jan  4 17:39:56 fedora sshd[8761]: pam_krb5[8761]:
krb5_get_init_creds_password(krbtgt/COMPANY.COM) returned
-1765328360 (Preauthentication failed)
Jan  4 17:39:56 fedora sshd[8761]: pam_krb5[8761]: pam_acct_mgmt
returning 7 (Authentication failure)


Expected Results:  Should succeed with system-auth as configured by
authconfig.

Additional info:

/etc/krb5.conf:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = COMPANY.COM
 dns_lookup_realm = false
 dns_lookup_kdc = true
 default_tgs_enctypes = rc4-hmac
 default_tkt_enctypes = rc4-hmac
 permitted_enctypes = rc4-hmac

[realms]
 COMPANY.COM = {
 }

[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
   debug = true
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }


/etc/krb5.keytab:

Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp         Principal
---- -----------------
--------------------------------------------------------
  14 01/04/05 00:14:27 host/fedora.company.com
  14 01/04/05 00:14:30 cifs/fedora.company.com
  14 01/04/05 00:14:25 fedora$@COMPANY.COM
  14 01/04/05 00:14:25 FEDORA$@COMPANY.COM
  14 01/04/05 00:14:26 host/fedora
  14 01/04/05 00:14:26 host/FEDORA
  14 01/04/05 00:14:27 host/FEDORA.company.com
  14 01/04/05 00:14:28 HOST/fedora
  14 01/04/05 00:14:28 HOST/FEDORA
  14 01/04/05 00:14:29 HOST/fedora.company.com
  14 01/04/05 00:14:29 HOST/FEDORA.company.com
  14 01/04/05 00:14:29 cifs/fedora
  14 01/04/05 00:14:30 cifs/FEDORA
  14 01/04/05 00:14:31 cifs/FEDORA.company.com
  14 01/04/05 00:14:31 CIFS/fedora
  14 01/04/05 00:14:32 CIFS/FEDORA
  14 01/04/05 00:14:32 CIFS/fedora.company.com
  14 01/04/05 00:14:33 CIFS/FEDORA.company.com


/etc/samba/smb.conf:

[global]
   workgroup = COMPANYNT
   realm = COMPANY.COM
   security = ads
   use kerberos keytab = yes


/etc/pam.d/system-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_krb5.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid
< 100 quiet
account     [default=bad success=ok user_unknown=ignore]
/lib/security/$ISA/pam_krb5.so
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok
use_authtok md5 shadow
password    sufficient    /lib/security/$ISA/pam_krb5.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_krb5.so


~user/.k5login:

user