Bug 671186

Summary:	krb5-auth-dialog doesn't start if username != principal name
Product:	Red Hat Enterprise Linux 6	Reporter:	David Jaša <djasa>
Component:	krb5-auth-dialog	Assignee:	Debarshi Ray <debarshir>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.2	CC:	djasa, dpal, ksrot, mcepl, mclasen, pkis
Target Milestone:	rc	Keywords:	FastFix
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-10-05 16:35:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description David Jaša 2011-01-20 17:38:01 UTC

Description of problem:
when logged in to machine with Red Hat krb5.conf with username different than kerberos principal name, the krb5-auth-dialog keeps exiting silently until "kinit $principal" is run. Then it works normally until kdestroy is called. Changing "principal" option in preferences has no effect.

Version-Release number of selected component (if applicable):
krb5-auth-dialog-0.13-3.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. log in as user test
2. run krb5-auth-dialog. It exits immediately with $? = 0
3. run kinit $your_red_hat_nick
4. run krb5-auth-dialog - it works fine
  
Actual results:


Expected results:

If kinit returns "Couldn't acquire kerberos
ticket: 'Client not found in Kerberos database'"
the krb5-auth-dialog should pop up window asking for principal name in addition to password.

Similarly, if there are more realms configured, krb5-auth-dialog should give option which one it should kinit


Additional info:

Comment 2 RHEL Program Management 2011-01-20 18:08:16 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 3 RHEL Program Management 2011-07-06 01:24:02 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 4 Matěj Cepl 2011-10-17 06:19:43 UTC

I could reproduce this on RHEL 6.2 anytime, and in my opinion this is a duplicate of the Fedora bug 672846 -- we are missing -A (or --always) when running krb5-auth-dialog.

Comment 9 Debarshi Ray 2016-10-04 15:33:37 UTC

One downside of using -A or --always is that the user will get a notification about expired network credentials even if they don't intend to use Kerberos at all and just happen to have krb5-auth-dialog installed. You could counter that by saying that the notification can be clicked away using "don't show me this again", or the package can be uninstalled.

Comment 10 Debarshi Ray 2016-10-04 15:35:40 UTC

Here is a scratch build:
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=11858020

I am slightly concerned whether this change (comment 9) in behaviour is really desired. No strong opinion, though.

Comment 13 Debarshi Ray 2016-10-05 16:02:07 UTC

After talking to Matěj, I am even more inclined to decline this (comment 9). I will reconsider this if there is an actual customer request. Otherwise, it doesn't make sense to tweak the UX with visible side-effects for RHEL 6.x at this stage.

Comment 14 RHEL Program Management 2016-10-05 16:35:15 UTC

Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.