Bug 985956
| Summary: | kinit does not work when the client time is more than one day behind the server time | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Patrik Kis <pkis> |
| Component: | krb5 | Assignee: | Nalin Dahyabhai <nalin> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | David Spurek <dspurek> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | dspurek, ebenes, nalin, pkis, stefw |
| Target Milestone: | beta | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | krb5-1.11.3-4.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 961221 | Environment: | |
| Last Closed: | 2014-06-13 11:51:14 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 961221 | ||
| Bug Blocks: | 917658 | ||
|
Description
Patrik Kis
2013-07-18 15:12:22 UTC
The most recent rebase should incorporate a backported version of the fix for this. Hi, bug is not fixed correctly. When I set time day,week or month ahead the server time, then I can get ticket and use it with gssapi (ldapsearch+gssapi). When I set time day,week or month behind the server time then I can get the ticket, but it doesn't work with gssapi. detailed output: -------- server: [test]date Tue Aug 6 09:51:39 EDT 2013 -------- client: [test]date Tue Jul 30 09:48:02 EDT 2013 [test]klist Ticket cache: DIR::/run/user/0/krb5cc/tktSymuNo Default principal: Ariel Valid starting Expires Service principal 08/06/2013 09:52:41 07/31/2013 09:48:23 krbtgt/EXAMPLE.COM renew until 08/06/2013 09:48:23 [test]ldapsearch -Y GSSAPI -H ldap://ibm-p750e-02-lp2.rhts.eng.bos.redhat.com -b dc=example,dc=com '(objectclass=*)' SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired) Additional comment to #2 tested with version: [test]rpm -q krb5-server krb5-server-1.11.3-4.el7.ppc64 I think we need more information about your topology here. Is your directory server also your KDC? If not, which server's time was noted, and what was the time on the other one? (In reply to Nalin Dahyabhai from comment #4) > I think we need more information about your topology here. Is your > directory server also your KDC? If not, which server's time was noted, and > what was the time on the other one? Yes, the KDC and the directory server are running on the same machine and have the same time. David, can you please confirm that? I use KDC and openldap server on the same machine and they have the same time. What are the versions of the krb5 packages on the client? I pointed a client with 1.11.3-6.el7 at an IPA server running on 6.4 with the clock skewed both backward and forward by more than a week, and didn't encounter this problem either time. (In reply to Nalin Dahyabhai from comment #7) > What are the versions of the krb5 packages on the client? I pointed a > client with 1.11.3-6.el7 at an IPA server running on 6.4 with the clock > skewed both backward and forward by more than a week, and didn't encounter > this problem either time. On booth client and server there is 1.11.3-6.el7 installed. It seems that the problem is how the service ticket expiration is counted. Please check the test below. The time when the service stop working is exactly one day, the dame time as the ticket validity period. SERVER: The server (kdc and directory server) time was at the beginning the test: # date Wed Aug 7 16:54:05 CEST 2013 CLIENT: The test finished within few second. # date 08061655 Tue Aug 6 16:55:00 CEST 2013 # echo Ar1€lKRBp@ss |kinit Ariel Password for Ariel: # ldapsearch -Y GSSAPI -H ldap://rhel7.pkis.net -b dc=example,dc=com '(objectclass=*)' SASL/GSSAPI authentication started SASL username: Ariel SASL SSF: 56 ... snip ... # numResponses: 7 # numEntries: 6 # klist Ticket cache: DIR::/run/user/0/krb5cc/tktKcGL0g Default principal: Ariel Valid starting Expires Service principal 08/07/2013 16:54:29 08/08/2013 16:54:29 krbtgt/EXAMPLE.COM renew until 08/07/2013 16:54:29 08/07/2013 16:54:30 08/08/2013 16:54:29 ldap/rhel7.pkis.net renew until 08/07/2013 16:54:29 # # # # kdestroy # # # date 08061654 Tue Aug 6 16:54:00 CEST 2013 # echo Ar1€lKRBp@ss |kinit Ariel Password for Ariel: # ldapsearch -Y GSSAPI -H ldap://rhel7.pkis.net -b dc=example,dc=com '(objectclass=*)' SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired) # klist Ticket cache: DIR::/run/user/0/krb5cc/tkt014udC Default principal: Ariel Valid starting Expires Service principal 08/07/2013 16:54:40 08/07/2013 16:54:03 krbtgt/EXAMPLE.COM renew until 08/07/2013 16:54:40 08/07/2013 16:54:43 08/07/2013 16:54:03 ldap/rhel7.pkis.net renew until 08/07/2013 16:54:40 # Is your KDC set up so that the client requires preauthentication? This is necessary in order to allow the client to use the time that the KDC reports along with the preauth-required error. (In reply to Nalin Dahyabhai from comment #9) > Is your KDC set up so that the client requires preauthentication? This is > necessary in order to allow the client to use the time that the KDC reports > along with the preauth-required error. It isn't using preauth; that was it! By setting preauth for the client principal it started to work. Thanks. Changing the status to ON_QA so we can verify this feature on all architectures. This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |