Description of problem: pam_krb5 supports obtaining AFS tokens, but only supports tokens using the traditional 2b and rxk5 token formats, requiring a single-DES session key in the kerberos ticket. Since many sites are trying to disable the use of single-DES for kerberos, a KDF algorithm has been specified for using kerberos session keys of other enctypes to produce fcrypt keys that can be used for AFS tokens. This allows single-DES to be disabled at the KDC, although it does not change the fcrypt encryption used by AFS on the wire. Having pam_krb5 support this new rxkad-kdf token scheme would make it easier for sites to disable the use of single-DES in kerberos. Additional info: This KDF scheme was originally published at http://lists.openafs.org/pipermail/afs3-standardization/2013-July/002738.html . The same document is also available (under a different name/number) through the IETF tools, at http://tools.ietf.org/html/draft-kaduk-afs3-rxkad-k5-kdf-00 . Single-DES is officially deprecated for use in Kerberos, per http://tools.ietf.org/html/rfc6649 .
I suspect you will have 0 success with pam_krb5 as this is a dying breed. I suggest you look at SSSD, open a similar ticket for it and contribute a feature. Please start with opening and SSSD upstream ticket.
This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle. Changing version to '22'. More information and reason for this action is here: https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
I think this should work correctly in the just-tagged 2.4.12.
pam_krb5-2.4.12-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-da1145ad41
pam_krb5-2.4.12-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-da1145ad41
pam_krb5-2.4.12-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.