Bug 1184628 - Principal canonicalization does not work for principals in IPA realm
Summary: Principal canonicalization does not work for principals in IPA realm
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
URL:
Whiteboard:
Keywords:
Depends On: 1184629
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-21 21:00 UTC by Martin Kosek
Modified: 2016-11-04 05:44 UTC (History)
7 users (show)

(edit)
Clone Of:
: 1184629 (view as bug list)
(edit)
Last Closed: 2016-11-04 05:44:17 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Description Martin Kosek 2015-01-21 21:00:00 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/4844

Principal canonicalization does not work for own realm:

{{{
$ KRB5_TRACE=/dev/stderr kinit -C admin@f21.test
[31948] 1421403750.682046: Getting initial credentials for admin@f21.test
[31948] 1421403750.683696: Sending request (157 bytes) to f21.test
[31948] 1421403750.684576: Resolving hostname master.f21.test.
[31948] 1421403750.685294: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.686131: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.686295: Response was from master KDC
[31948] 1421403750.686349: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.686386: Following referral to realm f21.test
[31948] 1421403750.686435: Sending request (157 bytes) to f21.test
[31948] 1421403750.686691: Resolving hostname master.f21.test.
[31948] 1421403750.686929: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.687412: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.687564: Response was from master KDC
[31948] 1421403750.687616: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.687658: Following referral to realm f21.test
[31948] 1421403750.687697: Sending request (157 bytes) to f21.test
[31948] 1421403750.687941: Resolving hostname master.f21.test.
[31948] 1421403750.688136: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.688519: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.688687: Response was from master KDC
[31948] 1421403750.688721: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.688740: Following referral to realm f21.test
[31948] 1421403750.688771: Sending request (157 bytes) to f21.test
[31948] 1421403750.689003: Resolving hostname master.f21.test.
[31948] 1421403750.689176: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.689526: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.689700: Response was from master KDC
[31948] 1421403750.689751: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.689786: Following referral to realm f21.test
[31948] 1421403750.689832: Sending request (157 bytes) to f21.test
[31948] 1421403750.690092: Resolving hostname master.f21.test.
[31948] 1421403750.690280: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.690669: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.690830: Response was from master KDC
[31948] 1421403750.690891: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.690954: Following referral to realm f21.test
[31948] 1421403750.691017: Sending request (157 bytes) to f21.test
[31948] 1421403750.691246: Resolving hostname master.f21.test.
[31948] 1421403750.691420: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.691790: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.691932: Response was from master KDC
[31948] 1421403750.691986: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.692008: Following referral to realm f21.test
[31948] 1421403750.692048: Sending request (157 bytes) to f21.test
[31948] 1421403750.692246: Resolving hostname master.f21.test.
[31948] 1421403750.692414: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.692792: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.692933: Response was from master KDC
[31948] 1421403750.692989: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.693049: Following referral to realm f21.test
[31948] 1421403750.693119: Sending request (157 bytes) to f21.test
[31948] 1421403750.693335: Resolving hostname master.f21.test.
[31948] 1421403750.693524: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.693922: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.694118: Response was from master KDC
[31948] 1421403750.694153: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.694172: Following referral to realm f21.test
[31948] 1421403750.694202: Sending request (157 bytes) to f21.test
[31948] 1421403750.694399: Resolving hostname master.f21.test.
[31948] 1421403750.694567: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.694934: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.695095: Response was from master KDC
[31948] 1421403750.695138: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.695157: Following referral to realm f21.test
[31948] 1421403750.695188: Sending request (157 bytes) to f21.test
[31948] 1421403750.695385: Resolving hostname master.f21.test.
[31948] 1421403750.695553: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.695899: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.696055: Response was from master KDC
[31948] 1421403750.696115: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.696134: Following referral to realm f21.test
[31948] 1421403750.696164: Sending request (157 bytes) to f21.test
[31948] 1421403750.696393: Resolving hostname master.f21.test.
[31948] 1421403750.696563: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.696908: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.697047: Response was from master KDC
[31948] 1421403750.697101: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.697126: Following referral to realm f21.test
[31948] 1421403750.697157: Sending request (157 bytes) to f21.test
[31948] 1421403750.697363: Resolving hostname master.f21.test.
[31948] 1421403750.697544: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.697919: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.698080: Response was from master KDC
[31948] 1421403750.698178: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.698246: Following referral to realm f21.test
[31948] 1421403750.698287: Sending request (157 bytes) to f21.test
[31948] 1421403750.698484: Resolving hostname master.f21.test.
[31948] 1421403750.698673: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.699017: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.699194: Response was from master KDC
[31948] 1421403750.699255: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.699290: Following referral to realm f21.test
[31948] 1421403750.699336: Sending request (157 bytes) to f21.test
[31948] 1421403750.699562: Resolving hostname master.f21.test.
[31948] 1421403750.699781: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.700106: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.700270: Response was from master KDC
[31948] 1421403750.700304: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.700323: Following referral to realm f21.test
[31948] 1421403750.700353: Sending request (157 bytes) to f21.test
[31948] 1421403750.700554: Resolving hostname master.f21.test.
[31948] 1421403750.700747: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.701075: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.701234: Response was from master KDC
[31948] 1421403750.701268: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.701298: Following referral to realm f21.test
[31948] 1421403750.701328: Sending request (157 bytes) to f21.test
[31948] 1421403750.701523: Resolving hostname master.f21.test.
[31948] 1421403750.701767: Sending initial UDP request to dgram 192.168.5.169:88
[31948] 1421403750.702095: Received answer (161 bytes) from dgram 192.168.5.169:88
[31948] 1421403750.702266: Response was from master KDC
[31948] 1421403750.702300: Received error from KDC: -1765328378/Client not found in Kerberos database
[31948] 1421403750.702319: Following referral to realm f21.test
kinit: Looping detected inside krb5_get_in_tkt while getting initial credentials
}}}

Comment 1 Roland Mainz 2015-01-22 21:50:46 UTC
Shouldn't this bug be assigned to "krb5" ?

Comment 2 Martin Kosek 2015-01-23 07:42:23 UTC
No. This bug is for updating FreeIPA KDC LDAP driver to be able to handle canonicalization. krb5 bug (Bug 1184629) is for fixing the krb5 loop problem (this is the one you are interested in).

Comment 4 Martin Kosek 2015-04-24 13:52:20 UTC
Steps to verify:

# kinit -C admin@ipa.realm

should just work (notice the lowercase of the realm).

Comment 5 Petr Vobornik 2015-08-11 15:22:39 UTC
postponing to 7.3. Reasoning: http://www.redhat.com/archives/freeipa-devel/2015-August/msg00141.html

Comment 6 Petr Vobornik 2016-07-01 13:29:04 UTC
This ticket was fixed in scope of ipa-4.4.0-1.el7

Comment 8 Xiyang Dong 2016-08-22 04:06:37 UTC
(In reply to Martin Kosek from comment #4)
> Steps to verify:
> 
> # kinit -C admin@ipa.realm
> 
> should just work (notice the lowercase of the realm).

Still not able to handle case insensitive realm:
# rpm -q ipa-server
ipa-server-4.4.0-7.el7.x86_64

# KRB5_TRACE=/dev/stderr kinit -C admin@testrelm.test
[22738] 1471838597.999062: Getting initial credentials for admin@testrelm.test
[22738] 1471838598.1834: Sending request (169 bytes) to testrelm.test
[22738] 1471838598.2931: Resolving hostname auto-hv-02-guest02.testrelm.test.
[22738] 1471838598.3825: Sending initial UDP request to dgram 10.19.34.7:88
[22738] 1471838598.6228: Received answer (172 bytes) from dgram 10.19.34.7:88
[22738] 1471838598.6474: Response was from master KDC
[22738] 1471838598.6511: Received error from KDC: -1765328324/Generic error (see e-text)
kinit: Generic error (see e-text) while getting initial credentials

Comment 9 Martin Babinsky 2016-08-22 08:47:48 UTC
This looks like a bug in realm canonicalization.

Comment 10 Martin Babinsky 2016-08-22 08:49:34 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6239

Comment 11 Martin Babinsky 2016-08-23 11:45:27 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6239

Comment 12 Martin Babinsky 2016-09-05 15:02:31 UTC
After discussion with other developers we concluded that the Kerberos realm should not be subject to the case-insensitive matching when canonicalization is requested so the original steps to verify are wrong.

You should verify this by using upper-case realm:

# kinit -C admin@IPA.REALM

Comment 13 Xiyang Dong 2016-09-06 00:29:06 UTC
Verified on ipa-server-4.4.0-9.el7:
# klist
klist: Credentials cache keyring 'persistent:0:0' not found
# kinit -C admin@TESTRELM.TEST
Password for admin@TESTRELM.TEST: 
# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@TESTRELM.TEST

Valid starting       Expires              Service principal
09/06/2016 05:57:58  09/07/2016 05:57:54  krbtgt/TESTRELM.TEST@TESTRELM.TEST

Comment 15 errata-xmlrpc 2016-11-04 05:44:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.