Hide Forgot
Description of problem: In 7.3 SSSD will set 'krb5_use_enterprise_principal = True' automatically if there is a trusted AD forest which has alternative domain suffixes set. (For testing 'krb5_use_enterprise_principal = True' can be set explicitly in sssd.conf) If there is an IPA user configured to use OTP authentication, 2FA will fail because the enterprise principal 'user\@IPA.DOMAIN' is forwarded to ipa-otpd instead of 'user'. This can be seen in the following log messages: Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: response sent: Access-Accept Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: bind end: success Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: bind start: uid=fbar,cn=users,cn=accounts,dc=dom-058-227,dc=abc,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: user query end: uid=fbar,cn=users,cn=accounts,dc=dom-058-227,dc=abc,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: user query start Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: request received Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar\@DOM-058-227.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM.IDM.LAB.ENG.BRQ.REDHAT.COM: response sent: Access-Reject Sep 22 13:52:24 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar\@DOM-058-227.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM.IDM.LAB.ENG.BRQ.REDHAT.COM: user query start Sep 22 13:52:24 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar\@DOM-058-227.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM.IDM.LAB.ENG.BRQ.REDHAT.COM: request received The first is without and the second with 'krb5_use_enterprise_principal = True' set. It would be possible to reproduce this just with kinit if the -E option is used. the IPA KDC should make sure it converts the enterprise principal to a plain one before sending it to ipa-otpd. Version-Release number of selected component (if applicable): ipa-server-4.4.0-9.el7
This looks like an issue in OTP preauth plugin in MIT krb5 because it takes a principal that came in as ((krb5_kdc_req*)request)->client and passes it down to the code that talks to the RADIUS server. The src/plugins/preauth/otp/otp_state.c:token_decode() either takes the user name from the OTP config or unparses the passed Kerberos principal, optionally striping its realm, if token type requires to do so. So to support enteprise principals we need to unparse the principal and see if we need to normalize it for our own realms. Then the resulting principal would be sent to the RADIUS server.
I also wonder if we actually get KDC_OPT_CANONICALIZE in the request->kdc_options. If so, we need to do canonicalization before talking to RADIUS server.
(In reply to Alexander Bokovoy from comment #2) > I also wonder if we actually get KDC_OPT_CANONICALIZE in the > request->kdc_options. If so, we need to do canonicalization before talking > to RADIUS server. kinit does not seem to set canonicalize with just -E, though it still fails even when canonicalization is requested.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:1891