RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1378440 - IPA forwards enterprise principal to ipa-otpd and not the plain principal
Summary: IPA forwards enterprise principal to ipa-otpd and not the plain principal
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: krb5
Version: 7.3
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: Robbie Harwood
QA Contact: Patrik Kis
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-22 12:21 UTC by Sumit Bose
Modified: 2017-08-01 17:58 UTC (History)
6 users (show)

Fixed In Version: krb5-1.15.1-7.el7
Doc Type: Bug Fix
Doc Text:
Cause: krb5 does not canonicalize principal before handing off to otpd Consequence: 2fa will mysteriously fail in sssd for users with it enabled Fix: Use the canonical client principal name for OTP in krb5 Result: IPA forwards the correct principal name
Clone Of:
Environment:
Last Closed: 2017-08-01 17:58:41 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1891 0 normal SHIPPED_LIVE krb5 bug fix and enhancement update 2017-08-01 18:04:38 UTC

Description Sumit Bose 2016-09-22 12:21:53 UTC 
Description of problem:
In 7.3 SSSD will set 'krb5_use_enterprise_principal = True' automatically if there is a trusted AD forest which has alternative domain suffixes set. (For testing 'krb5_use_enterprise_principal = True' can be set explicitly in sssd.conf)

If there is an IPA user configured to use OTP authentication, 2FA will fail because the enterprise principal 'user\@IPA.DOMAIN' is forwarded to ipa-otpd instead of 'user'.

This can be seen in the following log messages:

Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: response sent: Access-Accept
Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: bind end: success
Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: bind start: uid=fbar,cn=users,cn=accounts,dc=dom-058-227,dc=abc,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: user query end: uid=fbar,cn=users,cn=accounts,dc=dom-058-227,dc=abc,dc=idm,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: user query start
Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar.IDM.LAB.ENG.BRQ.REDHAT.COM: request received

Sep 22 13:55:51 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar\@DOM-058-227.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM.IDM.LAB.ENG.BRQ.REDHAT.COM: response sent: Access-Reject
Sep 22 13:52:24 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar\@DOM-058-227.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM.IDM.LAB.ENG.BRQ.REDHAT.COM: user query start
Sep 22 13:52:24 vm-058-227.abc.idm.lab.eng.brq.redhat.com ipa-otpd[10564]: fbar\@DOM-058-227.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM.IDM.LAB.ENG.BRQ.REDHAT.COM: request received


The first is without and the second with 'krb5_use_enterprise_principal = True' set.

It would be possible to reproduce this just with kinit if the -E option is used.

the IPA KDC should make sure it converts the enterprise principal to a plain one before sending it to ipa-otpd.

Version-Release number of selected component (if applicable):
ipa-server-4.4.0-9.el7
Comment 1 Alexander Bokovoy 2016-09-22 12:58:33 UTC 
This looks like an issue in OTP preauth plugin in MIT krb5 because it takes a principal that came in as ((krb5_kdc_req*)request)->client and passes it down to the code that talks to the RADIUS server. The src/plugins/preauth/otp/otp_state.c:token_decode() either takes the user name from the OTP config or unparses the passed Kerberos principal, optionally striping its realm, if token type requires to do so.

So to support enteprise principals we need to unparse the principal and see if we need to normalize it for our own realms. Then the resulting principal would be sent to the RADIUS server.
Comment 2 Alexander Bokovoy 2016-09-22 13:03:31 UTC 
I also wonder if we actually get KDC_OPT_CANONICALIZE in the request->kdc_options. If so, we need to do canonicalization before talking to RADIUS server.
Comment 3 Robbie Harwood 2016-09-22 20:50:22 UTC 
(In reply to Alexander Bokovoy from comment #2)
> I also wonder if we actually get KDC_OPT_CANONICALIZE in the
> request->kdc_options. If so, we need to do canonicalization before talking
> to RADIUS server.

kinit does not seem to set canonicalize with just -E, though it still fails even when canonicalization is requested.
Comment 18 errata-xmlrpc 2017-08-01 17:58:41 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1891
Note You need to log in before you can comment on or make changes to this bug.