Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 665001

Summary:	Unable to change password
Product:	[Retired] freeIPA	Reporter:	Gabor Szathmari <gabor.szathmari>
Component:	ipa-server	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	Chandrasekar Kannan <ckannan>
Severity:	high	Docs Contact:
Priority:	low
Version:	1.2	CC:	benl, dpal, jgalipea, sgallagh
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-02-23 19:55:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Gabor Szathmari 2010-12-22 12:39:06 UTC

Description of problem:

I can not change the expired passwords due to a compatibility problem. The problem persists for both new and existing users.

Version-Release number of selected component (if applicable):
ipa-admintools-1.2.2-5.fc14.i686
ipa-client-1.2.2-5.fc14.i686
ipa-python-1.2.2-5.fc14.i686
ipa-server-1.2.2-5.fc14.i686
ipa-server-selinux-1.2.2-5.fc14.i686
krb5-auth-dialog-0.16-1.fc14.i686
krb5-libs-1.8.2-7.fc14.i686
krb5-server-1.8.2-7.fc14.i686
krb5-server-ldap-1.8.2-7.fc14.i686
krb5-workstation-1.8.2-7.fc14.i686
pam_krb5-2.3.11-2.fc14.i686
python-iniparse-0.4-2.fc14.noarch
python-krbV-1.0.90-2.fc14.i686

How reproducible:
1. Try to change expired password during login
2. Timeout and failure

Steps to Reproduce:
1. Try to log in via local login or ssh
2. Type in the existing password
3. Type in the existing password again
4. Type in the new password

Actual results:
Expired users can not log in at all

Expected results:
Successful password change and login

Additional info:
Client was F14 and RHEL6

$ ssh -l teszt
teszt@xxx's password:
Warning: password has expired.
WARNING: Your password has expired.
You must change your password now and login again!
teszt felhasználó jelszavának megváltoztatása.
Kerberos 5 jelszó: (Kerberos 5 password)
Új jelszó: (New password)
Ismét az új jelszó: (New pw again)
passwd: Hitelesítő tokenkezelés hiba (Token manipulation error)
Connection to xxx closed.

Relevant log on the server (/var/log/message)
Dec 22 13:37:12 xxx kpasswd[1712]: Unsupported version

Comment 1 Gabor Szathmari 2010-12-22 15:22:27 UTC

RH Enterprise IPA 1.0 works fine

Comment 2 Rob Crittenden 2010-12-22 15:32:13 UTC

It works fine on what, Fedora 14?

This looks like a duplicate of 658832

Comment 3 Gabor Szathmari 2010-12-22 16:39:29 UTC

I apologize for the wording in the previous comment. 
The RH Enterprise IPA (from the CentOS testing repo) is working fine on CentOS 5.5

Comment 4 Dmitri Pal 2010-12-22 23:57:57 UTC

Which version of 389-ds-base?

Comment 5 Gabor Szathmari 2010-12-23 13:43:36 UTC

389-ds-base-1.2.7.5-1.fc14.i686

The have found out that the problem persists on the client side. In case of using ipa-client on Fedora 14, I can not change the password. However, CentOS 5.5 configured by authconfig-tui (and no ipa-client) just works fine.

Comment 6 Gabor Szathmari 2010-12-23 13:43:57 UTC

The have = I have

Comment 8 Stephen Gallagher 2011-01-03 12:38:59 UTC

Gabor, can you please do the following:

1) Add "debug_level = 9" to the [domain/<DOMAIN>] section of /etc/sssd/sssd.conf
2) Attempt to change the password.
3) Attach the following log files (sanitized) to this ticket:
 a. /var/log/secure
 b. /var/log/sssd/sssd_<DOMAIN>.log
 c. /var/log/sssd/krb5_child.log

Substitute <DOMAIN> with whatever domain is specified in your sssd.conf

Comment 9 Gabor Szathmari 2011-01-06 13:48:27 UTC

The Fedora Client is not using sssd at all.

Comment 10 Stephen Gallagher 2011-01-06 13:56:54 UTC

Sorry, I misunderstood the problem. Yeah, I agree with Rob's comment above that this is probably a duplicate of Bug #658832

Comment 11 Dmitri Pal 2011-02-23 19:55:46 UTC

This should have been fixed by the underlaying DS errata. Marking closed.
Feel free to reopen if you still observe the problem.