Hello,
I'm trying to combine 2FA and kerberos, as described on
https://bugzilla.redhat.com/show_bug.cgi?id=1510734 and on
https://www.freeipa.org/page/V4/Kerberos_PKINIT#How_to_Use
Our main FreeIPA server, for historical reasons, is running without
certificate authority, on Letsencrypt certificates for httpd and slapd.
For test purposes, I installed new instance of FreeIPA (stock CentOS7)
with the same configuration, added CA with ipa-ca-install command,
enabled pkinit and created a user with 2FA enabled. ipa config-show says
this master is capable of PKINIT.
Now "kinit -n" works for me. But if I try "kinit -T $ARMOR_CCACHE
principal@REALM", it's asking me for OTP code, then return "kinit:
Preauthentication failed while getting initial credentials". In
krb5kdc.log I see "Additional pre-authentication required" first, and
"preauth (otp) verify failure: Generic preauthentication failure" next.
But the same OTP authenticator works perfectly for ssh, sudo and FreeIPA
web console.
Could you please help with that.