On pe, 17 joulu 2021, Simon Matthews via FreeIPA-users wrote:
Platform is a fully-updated CentOS 7 instance. I have installed ipa-server-4.6.8-5.el7.centos.9.x86_64 and all the dependent packages.
The RedHat documentation tells you to use a script that sets all passwords to the same fixed string, however, I would like to use the hashed passwords from my NIS instance. The NIS server passwrod policy is set to "sha512".
I have set: ipa config-mod --enable-migration=true
It appears that the RedHat build does not allow encrypted passwords with "ipa user-mod", but I am trying to set the password with "ipa user-add". However, whenever I do this, attempting to test the login results in: kinit: Pre-authentication failed: Invalid argument while getting initial credentials
That's correct. You have no Kerberos key associated with the entry, only (some) LDAP password hash.
In order to obtain a kerberos ticket, KDC needs to have own encryption keys for each user. During migration you don't have any until you'd attempt to authenticate over LDAP with a plain-text password.
When migration mode is enabled, SSSD notices it and attempts to authenticate to LDAP in case kinit fails. On LDAP authentication IPA LDAP plugins handle this by generating Kerberos encryption keys for this user account because now they have a plain-text password -- this happens after the plain-text password was successfully authenticated against existing LDAP password hash.
So you need to authenticate prior to be able to use Kerberos -- either by doing a login through SSSD PAM services (ssh with password, for example) or by directly doing LDAP authentication with a password.