Hi Community,
Cannot authenticate using user's secondary email as an alternative name
(need to setup an email server with several virtual domains).
According to
https://bugzilla.redhat.com/show_bug.cgi?id=1328552 this is
expected to work but seems I'm missing something.
Created a fresh VM just to deal with the issue:
[root@mgsauth02 ol]# cat /etc/fedora-release
Fedora release 37 (Thirty Seven)
[root@mgsauth02 ol]# ipa --version
VERSION: 4.10.1, API_VERSION: 2.251
all packages updated.
Repeating commands from the testscript
https://bugzilla.redhat.com/show_bug.cgi?id=1328552#c13
[root@mgsauth02 ol]# ipa user-add tuser --first test --last user --password
Password:
Enter Password again to verify:
------------------
Added user "tuser"
------------------
User login: tuser
First name: test
Last name: user
Full name: test user
Display name: test user
Initials: tu
Home directory: /home/tuser
GECOS: test user
Login shell: /bin/sh
Principal name: tuser(a)TESTRELM.CO
Principal alias: tuser(a)TESTRELM.CO
User password expiration: 20221224134753Z
Email address: tuser(a)testrelm.co
UID: 1563000004
GID: 1563000004
Password: True
Member of groups: ipausers
Kerberos keys available: True
[root@mgsauth02 ol]# kinit admin
Password for admin(a)TESTRELM.CO:
[root@mgsauth02 ol]# ipa user-add-principal tuser talias talias\\(a)ent.test
---------------------------------
Added new aliases to user "tuser"
---------------------------------
User login: tuser
Principal alias: tuser(a)TESTRELM.CO, talias\@ent.test(a)TESTRELM.CO,
talias(a)TESTRELM.CO
[root@mgsauth02 ol]# kinit talias
Password for talias(a)TESTRELM.CO:
Password expired. You must change it now.
Enter new password:
Enter it again:
[root@mgsauth02 ol]# klist
Ticket cache: KCM:0:60382
Default principal: tuser(a)TESTRELM.CO
Valid starting Expires Service principal
12/24/2022 13:51:02 12/25/2022 13:10:41 krbtgt/TESTRELM.CO(a)TESTRELM.CO
[root@mgsauth02 ol]# kinit -C talias
Password for talias(a)TESTRELM.CO:
[root@mgsauth02 ol]# klist
Ticket cache: KCM:0:52413
Default principal: tuser(a)TESTRELM.CO
Valid starting Expires Service principal
12/24/2022 13:52:32 12/25/2022 13:18:25 krbtgt/TESTRELM.CO(a)TESTRELM.CO
=== So far OK. But when trying alias in email-form:
[root@mgsauth02 ol]# kinit talias\\(a)ent.test
kinit: Client 'talias\@ent.test(a)TESTRELM.CO' not found in Kerberos
database while getting initial credentials
[root@mgsauth02 ol]# kinit -E talias\\(a)ent.test
kinit: Client 'talias\@ent.test(a)TESTRELM.CO' not found in Kerberos
database while getting initial credentials
And the following appears in /var/log/krb5kdc.log:
Dec 24 13:54:32 mgsauth02.infra.smartshell.gg krb5kdc[1119](info):
AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18),
aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26),
aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17),
camellia128-cts-cmac(25)}) 10.255.0.252: CLIENT_NOT_FOUND:
talias\@ent.test(a)TESTRELM.CO for krbtgt/TESTRELM.CO(a)TESTRELM.CO, Client
not found in Kerberos database
Dec 24 13:54:32 mgsauth02.infra.smartshell.gg krb5kdc[1119](info):
closing down fd 11
Tried adding "|krb5_use_enterprise_principal = True|" to sssd.conf as
mentioned in
https://www.freeipa.org/page/V4/Support_of_UPN_for_trusted_domains but
without any change .
Any advice, please?