Am Mon, May 02, 2022 at 12:32:34PM -0300 schrieb tizo:
On Mon, May 2, 2022 at 11:56 AM Sumit Bose <sbose(a)redhat.com>
wrote:
>
> Am Mon, May 02, 2022 at 11:39:40AM -0300 schrieb tizo:
> > > Hi,
> > >
> > > thanks, at least I received your email. Can you run the tests with
> > > "krb5_use_fast = never" and "krb5_use_enterprise_principal
= True" again
> > > but with 'debug_level = 9' in the [domain/...] section of
sssd.conf.
> > > This will add some additional information into krb5_child.log which
> > > might help to understand why the client does not like the reply from the
> > > DC.
> > >
> > > bye,
> > > Sumit
> > >
> >
> > I cleared all the logs and ran the tests again with those parameters.
> > I am sending the logs. Thanks!
>
> Hi,
>
> can you try if you can change the password with 'kapsswd
> usu1(a)ADTEST.FNR.GUB.UY'? I guess it will fail as well. Can you take a
> network trace of this command with tcpdump and send it as well?
>
> bye,
> Sumit
>
It fails, and with kinit too:
[root@idmt01 tmp]# kinit usu1(a)ADTEST.FNR.GUB.UY
Password for usu1(a)ADTEST.FNR.GUB.UY:
kinit: KDC reply did not match expectations while getting initial credentials
[root@idmt01 tmp]# kpasswd usu1(a)ADTEST.FNR.GUB.UY
Password for usu1(a)ADTEST.FNR.GUB.UY:
kpasswd: KDC reply did not match expectations getting initial ticket
I am sending tcpdump captures while trying with kpasswd. There are
two, as there are two Samba DC (smbtest.adtest.fnr.gub.uy and
smbtest02.adtest.fnr.gub.uy), but I think that the first one replied
in this case.
Hi,
can you send the output of
KRB5_TRACE=/dev/stdout kpasswd usu1(a)ADTEST.FNR.GUB.UY
as well and your /etc/krb5.conf?
bye,
Sumit