On to, 12 maalis 2020, Leonid Kanter via FreeIPA-users wrote:
Hello,
I'm trying to combine 2FA and kerberos, as described on
https://bugzilla.redhat.com/show_bug.cgi?id=1510734 and on
https://www.freeipa.org/page/V4/Kerberos_PKINIT#How_to_Use
Our main FreeIPA server, for historical reasons, is running without
certificate authority, on Letsencrypt certificates for httpd and slapd.
For test purposes, I installed new instance of FreeIPA (stock CentOS7)
with the same configuration, added CA with ipa-ca-install command,
enabled pkinit and created a user with 2FA enabled. ipa config-show says
this master is capable of PKINIT.
Now "kinit -n" works for me. But if I try "kinit -T $ARMOR_CCACHE
principal@REALM", it's asking me for OTP code, then return "kinit:
Preauthentication failed while getting initial credentials". In
krb5kdc.log I see "Additional pre-authentication required" first, and
"preauth (otp) verify failure: Generic preauthentication failure" next.
But the same OTP authenticator works perfectly for ssh, sudo and FreeIPA
web console.
Could you please help with that.
What did you try to enter? 'kinit' does not support separate prompts for
a pin and OTP value, so you have to enter them together, e.g.
password+OTP-value, then '<enter>'.
SSSD knows how to handle prompts, it will be able to show two separate
prompts but ssh and kinit couldn't.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland