I've got a FreeIPA domain in a domain trust with a windows 2012r2 domain. SQL Server 2014 is a member of the windows domain and is configured to accept both windows and native authentication. From a box thats a member of my FreeIPA domain I'm able to get a ticket as a user from the windows domain and connect to the server without issue, if I use the sql server's fqdn.
Where I run into an issue is where I create a CNAME for my sql server. I add an SPN to AD: setspn -A MSSQLSvc/sqlserver2.ent2k12.domain.com:1433 ENT2K12\sqlserverspn
when i try to access the db using the CNAME I get the following error: cn = pyodbc.connect('DRIVER={ODBC Driver 13 for SQL Server};Server= sqlserver2.ent2k12.domain.com; DATABASE=testdb;Trusted_Connection=yes;') pyodbc.Error: ('HY000', '[HY000] [unixODBC][Microsoft][ODBC Driver 13 for SQL Server]SSPI Provider: Message stream modified (851968) (SQLDriverConnect)')
I know this error usually means that the case of the domain is off but I can't seem to create an SPN that kerberos likes. Here's my klist: Ticket cache: KEYRING:persistent:0:0 Default principal: freeipa3@ENT2K12.DOMAIN.COM
Valid starting Expires Service principal 08/15/2018 11:22:16 08/15/2018 21:21:36 MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM renew until 08/16/2018 11:21:32 08/15/2018 11:21:36 08/15/2018 21:21:36 krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM renew until 08/16/2018 11:21:32
So I'm getting the ticket. not really sure where to go from here. Any help would be greatly appreciated.
Thanks
Marc Boorshtein
On ke, 15 elo 2018, Marc Boorshtein via FreeIPA-users wrote:
I've got a FreeIPA domain in a domain trust with a windows 2012r2 domain. SQL Server 2014 is a member of the windows domain and is configured to accept both windows and native authentication. From a box thats a member of my FreeIPA domain I'm able to get a ticket as a user from the windows domain and connect to the server without issue, if I use the sql server's fqdn.
Where I run into an issue is where I create a CNAME for my sql server. I add an SPN to AD: setspn -A MSSQLSvc/sqlserver2.ent2k12.domain.com:1433 ENT2K12\sqlserverspn
when i try to access the db using the CNAME I get the following error: cn = pyodbc.connect('DRIVER={ODBC Driver 13 for SQL Server};Server= sqlserver2.ent2k12.domain.com; DATABASE=testdb;Trusted_Connection=yes;') pyodbc.Error: ('HY000', '[HY000] [unixODBC][Microsoft][ODBC Driver 13 for SQL Server]SSPI Provider: Message stream modified (851968) (SQLDriverConnect)')
I know this error usually means that the case of the domain is off but I can't seem to create an SPN that kerberos likes. Here's my klist: Ticket cache: KEYRING:persistent:0:0 Default principal: freeipa3@ENT2K12.DOMAIN.COM
Valid starting Expires Service principal 08/15/2018 11:22:16 08/15/2018 21:21:36 MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM renew until 08/16/2018 11:21:32 08/15/2018 11:21:36 08/15/2018 21:21:36 krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM renew until 08/16/2018 11:21:32
So I'm getting the ticket. not really sure where to go from here. Any help would be greatly appreciated.
Since in this case you have basically no involvement from FreeIPA side at all (notice there is no FreeIPA's realm ticket in your ccache).
Can you provide a KRB5_TRACE of a pyodbc.connect() operation? Make sure you have no tickets in the ccache other than a TGT before that.
right, was wondering if maybe something having to do with DNS or the krb5 config generated by IPA. Here's what I'm seeing:
[root@pyodbc ~]# env KRB5_TRACE=/dev/stdout python3.6 test.py [28353] 1534350643.20552: ccselect module realm chose cache KEYRING:persistent:0:0 with client principal freeipa3@ENT2K12.DOMAIN.COM for server principal MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM [28353] 1534350643.20553: Getting credentials freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM using ccache KEYRING:persistent:0:0 [28353] 1534350643.20554: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found [28353] 1534350643.20555: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20556: Starting with TGT for client realm: freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM [28353] 1534350643.20557: Requesting tickets for MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM, referrals on [28353] 1534350643.20558: Generated subkey for TGS request: aes256-cts/48E6 [28353] 1534350643.20559: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [28353] 1534350643.20561: Encoding request body and padata into FAST request [28353] 1534350643.20562: Sending request (1796 bytes) to ENT2K12.DOMAIN.COM [28353] 1534350643.20563: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20564: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20565: Initiating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20566: Sending TCP request to stream 192.168.2.75:88 [28353] 1534350643.20567: Received answer (1731 bytes) from stream 192.168.2.75:88 [28353] 1534350643.20568: Terminating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20569: Response was not from master KDC [28353] 1534350643.20570: Decoding FAST response [28353] 1534350643.20571: FAST reply key: aes256-cts/21CB [28353] 1534350643.20572: TGS reply is for freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM with session key rc4-hmac/4633 [28353] 1534350643.20573: TGS request result: 0/Success [28353] 1534350643.20574: Received creds for desired service MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM [28353] 1534350643.20575: Storing freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM in KEYRING:persistent:0:0 [28353] 1534350643.20577: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20578: Get cred via TGT krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM after requesting krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM (canonicalize off) [28353] 1534350643.20579: Generated subkey for TGS request: aes256-cts/88D1 [28353] 1534350643.20580: etypes requested in TGS request: rc4-hmac [28353] 1534350643.20582: Encoding request body and padata into FAST request [28353] 1534350643.20583: Sending request (1752 bytes) to ENT2K12.DOMAIN.COM [28353] 1534350643.20584: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20585: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20586: Initiating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20587: Sending TCP request to stream 192.168.2.75:88 [28353] 1534350643.20588: Received answer (1672 bytes) from stream 192.168.2.75:88 [28353] 1534350643.20589: Terminating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20590: Response was not from master KDC [28353] 1534350643.20591: Decoding FAST response [28353] 1534350643.20592: FAST reply key: aes256-cts/64A9 [28353] 1534350643.20593: TGS reply is for freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM with session key rc4-hmac/C871 [28353] 1534350643.20594: Got cred; 0/Success [28353] 1534350643.20596: Creating authenticator for freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM, seqnum 466799469, subkey rc4-hmac/AFCE, session key rc4-hmac/4633 [28353] 1534350643.20597: Negotiating for enctypes in authenticator: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [28353] 1534350643.20610: ccselect module realm chose cache KEYRING:persistent:0:0 with client principal freeipa3@ENT2K12.DOMAIN.COM for server principal MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM [28353] 1534350643.20611: Getting credentials freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM using ccache KEYRING:persistent:0:0 [28353] 1534350643.20612: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20614: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20615: Get cred via TGT krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM after requesting krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM (canonicalize off) [28353] 1534350643.20616: Generated subkey for TGS request: aes256-cts/5F07 [28353] 1534350643.20617: etypes requested in TGS request: rc4-hmac [28353] 1534350643.20619: Encoding request body and padata into FAST request [28353] 1534350643.20620: Sending request (1752 bytes) to ENT2K12.DOMAIN.COM [28353] 1534350643.20621: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20622: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20623: Initiating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20624: Sending TCP request to stream 192.168.2.75:88 [28353] 1534350643.20625: Received answer (1671 bytes) from stream 192.168.2.75:88 [28353] 1534350643.20626: Terminating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20627: Response was not from master KDC [28353] 1534350643.20628: Decoding FAST response [28353] 1534350643.20629: FAST reply key: aes256-cts/3BB5 [28353] 1534350643.20630: TGS reply is for freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM with session key rc4-hmac/0FE4 [28353] 1534350643.20631: Got cred; 0/Success [28353] 1534350643.20633: Creating authenticator for freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM, seqnum 673120205, subkey rc4-hmac/C59D, session key rc4-hmac/4633 [28353] 1534350643.20634: Negotiating for enctypes in authenticator: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts Traceback (most recent call last): File "test.py", line 2, in <module> cn = pyodbc.connect('DRIVER={ODBC Driver 13 for SQL Server};Server= sqlserver2.ent2k12.domain.com; DATABASE=testdb;Trusted_Connection=yes;') pyodbc.Error: ('HY000', '[HY000] [unixODBC][Microsoft][ODBC Driver 13 for SQL Server]SSPI Provider: Message stream modified (851968) (SQLDriverConnect)')
Only ticket in the cache before running was the freeipa3 tgt: [root@pyodbc ~]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: freeipa3@ENT2K12.DOMAIN.COM
Valid starting Expires Service principal 08/15/2018 12:29:56 08/15/2018 22:29:56 krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM renew until 08/16/2018 12:29:54
Thanks Marc
On Wed, Aug 15, 2018 at 12:24 PM Alexander Bokovoy abokovoy@redhat.com wrote:
On ke, 15 elo 2018, Marc Boorshtein via FreeIPA-users wrote:
I've got a FreeIPA domain in a domain trust with a windows 2012r2 domain. SQL Server 2014 is a member of the windows domain and is configured to accept both windows and native authentication. From a box thats a member of my FreeIPA domain I'm able to get a ticket as a user from the windows domain and connect to the server without issue, if I use the sql server's fqdn.
Where I run into an issue is where I create a CNAME for my sql server. I add an SPN to AD: setspn -A MSSQLSvc/sqlserver2.ent2k12.domain.com:1433
ENT2K12\sqlserverspn
when i try to access the db using the CNAME I get the following error: cn = pyodbc.connect('DRIVER={ODBC Driver 13 for SQL Server};Server= sqlserver2.ent2k12.domain.com; DATABASE=testdb;Trusted_Connection=yes;') pyodbc.Error: ('HY000', '[HY000] [unixODBC][Microsoft][ODBC Driver 13 for SQL Server]SSPI Provider: Message stream modified (851968) (SQLDriverConnect)')
I know this error usually means that the case of the domain is off but I can't seem to create an SPN that kerberos likes. Here's my klist: Ticket cache: KEYRING:persistent:0:0 Default principal: freeipa3@ENT2K12.DOMAIN.COM
Valid starting Expires Service principal 08/15/2018 11:22:16 08/15/2018 21:21:36 MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM renew until 08/16/2018 11:21:32 08/15/2018 11:21:36 08/15/2018 21:21:36 krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM renew until 08/16/2018 11:21:32
So I'm getting the ticket. not really sure where to go from here. Any help would be greatly appreciated.
Since in this case you have basically no involvement from FreeIPA side at all (notice there is no FreeIPA's realm ticket in your ccache).
Can you provide a KRB5_TRACE of a pyodbc.connect() operation? Make sure you have no tickets in the ccache other than a TGT before that.
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland
On ke, 15 elo 2018, Marc Boorshtein wrote:
right, was wondering if maybe something having to do with DNS or the krb5 config generated by IPA. Here's what I'm seeing:
[root@pyodbc ~]# env KRB5_TRACE=/dev/stdout python3.6 test.py [28353] 1534350643.20552: ccselect module realm chose cache KEYRING:persistent:0:0 with client principal freeipa3@ENT2K12.DOMAIN.COM for server principal MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM [28353] 1534350643.20553: Getting credentials freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM using ccache KEYRING:persistent:0:0 [28353] 1534350643.20554: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found [28353] 1534350643.20555: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20556: Starting with TGT for client realm: freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM [28353] 1534350643.20557: Requesting tickets for MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM, referrals on [28353] 1534350643.20558: Generated subkey for TGS request: aes256-cts/48E6 [28353] 1534350643.20559: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [28353] 1534350643.20561: Encoding request body and padata into FAST request [28353] 1534350643.20562: Sending request (1796 bytes) to ENT2K12.DOMAIN.COM [28353] 1534350643.20563: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20564: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20565: Initiating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20566: Sending TCP request to stream 192.168.2.75:88 [28353] 1534350643.20567: Received answer (1731 bytes) from stream 192.168.2.75:88 [28353] 1534350643.20568: Terminating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20569: Response was not from master KDC [28353] 1534350643.20570: Decoding FAST response [28353] 1534350643.20571: FAST reply key: aes256-cts/21CB [28353] 1534350643.20572: TGS reply is for freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM with session key rc4-hmac/4633 [28353] 1534350643.20573: TGS request result: 0/Success [28353] 1534350643.20574: Received creds for desired service MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM [28353] 1534350643.20575: Storing freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM in KEYRING:persistent:0:0 [28353] 1534350643.20577: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20578: Get cred via TGT krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM after requesting krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM (canonicalize off) [28353] 1534350643.20579: Generated subkey for TGS request: aes256-cts/88D1 [28353] 1534350643.20580: etypes requested in TGS request: rc4-hmac [28353] 1534350643.20582: Encoding request body and padata into FAST request [28353] 1534350643.20583: Sending request (1752 bytes) to ENT2K12.DOMAIN.COM [28353] 1534350643.20584: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20585: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20586: Initiating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20587: Sending TCP request to stream 192.168.2.75:88 [28353] 1534350643.20588: Received answer (1672 bytes) from stream 192.168.2.75:88 [28353] 1534350643.20589: Terminating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20590: Response was not from master KDC [28353] 1534350643.20591: Decoding FAST response [28353] 1534350643.20592: FAST reply key: aes256-cts/64A9 [28353] 1534350643.20593: TGS reply is for freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM with session key rc4-hmac/C871 [28353] 1534350643.20594: Got cred; 0/Success [28353] 1534350643.20596: Creating authenticator for freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM, seqnum 466799469, subkey rc4-hmac/AFCE, session key rc4-hmac/4633 [28353] 1534350643.20597: Negotiating for enctypes in authenticator: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [28353] 1534350643.20610: ccselect module realm chose cache KEYRING:persistent:0:0 with client principal freeipa3@ENT2K12.DOMAIN.COM for server principal MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM [28353] 1534350643.20611: Getting credentials freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM using ccache KEYRING:persistent:0:0 [28353] 1534350643.20612: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20614: Retrieving freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM from KEYRING:persistent:0:0 with result: 0/Success [28353] 1534350643.20615: Get cred via TGT krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM after requesting krbtgt/ ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM (canonicalize off) [28353] 1534350643.20616: Generated subkey for TGS request: aes256-cts/5F07 [28353] 1534350643.20617: etypes requested in TGS request: rc4-hmac [28353] 1534350643.20619: Encoding request body and padata into FAST request [28353] 1534350643.20620: Sending request (1752 bytes) to ENT2K12.DOMAIN.COM [28353] 1534350643.20621: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20622: Resolving hostname adfs.ent2k12.domain.com. [28353] 1534350643.20623: Initiating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20624: Sending TCP request to stream 192.168.2.75:88 [28353] 1534350643.20625: Received answer (1671 bytes) from stream 192.168.2.75:88 [28353] 1534350643.20626: Terminating TCP connection to stream 192.168.2.75:88 [28353] 1534350643.20627: Response was not from master KDC [28353] 1534350643.20628: Decoding FAST response [28353] 1534350643.20629: FAST reply key: aes256-cts/3BB5 [28353] 1534350643.20630: TGS reply is for freeipa3@ENT2K12.DOMAIN.COM -> krbtgt/ENT2K12.DOMAIN.COM@ENT2K12.DOMAIN.COM with session key rc4-hmac/0FE4 [28353] 1534350643.20631: Got cred; 0/Success [28353] 1534350643.20633: Creating authenticator for freeipa3@ENT2K12.DOMAIN.COM -> MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ ENT2K12.DOMAIN.COM, seqnum 673120205, subkey rc4-hmac/C59D, session key rc4-hmac/4633 [28353] 1534350643.20634: Negotiating for enctypes in authenticator: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts Traceback (most recent call last): File "test.py", line 2, in <module> cn = pyodbc.connect('DRIVER={ODBC Driver 13 for SQL Server};Server= sqlserver2.ent2k12.domain.com; DATABASE=testdb;Trusted_Connection=yes;') pyodbc.Error: ('HY000', '[HY000] [unixODBC][Microsoft][ODBC Driver 13 for SQL Server]SSPI Provider: Message stream modified (851968) (SQLDriverConnect)')
So, you've got a ticket using rc4-hmac and tried to negotiate that but MS-SQL refused it. May be this is the core of the issue?
Try to modify krb5.conf's [libdefaults] section and add there
default_tgs_types = -rc4 permitted_enc_types = -rc4 default_tkt_enctypes = -rc4
This should force removal of arcfour-hmac variants.
freeipa-users@lists.fedorahosted.org