On Thu, Feb 02, 2017 at 09:11:39PM +0000, Gilbert, Sonia wrote:
Thanks for helping out Lukas.
Kinit resolves to dc02 then fails pre-authentication because it was not the master KDC,
after providing password, then resolves to dc01 and then gets the policy rejects again.
Tried a few times and it seems that it does not matter which server it resolves, get the
same messages about not being master and policy reject. I also tried to set the "
dns_lookup_kdc = false" but just caused it not find a server. Klist, only see the
server object in the
a.abc.com domain.
Below are the results of KRB5_TRACE=/dev/stderr kinit 018443(a)abc.com:
[root@server01 etc]# KRB5_TRACE=/dev/stderr kinit 018443(a)abc.com
In general, I think you should either use -E/-C or use upper-case realm.
[17578] 1486068170.688787: Getting initial credentials for
018443(a)abc.com
[17578] 1486068170.689166: Sending request (193 bytes) to
abc.com
[17578] 1486068170.818519: Resolving hostname
infdcpci02.abc.com.
[17578] 1486068170.883645: Sending initial UDP request to dgram x.x.161.252:88 (dc02)
[17578] 1486068170.946802: Received answer (195 bytes) from dgram x.x.161.252:88
[17578] 1486068171.9293: Response was not from master KDC
[17578] 1486068171.9356: Received error from KDC: -1765328359/Additional
pre-authentication required
[17578] 1486068171.9425: Processing preauth types: 16, 15, 19, 2
[17578] 1486068171.9456: Selected etype info: etype aes256-cts, salt
"abc.com018443", params ""
[17578] 1486068435.915755: AS key obtained for encrypted timestamp: aes256-cts/B3B5
[17578] 1486068435.915855: Encrypted timestamp (for 1486068405.778558): plain
301AA011180F32303137303230323230343634355AA10502030BE13E, encrypted
B9066FF3F56DC8C931B4AA95937AE59185BCE87FDC1D2BF482A575B8166CEDA85E95D7EF5F36253F77D6674F208413BF079CEB6B45CBB101
[17578] 1486068435.915914: Preauth module encrypted_timestamp (2) (real) returned:
0/Success
[17578] 1486068435.915931: Produced preauth for next request: 2
[17578] 1486068435.915978: Sending request (273 bytes) to
abc.com
[17578] 1486068436.45327: Resolving hostname
infdcpci01.abc.com.
[17578] 1486068436.110256: Sending initial UDP request to dgram x.x.161.251:88
(different server dc01)
[17578] 1486068436.191100: Received answer (102 bytes) from dgram x.x.161.251:88
Is this a DC from the same realm?
[17578] 1486068436.256271: Response was not from master KDC
[17578] 1486068436.256323: Received error from KDC: -1765328372/KDC policy rejects
request
[17578] 1486068436.256366: Retrying AS request with master KDC
[17578] 1486068436.256381: Getting initial credentials for 018443(a)abc.com
[17578] 1486068436.256480: Sending request (193 bytes) to
abc.com (master)
kinit: KDC policy rejects request while getting initial credentials
With krb5.conf:
dns_lookup_kdc = false
[root@server01 etc]# KRB5_TRACE=/dev/stderr kinit 018443(a)abc.com
[17798] 1486068606.982122: Getting initial credentials for 018443(a)abc.com
[17798] 1486068606.982485: Sending request (193 bytes) to
abc.com
[17798] 1486068606.982757: Retrying AS request with master KDC
[17798] 1486068606.982798: Getting initial credentials for 018443(a)abc.com
[17798] 1486068606.982864: Sending request (193 bytes) to
abc.com (master)
kinit: Cannot find KDC for realm "abc.com" while getting initial credentials
Does it work if you define a 'known good' DC in krb5.conf ?
>
>
> [root@server01 etc]# klist -k
> Keytab name: FILE:/etc/krb5.keytab
> KVNO Principal
> ---- --------------------------------------------------------------------------
> 2 host/server01.a.abc.com(a)a.abc.com
> 2 host/server01.a.abc.com(a)a.abc.com
> 2 host/server01.a.abc.com(a)a.abc.com
> 2 host/server01.a.abc.com(a)a.abc.com
> 2 host/server01.a.abc.com(a)a.abc.com
> 2 host/server01(a)a.abc.com
> 2 host/server01(a)a.abc.com
> 2 host/server01(a)a.abc.com
> 2 host/server01(a)a.abc.com
> 2 host/server01(a)a.abc.com
> 2 server01$(a)a.abc.com
> 2 server01$(a)a.abc.com
> 2 server01$(a)a.abc.com
> 2 server01$(a)a.abc.com
> 2 server01$(a)a.abc.com
>
> Sonia Gilbert, -Engineer II, Information Protection & Compliance Team
> 3375 Koapaka Street, 3rd Floor, Honolulu, HI 96819 | P: 808.564.7503
> Sonia.Gilbert(a)HawaiianAir.com
>
>
>
>
> -----Original Message-----
> From: Lukas Slebodnik [mailto:lslebodn@redhat.com]
> Sent: Thursday, February 02, 2017 10:41 AM
> To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org>
> Subject: [SSSD-users] Re: account not authenticating in child domain
>
> On (02/02/17 19:55), Gilbert, Sonia wrote:
> >No. Also they said that they opened up the firewall for all the ports.
> >
> >[root@server01 /]# kinit 018443(a)abc.com Password for 018443(a)abc.com:
> >kinit: KDC policy rejects request while getting initial credentials
> >
> >Could it be trying to use krb5.keytab? Is it unique to each instance. Since it
was removed from the realm, will it need to have a new keytab generated. Is that a local
verification or do we also have to do something on the AD server?
> >
> Use KRB5_TRACE for extra tracing information.
> e.g.
> KRB5_TRACE=/dev/stderr kinit 018443(a)abc.com
>
> LS
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org To unsubscribe send an
email to sssd-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org