On Mon, 2017-06-05 at 09:59 -0500, Kat via FreeIPA-users wrote:
> Never mind -- if I use ipa-getkeytab, it works perfectly.
> 
> What is the difference between what getkeytab and ktutil by hand
> does? 
> Is it documented?

In FreeIPA we generate a random salt instead of using the old
"principal name as salt". ktutil depends on using the "principal name
as salt" to generate correct keys, so it fails to create a valid key.

Simo.

> -K
> 
> 
> On 6/5/17 9:18 AM, Kat wrote:
> > Ok, I guess I am not understanding something here. What am I
> > missing? 
> > The PW is correct, but no matter what I do, I can't use the keytab 
> > file for a user as shown below:
> > 
> > [root@ipa ~]# ktutil
> > ktutil:  addent -password -p cyb...@example.com -k 1 -e 
> > aes256-cts-hmac-sha1-96
> > Password for cyb...@example.com:
> > ktutil:  wkt /root/cyberj.keytab
> > ktutil:  q
> > 
> > [root@ipa ~]# kinit -k -t cyberj.keytab cyb...@example.com
> > kinit: Password incorrect while getting initial credentials
> > 
> > :-(
> > 
> > -K
> > 
> 
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave@lists.fedorahoste
> d.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org

Reply via email to