Hi,
We send the krb5_child.log attached as requested.
The test was an ssh u...@adtest.xxx.xxx.xx@idmsrvpru.idmpru.xxx.xxx.xx from our
IdM server.
Many thanks.
Lic. Mateo Duffour
Unidad Informática
2901.40.91
[
http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,Uruguay
| 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
[ http://www.fnr.gub.uy/ | ]
No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y
la información adjunta al mismo está dirigido exclusivamente a su destinatario.
Puede contener información confidencial, privilegiada o de uso restringido,
protegida por las normas. Si Ud. recibió este e-mail por error, por favor,
sírvase notificarle a quien se lo envió y borrar el original. Cualquier otro
uso del e-mail por Ud. está prohibido.
----- Original Message -----
From: "Sumit Bose" <sb...@redhat.com>
To: "Mateo Duffour" <mduff...@fnr.gub.uy>
Cc: "Alexander Bokovoy" <aboko...@redhat.com>, "Sumit Bose" <sb...@redhat.com>,
"freeipa-users" <freeipa-users@lists.fedorahosted.org>, "tizo"
<tiz...@gmail.com>
Sent: Friday, 8 April, 2022 02:45:06
Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC -
User accounts with passwords expired
Am Thu, Apr 07, 2022 at 05:07:00PM -0300 schrieb Mateo Duffour:
> Hi,
>
> The last answer that we received on bugzilla and on samba lists sais "Your
> kpasswd is expecting FAST support which has been added in samba 4.16. So you
> either have to disable FAST or upgrade first."
>
> We've upgraded our Samba server version to 4.16.0 and we're getting this
> error now (when trying to login with any user from our IdM server):
>
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx krb5_child[4846]: Error
> constructing AP-REQ armor: Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx
> not found in Kerberos database
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx krb5_child[4846]: Error
> constructing AP-REQ armor: Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx
> not found in Kerberos database
Hi,
looks like there are issues requesting the cross-realm TGT, it would be
good to see the full krb5_child.log file with 'debug_level = 9' in the
[domain/...] section of sssd.conf to maybe better understand why this fails.
I would expect that the cross-realm TGT is requested during the
validation of the Kerberos ticket. You can disable the validation as a
workaround by adding
krb5_validate = false
in the [domain/...] section of sssd.conf, see man sssd-krb5 for details.
bye,
Sumit
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx sshd[4842]: pam_sss(sshd:auth):
> authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.9.9.4
> user=u...@adtest.xxx.xxx.xx
> Apr 07 11:50:46 idmsrvpru.idmpru.xxx.xxx.xx sshd[4842]: pam_sss(sshd:auth):
> received for user u...@adtest.xxx.xxx.xx : 4 (System error)
> Apr 07 11:50:48 idmsrvpru.idmpru.xxx.xxx.xx sshd[4840]: error: PAM:
> Authentication failure for u...@adtest.xxx.xxx.xx from 10.9.9.4
>
> Any help is appreciated, regards.
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
> http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,Uruguay
> | 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [ http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje
> y la información adjunta al mismo está dirigido exclusivamente a su
> destinatario. Puede contener información confidencial, privilegiada o de uso
> restringido, protegida por las normas. Si Ud. recibió este e-mail por error,
> por favor, sírvase notificarle a quien se lo envió y borrar el original.
> Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "Mateo Duffour" <mduff...@fnr.gub.uy>
> To: "Alexander Bokovoy" <aboko...@redhat.com>
> Cc: "Sumit Bose" <sb...@redhat.com>, "freeipa-users"
> <freeipa-users@lists.fedorahosted.org>, "tizo" <tiz...@gmail.com>
> Sent: Friday, 11 March, 2022 15:49:31
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC
> - User accounts with passwords expired
>
> Hi,
>
> We are experiencing the same behavior on Samba AD DC 4.15.5, we are going to
> report a bug on bugzilla.samba.org as you suggested.
>
>
> Thanks again.
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
> http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,Uruguay
> | 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [ http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje
> y la información adjunta al mismo está dirigido exclusivamente a su
> destinatario. Puede contener información confidencial, privilegiada o de uso
> restringido, protegida por las normas. Si Ud. recibió este e-mail por error,
> por favor, sírvase notificarle a quien se lo envió y borrar el original.
> Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "Alexander Bokovoy" <aboko...@redhat.com>
> To: "Mateo Duffour" <mduff...@fnr.gub.uy>
> Cc: "Sumit Bose" <sb...@redhat.com>, "freeipa-users"
> <freeipa-users@lists.fedorahosted.org>, "tizo" <tiz...@gmail.com>
> Sent: Friday, 11 March, 2022 15:03:58
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC
> - User accounts with passwords expired
>
> On pe, 11 maalis 2022, Mateo Duffour wrote:
>
>
> Hi,
>
> We installed Samba AD DC from this repo [
> https://samba.tranquil.it/redhat8/samba-4.14.10/ |
> https://samba.tranquil.it/redhat8/samba-4.14.10/ ] Its running over
> Roky Linux and it's on a trust relationship with IdM.
>
>
>
> Thanks. So this is a build with embedded Heimdal Kerberos version and a
> relatively old one.
>
> This sounds like a bug worth opening Samba upstream. There is nothing
> specific to FreeIPA in this communication, though. What happens is that
> a Kerberos client (in this case kpasswd) attempts to change a password
> and fails when expecting a response on Kerberos level from Samba AD DC.
>
> It may be mix of expectations between kpasswd from MIT Kerberos (on
> Rocky) and Heimdal (embedded in Samba AD DC), but to fix it you'd need
> to talk to Samba AD developers.
>
> Please open a bug at bugzilla.samba.org, attach this capture and
> kpasswd trace logs. Also please provide details to what Samba build is
> this in the bug report.
>
> Prior doing that, may be try an upgrade to Samba 4.15.5 which is
> available in the same repositories from Tranquil IT.
> (https://samba.tranquil.it/redhat8/).
>
>
> BQ_BEGIN
>
>
> Regards,
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
> http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,Uruguay
> | 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [ http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje
> y la información adjunta al mismo está dirigido exclusivamente a su
> destinatario. Puede contener información confidencial, privilegiada o de uso
> restringido, protegida por las normas. Si Ud. recibió este e-mail por error,
> por favor, sírvase notificarle a quien se lo envió y borrar el original.
> Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "Alexander Bokovoy" <aboko...@redhat.com>
> To: "Mateo Duffour" <mduff...@fnr.gub.uy>
> Cc: "Sumit Bose" <sb...@redhat.com>, "freeipa-users"
> <freeipa-users@lists.fedorahosted.org>, "tizo" <tiz...@gmail.com>
> Sent: Friday, 11 March, 2022 14:07:58
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC
> - User accounts with passwords expired
>
> On pe, 11 maalis 2022, Mateo Duffour wrote:
>
>
> Hi,
>
> I've send the network capture attached, it was made with tcpdump in the
> IdM server to the Samba AD DC server, while trying to log in with ssh
> with user5.
>
>
>
> Hi,
>
> can you give more details about this Samba AD DC installation? What
> Samba version is that? How was it built?
>
>
>
>
> BQ_BEGIN
>
> Regards,
>
> Lic. Mateo Duffour
> Unidad Informática
> 2901.40.91
>
> [
> http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,Uruguay
> | 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
> [ http://www.fnr.gub.uy/ | ]
>
>
>
> No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje
> y la información adjunta al mismo está dirigido exclusivamente a su
> destinatario. Puede contener información confidencial, privilegiada o de uso
> restringido, protegida por las normas. Si Ud. recibió este e-mail por error,
> por favor, sírvase notificarle a quien se lo envió y borrar el original.
> Cualquier otro uso del e-mail por Ud. está prohibido.
>
>
> From: "tizo" <tiz...@gmail.com>
> To: "freeipa-users" <freeipa-users@lists.fedorahosted.org>
> Cc: "Mateo Duffour" <mduff...@fnr.gub.uy>, "Alexander Bokovoy"
> <aboko...@redhat.com>, "Sumit Bose" <sb...@redhat.com>
> Sent: Friday, 11 March, 2022 11:38:50
> Subject: Re: [Freeipa-users] Re: IdM with trust relationship with Samba AD DC
> - User accounts with passwords expired
>
>
>
>
> Hi,
>
> this is still the same pattern. Would it be possible to get a network
> trace to better understand how the KDC reply looks like and what might
> not be as expected by libkrb5?
>
> Additionally, can you try to set the password for the user with the
> expired password with
>
> KRB5_TRACE=/dev/stdout kpasswd usu5@ADTEST.....
>
> and send the output?
>
> bye,
> Sumit
>
>
>
>
>
> Hi there. I work with Mateo. We are sending the network capture in some
> minutes, but to get ahead I am sending the other test:
>
> # KRB5_TRACE=/dev/stdout kpasswd u...@adtest.xxx.xxx.xx
> [47521] 1647008539.753136: Getting initial credentials for
> u...@adtest.xxx.xxx.xx
> [47521] 1647008539.753137: FAST armor ccache: KCM:0:84390
> [47521] 1647008539.753138: Retrieving
> host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.XXX.XXX.XX\@ADTEST.XXX.XXX.XX@X-CACHECONF:
> from KCM:0:84390 with result: -1765328243/Matching credential not found
> [47521] 1647008539.753139: Setting initial creds service to kadmin/changepw
> [47521] 1647008539.753140: FAST armor ccache: KCM:0:84390
> [47521] 1647008539.753141: Retrieving
> host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.XXX.XXX.XX\@ADTEST.XXX.XXX.XX@X-CACHECONF:
> from KCM:0:84390 with result: -1765328243/Matching credential not found
> [47521] 1647008539.753143: Sending unauthenticated request
> [47521] 1647008539.753144: Sending request (179 bytes) to ADTEST.XXX.XXX.XX
> [47521] 1647008539.753145: Initiating TCP connection to stream [
> http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008540.776855: Initiating TCP connection to stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776856: Sending TCP request to stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776857: Received answer (278 bytes) from stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776858: Terminating TCP connection to stream [
> http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008540.776859: Terminating TCP connection to stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008540.776860: Response was from master KDC
> [47521] 1647008540.776861: Received error from KDC: -1765328359/Additional
> pre-authentication required
> [47521] 1647008540.776864: Preauthenticating using KDC method data
> [47521] 1647008540.776865: Processing preauth types: PA-PK-AS-REQ (16),
> PA-PK-AS-REP_OLD (15), PA-ENC-TIMESTAMP (2), PA-ETYPE-INFO2 (19)
> [47521] 1647008540.776866: Selected etype info: etype aes256-cts, salt
> "ADTEST.XXX.XXX.XXusu5", params "\x00\x00\x10\x00"
> [47521] 1647008540.776867: PKINIT client has no configured identity; giving
> up
> [47521] 1647008540.776868: PKINIT client has no configured identity; giving
> up
> [47521] 1647008540.776869: Preauth module pkinit (16) (real) returned:
> 22/Invalid argument
> Password for u...@adtest.xxx.xxx.xx:
> [47521] 1647008555.456745: AS key obtained for encrypted timestamp:
> aes256-cts/0DAE
> [47521] 1647008555.456747: Encrypted timestamp (for 1647008555.462202): plain
> 301AA011180F32303232303331313134323233355AA1050203070D7A, encrypted
> 588F164716268F95639456AEE7589886245643006D4F7B630289E1E745736D8B9037356B398C63F122292C02AAB12E25883A00C2E266E84C
>
> [47521] 1647008555.456748: Preauth module encrypted_timestamp (2) (real)
> returned: 0/Success
> [47521] 1647008555.456749: Produced preauth for next request:
> PA-ENC-TIMESTAMP (2)
> [47521] 1647008555.456750: Sending request (257 bytes) to ADTEST.XXX.XXX.XX
> [47521] 1647008555.456751: Initiating TCP connection to stream [
> http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008556.458248: Initiating TCP connection to stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458249: Sending TCP request to stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458250: Received answer (1438 bytes) from stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458251: Terminating TCP connection to stream [
> http://10.2.100.4:88/ | 10.2.100.4:88 ]
> [47521] 1647008556.458252: Terminating TCP connection to stream [
> http://10.2.100.3:88/ | 10.2.100.3:88 ]
> [47521] 1647008556.458253: Response was from master KDC
> [47521] 1647008556.458254: Processing preauth types: PA-PW-SALT (3)
> [47521] 1647008556.458255: Received salt "ADTEST.XXX.XXX.XXusu5" via padata
> type PA-PW-SALT (3)
> [47521] 1647008556.458256: Produced preauth for next request: (empty)
> [47521] 1647008556.458257: AS key determined by preauth: aes256-cts/0DAE
> [47521] 1647008556.458258: Decrypted AS reply; session key is:
> aes256-cts/35D9
> [47521] 1647008556.458259: FAST negotiation: unavailable
> kpasswd: KDC reply did not match expectations getting initial ticket
>
> FYI, I have tried the same test with a user WITHOUT expired password, and it
> does not work either, and the log is exactly the same. Indeed, when I log in
> with ssh with this user, I cannot change the password too:
>
> $ passwd
> Changing password for user u...@adtest.xxx.xx.xx.
> Current Password:
> Password change failed. Server message: Old password not accepted.
> passwd: Authentication token manipulation error
>
> Thanks very much.
>
>
>
>
>
> BQ_END
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>
>
>
>
> BQ_END
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x0400): krb5_child started.
(2022-04-11 10:13:19): [krb5_child[10339]] [unpack_buffer] (0x1000): total buffer size: [102]
(2022-04-11 10:13:19): [krb5_child[10339]] [unpack_buffer] (0x0100): cmd [249 (pre-auth)] uid [10107] gid [10107] validate [true] enterprise principal [false] offline [false] UPN [u...@adtest.xxx.xxx.xx]
(2022-04-11 10:13:19): [krb5_child[10339]] [unpack_buffer] (0x0100): ccname: [KCM:] old_ccname: [KCM:] keytab: [/etc/krb5.keytab]
(2022-04-11 10:13:19): [krb5_child[10339]] [k5c_setup_fast] (0x0100): Fast principal is set to [host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx]
(2022-04-11 10:13:19): [krb5_child[10339]] [find_principal_in_keytab] (0x4000): Trying to find principal host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx in keytab.
(2022-04-11 10:13:19): [krb5_child[10339]] [match_principal] (0x1000): Principal matched to the sample (host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx).
(2022-04-11 10:13:19): [krb5_child[10340]] [become_user] (0x0200): Trying to become user [0][0].
(2022-04-11 10:13:19): [krb5_child[10340]] [become_user] (0x0200): Already user [0].
(2022-04-11 10:13:19): [krb5_child[10340]] [check_fast_ccache] (0x2000): Running as [0][0].
(2022-04-11 10:13:19): [krb5_child[10340]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true]
(2022-04-11 10:13:19): [krb5_child[10340]] [create_ccache] (0x4000): Initializing ccache of type [FILE]
(2022-04-11 10:13:19): [krb5_child[10340]] [create_ccache] (0x4000): returning: 0
(2022-04-11 10:13:19): [krb5_child[10339]] [check_fast_ccache] (0x0200): FAST TGT was successfully recreated!
(2022-04-11 10:13:19): [krb5_child[10339]] [become_user] (0x0200): Trying to become user [10107][10107].
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x2000): Running as [10107][10107].
(2022-04-11 10:13:19): [krb5_child[10339]] [set_lifetime_options] (0x0100): No specific renewable lifetime requested.
(2022-04-11 10:13:19): [krb5_child[10339]] [set_lifetime_options] (0x0100): No specific lifetime requested.
(2022-04-11 10:13:19): [krb5_child[10339]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true]
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x0400): Will perform pre-auth
(2022-04-11 10:13:19): [krb5_child[10339]] [tgt_req_child] (0x1000): Attempting to get a TGT
(2022-04-11 10:13:19): [krb5_child[10339]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417579: Getting initial credentials for u...@adtest.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417580: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417581: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417583: Sending unauthenticated request
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417584: Sending request (188 bytes) to ADTEST.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417585: Initiating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417586: Sending TCP request to stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417587: Received answer (323 bytes) from stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417588: Terminating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417589: Response was from master KDC
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417590: Received error from KDC: -1765328359/Additional pre-authentication required
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417591: Upgrading to FAST due to presence of PA_FX_FAST in reply
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417592: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417593: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417594: Getting credentials host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx using ccache MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417595: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417596: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417597: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417598: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: 0/Success
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417599: Starting with TGT for client realm: host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417600: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417601: Requesting TGT krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx using TGT krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417602: Generated subkey for TGS request: aes256-cts/8B9E
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417603: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417605: Encoding request body and padata into FAST request
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417606: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417607: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417608: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417609: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417610: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417611: Response was from master KDC
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417612: Decoding FAST response
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417613: TGS request result: -1765328377/Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417614: Trying next closer realm in path: ADTEST.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417615: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417616: Requesting TGT krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx using TGT krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417617: Generated subkey for TGS request: aes256-cts/F32C
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417618: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417620: Encoding request body and padata into FAST request
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417621: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417622: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417623: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417624: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417625: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417626: Response was from master KDC
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417627: Decoding FAST response
(2022-04-11 10:13:19): [krb5_child[10339]] [sss_child_krb5_trace_cb] (0x4000): [10339] 1649682799.417628: TGS request result: -1765328377/Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:19): [krb5_child[10339]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328377] during pre-auth.
(2022-04-11 10:13:19): [krb5_child[10339]] [k5c_send_data] (0x0200): Received error code 0
(2022-04-11 10:13:19): [krb5_child[10339]] [pack_response_packet] (0x2000): response packet size: [4]
(2022-04-11 10:13:19): [krb5_child[10339]] [k5c_send_data] (0x4000): Response sent.
(2022-04-11 10:13:19): [krb5_child[10339]] [main] (0x0400): krb5_child completed successfully
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): krb5_child started.
(2022-04-11 10:13:32): [krb5_child[10343]] [unpack_buffer] (0x1000): total buffer size: [119]
(2022-04-11 10:13:32): [krb5_child[10343]] [unpack_buffer] (0x0100): cmd [241 (auth)] uid [10107] gid [10107] validate [true] enterprise principal [false] offline [false] UPN [u...@adtest.xxx.xxx.xx]
(2022-04-11 10:13:32): [krb5_child[10343]] [unpack_buffer] (0x0100): ccname: [KCM:] old_ccname: [KCM:] keytab: [/etc/krb5.keytab]
(2022-04-11 10:13:32): [krb5_child[10343]] [switch_creds] (0x0200): Switch user to [10107][10107].
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.
(2022-04-11 10:13:32): [krb5_child[10343]] [switch_creds] (0x0200): Switch user to [0][0].
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_check_old_ccache] (0x4000): Ccache_file is [KCM:] and is not active and TGT is valid.
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_precreate_ccache] (0x4000): Recreating ccache
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_setup_fast] (0x0100): Fast principal is set to [host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx]
(2022-04-11 10:13:32): [krb5_child[10343]] [find_principal_in_keytab] (0x4000): Trying to find principal host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx in keytab.
(2022-04-11 10:13:32): [krb5_child[10343]] [match_principal] (0x1000): Principal matched to the sample (host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx).
(2022-04-11 10:13:32): [krb5_child[10343]] [check_fast_ccache] (0x0200): FAST TGT is still valid.
(2022-04-11 10:13:32): [krb5_child[10343]] [become_user] (0x0200): Trying to become user [10107][10107].
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x2000): Running as [10107][10107].
(2022-04-11 10:13:32): [krb5_child[10343]] [set_lifetime_options] (0x0100): No specific renewable lifetime requested.
(2022-04-11 10:13:32): [krb5_child[10343]] [set_lifetime_options] (0x0100): No specific lifetime requested.
(2022-04-11 10:13:32): [krb5_child[10343]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true]
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): Will perform auth
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): Will perform online auth
(2022-04-11 10:13:32): [krb5_child[10343]] [tgt_req_child] (0x1000): Attempting to get a TGT
(2022-04-11 10:13:32): [krb5_child[10343]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847088: Getting initial credentials for u...@adtest.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847089: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847090: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847092: Sending unauthenticated request
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847093: Sending request (188 bytes) to ADTEST.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847094: Initiating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847095: Sending TCP request to stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847096: Received answer (323 bytes) from stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847097: Terminating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847098: Response was from master KDC
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847099: Received error from KDC: -1765328359/Additional pre-authentication required
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847100: Upgrading to FAST due to presence of PA_FX_FAST in reply
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847101: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847102: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847103: Getting credentials host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx using ccache MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847104: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847105: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847106: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847107: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: 0/Success
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847108: Starting with TGT for client realm: host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847109: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847110: Requesting TGT krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx using TGT krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847111: Generated subkey for TGS request: aes256-cts/6875
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847112: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847114: Encoding request body and padata into FAST request
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847115: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847116: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847117: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847118: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847119: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847120: Response was from master KDC
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847121: Decoding FAST response
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847122: TGS request result: -1765328377/Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847123: Trying next closer realm in path: ADTEST.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847124: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847125: Requesting TGT krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx using TGT krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847126: Generated subkey for TGS request: aes256-cts/9132
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847127: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847129: Encoding request body and padata into FAST request
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847130: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847131: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847132: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847133: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847134: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847135: Response was from master KDC
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847136: Decoding FAST response
(2022-04-11 10:13:32): [krb5_child[10343]] [sss_child_krb5_trace_cb] (0x4000): [10343] 1649682812.847137: TGS request result: -1765328377/Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:32): [krb5_child[10343]] [get_and_save_tgt] (0x0020): 1724: [-1765328377][Error constructing AP-REQ armor: Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database]
(2022-04-11 10:13:32): [krb5_child[10343]] [map_krb5_error] (0x0020): 1853: [-1765328377][Error constructing AP-REQ armor: Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database]
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_send_data] (0x0200): Received error code 1432158209
(2022-04-11 10:13:32): [krb5_child[10343]] [pack_response_packet] (0x2000): response packet size: [4]
(2022-04-11 10:13:32): [krb5_child[10343]] [k5c_send_data] (0x4000): Response sent.
(2022-04-11 10:13:32): [krb5_child[10343]] [main] (0x0400): krb5_child completed successfully
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x0400): krb5_child started.
(2022-04-11 10:13:34): [krb5_child[10348]] [unpack_buffer] (0x1000): total buffer size: [102]
(2022-04-11 10:13:34): [krb5_child[10348]] [unpack_buffer] (0x0100): cmd [249 (pre-auth)] uid [10107] gid [10107] validate [true] enterprise principal [false] offline [false] UPN [u...@adtest.xxx.xxx.xx]
(2022-04-11 10:13:34): [krb5_child[10348]] [unpack_buffer] (0x0100): ccname: [KCM:] old_ccname: [KCM:] keytab: [/etc/krb5.keytab]
(2022-04-11 10:13:34): [krb5_child[10348]] [k5c_setup_fast] (0x0100): Fast principal is set to [host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx]
(2022-04-11 10:13:34): [krb5_child[10348]] [find_principal_in_keytab] (0x4000): Trying to find principal host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx in keytab.
(2022-04-11 10:13:34): [krb5_child[10348]] [match_principal] (0x1000): Principal matched to the sample (host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx).
(2022-04-11 10:13:34): [krb5_child[10348]] [check_fast_ccache] (0x0200): FAST TGT is still valid.
(2022-04-11 10:13:34): [krb5_child[10348]] [become_user] (0x0200): Trying to become user [10107][10107].
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x2000): Running as [10107][10107].
(2022-04-11 10:13:34): [krb5_child[10348]] [set_lifetime_options] (0x0100): No specific renewable lifetime requested.
(2022-04-11 10:13:34): [krb5_child[10348]] [set_lifetime_options] (0x0100): No specific lifetime requested.
(2022-04-11 10:13:34): [krb5_child[10348]] [set_canonicalize_option] (0x0100): Canonicalization is set to [true]
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x0400): Will perform pre-auth
(2022-04-11 10:13:34): [krb5_child[10348]] [tgt_req_child] (0x1000): Attempting to get a TGT
(2022-04-11 10:13:34): [krb5_child[10348]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [ADTEST.xxx.xxx.xx]
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673946: Getting initial credentials for u...@adtest.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673947: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673948: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673950: Sending unauthenticated request
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673951: Sending request (188 bytes) to ADTEST.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673952: Initiating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673953: Sending TCP request to stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673954: Received answer (323 bytes) from stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673955: Terminating TCP connection to stream 10.2.100.3:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673956: Response was from master KDC
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673957: Received error from KDC: -1765328359/Additional pre-authentication required
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673958: Upgrading to FAST due to presence of PA_FX_FAST in reply
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673959: FAST armor ccache: MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673960: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/fast_avail/krbtgt\/ADTEST.xxx.xxx.xx\@ADTEST.xxx.xxx.xx@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673961: Getting credentials host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx using ccache MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673962: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673963: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673964: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673965: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: 0/Success
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673966: Starting with TGT for client realm: host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673967: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673968: Requesting TGT krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx using TGT krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673969: Generated subkey for TGS request: aes256-cts/3A50
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673970: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673972: Encoding request body and padata into FAST request
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673973: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673974: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673975: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673976: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673977: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673978: Response was from master KDC
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673979: Decoding FAST response
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673980: TGS request result: -1765328377/Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673981: Trying next closer realm in path: ADTEST.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673982: Retrieving host/idmsrvpru.idmpru.xxx.xxx...@idmpru.xxx.xxx.xx -> krbtgt/adtest.xxx.xxx...@adtest.xxx.xxx.xx from MEMORY:/var/lib/sss/db/fast_ccache_IDMPRU.xxx.xxx.xx with result: -1765328243/Matching credential not found
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673983: Requesting TGT krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx using TGT krbtgt/idmpru.xxx.xxx...@idmpru.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673984: Generated subkey for TGS request: aes256-cts/625C
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673985: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673987: Encoding request body and padata into FAST request
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673988: Sending request (2074 bytes) to IDMPRU.xxx.xxx.xx
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673989: Initiating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673990: Sending TCP request to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673991: Received answer (510 bytes) from stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673992: Terminating TCP connection to stream 10.2.100.2:88
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673993: Response was from master KDC
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673994: Decoding FAST response
(2022-04-11 10:13:34): [krb5_child[10348]] [sss_child_krb5_trace_cb] (0x4000): [10348] 1649682814.673995: TGS request result: -1765328377/Server krbtgt/adtest.xxx.xxx...@idmpru.xxx.xxx.xx not found in Kerberos database
(2022-04-11 10:13:34): [krb5_child[10348]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328377] during pre-auth.
(2022-04-11 10:13:34): [krb5_child[10348]] [k5c_send_data] (0x0200): Received error code 0
(2022-04-11 10:13:34): [krb5_child[10348]] [pack_response_packet] (0x2000): response packet size: [4]
(2022-04-11 10:13:34): [krb5_child[10348]] [k5c_send_data] (0x4000): Response sent.
(2022-04-11 10:13:34): [krb5_child[10348]] [main] (0x0400): krb5_child completed successfully
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
