Public bug reported: [ Impact ]
Smartcard Authentication using Windows Server 2025 domain controllers fails with MIT Kerberos 1.20.1-6ubuntu2.6 in Noble with the following: ``` [3577] 1782823607.222882: Received error from KDC: -1765328305/Checksum must be included kinit: Checksum must be included while getting initial credentials ``` This may also impact Windows Server 2022 domain controllers in some configurations (upstream suggests "Computer Configuration > Policies > Administrative Templates > System > KDC > Configure hash algorithms for certificate logon"). This bug was fixed upstream in [1]. Tests in [2] are included for basic unittest coverage of the changes. [1] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00 [2] https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d [ Test Plan ] Attached is `setup.md` with a comprehensive guide for deploying Windows and configuring SSSD, AD & a Yubikey for certificate authentication. Verification should follow the guide for setup and use the following kinit: ```sh sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' [email protected] ``` After prompting for the Yubikey pin: Expected result: Actual result: ``` $ sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' [email protected] Using default cache: /tmp/krb5cc_0 Using principal: [email protected] PA Option X509_user_identity = PKCS11: [4321] 1784645439.201446: Getting initial credentials for [email protected] [4321] 1784645439.201448: Sending unauthenticated request [4321] 1784645439.201449: Sending request (175 bytes) to TEST.SE [4321] 1784645439.201450: Initiating TCP connection to stream 10.167.27.2:88 [4321] 1784645439.201451: Sending TCP request to stream 10.167.27.2:88 [4321] 1784645439.201452: Received answer (260 bytes) from stream 10.167.27.2:88 [4321] 1784645439.201453: Terminating TCP connection to stream 10.167.27.2:88 [4321] 1784645439.201454: Response was from primary KDC [4321] 1784645439.201455: Received error from KDC: -1765328359/Additional pre-authentication required [4321] 1784645439.201458: Preauthenticating using KDC method data [4321] 1784645439.201459: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), 111, PA-ENC-TIMESTAMP (2) [4321] 1784645439.201460: Selected etype info: etype aes256-cts, salt "TEST.SEwesley", params "" [4321] 1784645439.201461: PKINIT loading identity PKCS11: [4321] 1784645439.201462: PKINIT opening PKCS#11 module "opensc-pkcs11.so" [4321] 1784645439.201463: PKINIT PKCS#11 slotid 0 token Users [4321] 1784645439.201464: PKINIT opening PKCS#11 module "opensc-pkcs11.so" [4321] 1784645440.099789: PKINIT PKCS#11 slotid 0 token Users Users PIN: [4321] 1784645442.770762: PKINIT loading CA certs and CRLs from FILE /etc/sssd/pki/sssd_auth_ca_db.pem [4321] 1784645442.770763: PKINIT client computed kdc-req-body checksum 14/F6C7633376B8C2181CE9A7F18F12EE616118DC61 [4321] 1784645442.770765: PKINIT client making DH request [4321] 1784645442.770766: PKINIT chain cert #0: /DC=se/DC=test/CN=Users/CN=Wesley D. Hershberger [4321] 1784645442.770767: Preauth module pkinit (16) (real) returned: 0/Success [4321] 1784645442.770768: Produced preauth for next request: PA-PK-AS-REQ (16) [4321] 1784645442.770769: Sending request (3401 bytes) to TEST.SE [4321] 1784645442.770770: Initiating TCP connection to stream 10.167.27.2:88 [4321] 1784645442.770771: Sending TCP request to stream 10.167.27.2:88 [4321] 1784645443.004423: Received answer (86 bytes) from stream 10.167.27.2:88 [4321] 1784645443.004424: Terminating TCP connection to stream 10.167.27.2:88 [4321] 1784645443.004425: Response was from primary KDC [4321] 1784645443.004426: Received error from KDC: -1765328305/Checksum must be included kinit: Checksum must be included while getting initial credentials ``` [ Where problems could occur ] The ASN.1 sequence that is extended by the upstream fix (PKAuthenticator) is sent in the initial AS-REQ message sent by kinit when using PKINIT (certificate authentication). PKINIT is most common when using smartcards for authentication. Breakage as a result of this change would affect smartcard users. PKAuthenticator is specified as extensible in RFC-4556; it was assumed upstream that RFC-compliant implementations are able to decode PKAuthenticator even if they have not implemented support for PAChecksum2. It is expected that non-RFC-4556-compliant KDCs may be unable to decode the initial AS-REQ. If failures are encountered, verbose output for kinit should show failures while sending/receiving the messages modified by this change (PA-PK-AS-REQ, PA-PK-AS-REP). Use `KRB5_TRACE=/dev/stderr kinit -V`. As of July 20, 2026, the changes introduced by the patch have not been modified upstream, with the exception of 4c8ec1637 which fixes build issues on Solaris. [ Other information ] See the Microsoft spec for PA-PK-AS-REQ PAChecksum2 [1]. Upstream commits [2][3]. I explored the possibility of backporting this change to Ubuntu 22.04 but conflicts in expected test output make the backport significantly less trivial than for 24.04. Users with a hard dependency on Windows Server 2025 domain controllers should migrate to 24.04 or newer. [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/8270b791-0201-4231-9d89-e5074459be2f [2] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00 [3] https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d ** Affects: krb5 (Ubuntu) Importance: Undecided Status: Fix Released ** Affects: krb5 (Ubuntu Jammy) Importance: Undecided Status: Won't Fix ** Affects: krb5 (Ubuntu Noble) Importance: Medium Assignee: Wesley Hershberger (whershberger) Status: In Progress ** Tags: sts ** Attachment added: "setup.md" https://bugs.launchpad.net/bugs/2161440/+attachment/5985043/+files/setup.md ** Also affects: krb5 (Ubuntu Noble) Importance: Undecided Status: New ** Also affects: krb5 (Ubuntu Jammy) Importance: Undecided Status: New ** Changed in: krb5 (Ubuntu) Status: In Progress => Fix Released ** Changed in: krb5 (Ubuntu Jammy) Status: New => In Progress ** Changed in: krb5 (Ubuntu Jammy) Status: In Progress => Won't Fix ** Changed in: krb5 (Ubuntu Noble) Status: New => In Progress ** Changed in: krb5 (Ubuntu Noble) Importance: Undecided => Medium ** Changed in: krb5 (Ubuntu Noble) Assignee: (unassigned) => Wesley Hershberger (whershberger) ** Changed in: krb5 (Ubuntu) Assignee: Wesley Hershberger (whershberger) => (unassigned) ** Changed in: krb5 (Ubuntu) Importance: Medium => Undecided ** Tags added: sts -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161440 Title: Smartcard auth with Windows Server 2025 fails with "Checksum must be included" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2161440/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
