Public bug reported:

[ Impact ]

Smartcard Authentication using Windows Server 2025 domain controllers fails with
MIT Kerberos 1.20.1-6ubuntu2.6 in Noble with the following:

```
[3577] 1782823607.222882: Received error from KDC: -1765328305/Checksum must be 
included
kinit: Checksum must be included while getting initial credentials
```

This may also impact Windows Server 2022 domain controllers in some
configurations (upstream suggests "Computer Configuration > Policies
> Administrative Templates > System > KDC
> Configure hash algorithms for certificate logon").

This bug was fixed upstream in [1]. Tests in [2] are included for basic
unittest coverage of the changes.

[1] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00
[2] https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d

[ Test Plan ]

Attached is `setup.md` with a comprehensive guide for deploying Windows and
configuring SSSD, AD & a Yubikey for certificate authentication.

Verification should follow the guide for setup and use the following
kinit:

```sh
sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' 
[email protected]
```

After prompting for the Yubikey pin:

Expected result:


Actual result:

```
$ sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' 
[email protected]
Using default cache: /tmp/krb5cc_0
Using principal: [email protected]
PA Option X509_user_identity = PKCS11:
[4321] 1784645439.201446: Getting initial credentials for [email protected]
[4321] 1784645439.201448: Sending unauthenticated request
[4321] 1784645439.201449: Sending request (175 bytes) to TEST.SE
[4321] 1784645439.201450: Initiating TCP connection to stream 10.167.27.2:88
[4321] 1784645439.201451: Sending TCP request to stream 10.167.27.2:88
[4321] 1784645439.201452: Received answer (260 bytes) from stream 10.167.27.2:88
[4321] 1784645439.201453: Terminating TCP connection to stream 10.167.27.2:88
[4321] 1784645439.201454: Response was from primary KDC
[4321] 1784645439.201455: Received error from KDC: -1765328359/Additional 
pre-authentication required
[4321] 1784645439.201458: Preauthenticating using KDC method data
[4321] 1784645439.201459: Processing preauth types: PA-PK-AS-REQ (16), 
PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), 111, PA-ENC-TIMESTAMP (2)
[4321] 1784645439.201460: Selected etype info: etype aes256-cts, salt 
"TEST.SEwesley", params ""
[4321] 1784645439.201461: PKINIT loading identity PKCS11:
[4321] 1784645439.201462: PKINIT opening PKCS#11 module "opensc-pkcs11.so"
[4321] 1784645439.201463: PKINIT PKCS#11 slotid 0 token Users
[4321] 1784645439.201464: PKINIT opening PKCS#11 module "opensc-pkcs11.so"
[4321] 1784645440.099789: PKINIT PKCS#11 slotid 0 token Users
Users                            PIN:
[4321] 1784645442.770762: PKINIT loading CA certs and CRLs from FILE 
/etc/sssd/pki/sssd_auth_ca_db.pem
[4321] 1784645442.770763: PKINIT client computed kdc-req-body checksum 
14/F6C7633376B8C2181CE9A7F18F12EE616118DC61
[4321] 1784645442.770765: PKINIT client making DH request
[4321] 1784645442.770766: PKINIT chain cert #0: 
/DC=se/DC=test/CN=Users/CN=Wesley D. Hershberger
[4321] 1784645442.770767: Preauth module pkinit (16) (real) returned: 0/Success
[4321] 1784645442.770768: Produced preauth for next request: PA-PK-AS-REQ (16)
[4321] 1784645442.770769: Sending request (3401 bytes) to TEST.SE
[4321] 1784645442.770770: Initiating TCP connection to stream 10.167.27.2:88
[4321] 1784645442.770771: Sending TCP request to stream 10.167.27.2:88
[4321] 1784645443.004423: Received answer (86 bytes) from stream 10.167.27.2:88
[4321] 1784645443.004424: Terminating TCP connection to stream 10.167.27.2:88
[4321] 1784645443.004425: Response was from primary KDC
[4321] 1784645443.004426: Received error from KDC: -1765328305/Checksum must be 
included
kinit: Checksum must be included while getting initial credentials
```

[ Where problems could occur ]

The ASN.1 sequence that is extended by the upstream fix (PKAuthenticator) is
sent in the initial AS-REQ message sent by kinit when using PKINIT (certificate
authentication). PKINIT is most common when using smartcards for authentication.
Breakage as a result of this change would affect smartcard users.

PKAuthenticator is specified as extensible in RFC-4556; it was assumed upstream
that RFC-compliant implementations are able to decode PKAuthenticator even if
they have not implemented support for PAChecksum2. It is expected that
non-RFC-4556-compliant KDCs may be unable to decode the initial AS-REQ.

If failures are encountered, verbose output for kinit should show failures
while sending/receiving the messages modified by this change (PA-PK-AS-REQ,
PA-PK-AS-REP). Use `KRB5_TRACE=/dev/stderr kinit -V`.

As of July 20, 2026, the changes introduced by the patch have not been modified
upstream, with the exception of 4c8ec1637 which fixes build issues on Solaris.

[ Other information ]

See the Microsoft spec for PA-PK-AS-REQ PAChecksum2 [1].

Upstream commits [2][3].

I explored the possibility of backporting this change to Ubuntu 22.04 but
conflicts in expected test output make the backport significantly less trivial
than for 24.04. Users with a hard dependency on Windows Server 2025 domain
controllers should migrate to 24.04 or newer.

[1] 
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/8270b791-0201-4231-9d89-e5074459be2f
[2] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00
[3] https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d

** Affects: krb5 (Ubuntu)
     Importance: Undecided
         Status: Fix Released

** Affects: krb5 (Ubuntu Jammy)
     Importance: Undecided
         Status: Won't Fix

** Affects: krb5 (Ubuntu Noble)
     Importance: Medium
     Assignee: Wesley Hershberger (whershberger)
         Status: In Progress


** Tags: sts

** Attachment added: "setup.md"
   https://bugs.launchpad.net/bugs/2161440/+attachment/5985043/+files/setup.md

** Also affects: krb5 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: krb5 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Changed in: krb5 (Ubuntu)
       Status: In Progress => Fix Released

** Changed in: krb5 (Ubuntu Jammy)
       Status: New => In Progress

** Changed in: krb5 (Ubuntu Jammy)
       Status: In Progress => Won't Fix

** Changed in: krb5 (Ubuntu Noble)
       Status: New => In Progress

** Changed in: krb5 (Ubuntu Noble)
   Importance: Undecided => Medium

** Changed in: krb5 (Ubuntu Noble)
     Assignee: (unassigned) => Wesley Hershberger (whershberger)

** Changed in: krb5 (Ubuntu)
     Assignee: Wesley Hershberger (whershberger) => (unassigned)

** Changed in: krb5 (Ubuntu)
   Importance: Medium => Undecided

** Tags added: sts

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161440

Title:
  Smartcard auth with Windows Server 2025 fails with "Checksum must be
  included"

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2161440/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to