** Description changed: [ Impact ] Smartcard Authentication using Windows Server 2025 domain controllers fails with MIT Kerberos 1.20.1-6ubuntu2.6 in Noble with the following: ``` [3577] 1782823607.222882: Received error from KDC: -1765328305/Checksum must be included kinit: Checksum must be included while getting initial credentials ``` This may also impact Windows Server 2022 domain controllers in some configurations (upstream suggests "Computer Configuration > Policies > Administrative Templates > System > KDC > Configure hash algorithms for certificate logon"). This bug was fixed upstream in [1]. Tests in [2] are included for basic unittest coverage of the changes. [1] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00 [2] https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d [ Test Plan ] Attached is `setup.md` with a comprehensive guide for deploying Windows and configuring SSSD, AD & a Yubikey for certificate authentication. Verification should follow the guide for setup and use the following kinit: ```sh sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' [email protected] ``` After prompting for the Yubikey pin: Expected result: + ``` + $ sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' [email protected] + Using default cache: /tmp/krb5cc_0 + Using principal: [email protected] + PA Option X509_user_identity = PKCS11: + [7242] 1784670212.722461: Getting initial credentials for [email protected] + [7242] 1784670212.722463: Sending unauthenticated request + [7242] 1784670212.722464: Sending request (175 bytes) to TEST.SE + [7242] 1784670212.722465: Initiating TCP connection to stream 10.167.27.2:88 + [7242] 1784670212.722466: Sending TCP request to stream 10.167.27.2:88 + [7242] 1784670212.722467: Received answer (260 bytes) from stream 10.167.27.2:88 + [7242] 1784670212.722468: Terminating TCP connection to stream 10.167.27.2:88 + [7242] 1784670212.722469: Response was from primary KDC + [7242] 1784670212.722470: Received error from KDC: -1765328359/Additional pre-authentication required + [7242] 1784670212.722473: Preauthenticating using KDC method data + [7242] 1784670212.722474: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), 111, PA-ENC-TIMESTAMP (2) + [7242] 1784670212.722475: Selected etype info: etype aes256-cts, salt "TEST.SEwesley", params "" + [7242] 1784670212.722476: PKINIT loading identity PKCS11: + [7242] 1784670212.722477: PKINIT opening PKCS#11 module "opensc-pkcs11.so" + [7242] 1784670213.377619: PKINIT PKCS#11 slotid 0 token Users + [7242] 1784670213.377620: PKINIT opening PKCS#11 module "opensc-pkcs11.so" + [7242] 1784670213.377621: PKINIT PKCS#11 slotid 0 token Users + Users PIN: + [7242] 1784670215.995742: PKINIT loading CA certs and CRLs from FILE /etc/sssd/pki/sssd_auth_ca_db.pem + [7242] 1784670215.995743: PKINIT client computed checksums: 8A96F44C2975132F135DB71E35E713AA670A89DB 711875D60BB33C317231A15BE7F72C9D8CA58175DD241131A181215C2B5F8CF2 + [7242] 1784670215.995745: PKINIT client making DH request + [7242] 1784670216.003661: PKINIT chain cert #0: /DC=se/DC=test/CN=Users/CN=Wesley D. Hershberger + [7242] 1784670216.003662: Preauth module pkinit (16) (real) returned: 0/Success + [7242] 1784670216.003663: Produced preauth for next request: PA-PK-AS-REQ (16) + [7242] 1784670216.003664: Sending request (3456 bytes) to TEST.SE + [7242] 1784670216.003665: Initiating TCP connection to stream 10.167.27.2:88 + [7242] 1784670216.003666: Sending TCP request to stream 10.167.27.2:88 + [7242] 1784670216.003667: Received answer (4141 bytes) from stream 10.167.27.2:88 + [7242] 1784670216.003668: Terminating TCP connection to stream 10.167.27.2:88 + [7242] 1784670216.003669: Response was from primary KDC + [7242] 1784670216.003670: Processing preauth types: PA-PK-AS-REP (17) + [7242] 1784670216.003671: PKINIT client verified DH reply + [7242] 1784670216.003672: PKINIT client config accepts KDC dNSName SAN win-64up1dm1tnf.test.se + [7242] 1784670216.003673: PKINIT client found 2 SANs (0 princs, 0 UPNs, 1 DNS names) in certificate /CN=WIN-64UP1DM1TNF.test.se + [7242] 1784670216.003674: PKINIT client found dNSName SAN in KDC cert: WIN-64UP1DM1TNF.test.se + [7242] 1784670216.003675: PKINIT client matched KDC hostname WIN-64UP1DM1TNF.test.se against dNSName SAN; EKU check still required + [7242] 1784670216.003676: PKINIT found acceptable EKU and digitalSignature KU + [7242] 1784670216.003677: PKINIT client found acceptable EKU in KDC cert + [7242] 1784670216.003678: PKINIT client used octetstring2key to compute reply key aes256-cts/6A78 + [7242] 1784670216.003679: Preauth module pkinit (17) (real) returned: 0/Success + [7242] 1784670216.003680: Produced preauth for next request: (empty) + [7242] 1784670216.003681: AS key determined by preauth: aes256-cts/6A78 + [7242] 1784670216.003682: Decrypted AS reply; session key is: aes256-cts/A2C5 + [7242] 1784670216.003683: FAST negotiation: unavailable + [7242] 1784670216.003684: Resolving unique ccache of type MEMORY + [7242] 1784670216.003685: Initializing MEMORY:lL326z9 with default princ [email protected] + [7242] 1784670216.003686: Storing config in MEMORY:lL326z9 for krbtgt/[email protected]: pa_type: 16 + [7242] 1784670216.003687: Storing [email protected] -> krb5_ccache_conf_data/pa_type/krbtgt\/TEST.SE\@TEST.SE@X-CACHECONF: in MEMORY:lL326z9 + [7242] 1784670216.003688: Storing config in MEMORY:lL326z9 for krbtgt/[email protected]: pa_config_data: {"X509_user_identity":"PKCS11:"} + [7242] 1784670216.003689: Storing [email protected] -> krb5_ccache_conf_data/pa_config_data/krbtgt\/TEST.SE\@TEST.SE@X-CACHECONF: in MEMORY:lL326z9 + [7242] 1784670216.003690: Storing [email protected] -> krbtgt/[email protected] in MEMORY:lL326z9 + [7242] 1784670216.003691: Moving ccache MEMORY:lL326z9 to FILE:/tmp/krb5cc_0 + [7242] 1784670216.003692: Destroying ccache MEMORY:lL326z9 + Authenticated to Kerberos v5 + ``` Actual result: ``` $ sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' [email protected] Using default cache: /tmp/krb5cc_0 Using principal: [email protected] PA Option X509_user_identity = PKCS11: [4321] 1784645439.201446: Getting initial credentials for [email protected] [4321] 1784645439.201448: Sending unauthenticated request [4321] 1784645439.201449: Sending request (175 bytes) to TEST.SE [4321] 1784645439.201450: Initiating TCP connection to stream 10.167.27.2:88 [4321] 1784645439.201451: Sending TCP request to stream 10.167.27.2:88 [4321] 1784645439.201452: Received answer (260 bytes) from stream 10.167.27.2:88 [4321] 1784645439.201453: Terminating TCP connection to stream 10.167.27.2:88 [4321] 1784645439.201454: Response was from primary KDC [4321] 1784645439.201455: Received error from KDC: -1765328359/Additional pre-authentication required [4321] 1784645439.201458: Preauthenticating using KDC method data [4321] 1784645439.201459: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), 111, PA-ENC-TIMESTAMP (2) [4321] 1784645439.201460: Selected etype info: etype aes256-cts, salt "TEST.SEwesley", params "" [4321] 1784645439.201461: PKINIT loading identity PKCS11: [4321] 1784645439.201462: PKINIT opening PKCS#11 module "opensc-pkcs11.so" [4321] 1784645439.201463: PKINIT PKCS#11 slotid 0 token Users [4321] 1784645439.201464: PKINIT opening PKCS#11 module "opensc-pkcs11.so" [4321] 1784645440.099789: PKINIT PKCS#11 slotid 0 token Users Users PIN: [4321] 1784645442.770762: PKINIT loading CA certs and CRLs from FILE /etc/sssd/pki/sssd_auth_ca_db.pem [4321] 1784645442.770763: PKINIT client computed kdc-req-body checksum 14/F6C7633376B8C2181CE9A7F18F12EE616118DC61 [4321] 1784645442.770765: PKINIT client making DH request [4321] 1784645442.770766: PKINIT chain cert #0: /DC=se/DC=test/CN=Users/CN=Wesley D. Hershberger [4321] 1784645442.770767: Preauth module pkinit (16) (real) returned: 0/Success [4321] 1784645442.770768: Produced preauth for next request: PA-PK-AS-REQ (16) [4321] 1784645442.770769: Sending request (3401 bytes) to TEST.SE [4321] 1784645442.770770: Initiating TCP connection to stream 10.167.27.2:88 [4321] 1784645442.770771: Sending TCP request to stream 10.167.27.2:88 [4321] 1784645443.004423: Received answer (86 bytes) from stream 10.167.27.2:88 [4321] 1784645443.004424: Terminating TCP connection to stream 10.167.27.2:88 [4321] 1784645443.004425: Response was from primary KDC [4321] 1784645443.004426: Received error from KDC: -1765328305/Checksum must be included kinit: Checksum must be included while getting initial credentials ``` [ Where problems could occur ] The ASN.1 sequence that is extended by the upstream fix (PKAuthenticator) is sent in the initial AS-REQ message sent by kinit when using PKINIT (certificate authentication). PKINIT is most common when using smartcards for authentication. Breakage as a result of this change would affect smartcard users. PKAuthenticator is specified as extensible in RFC-4556; it was assumed upstream that RFC-compliant implementations are able to decode PKAuthenticator even if they have not implemented support for PAChecksum2. It is expected that non-RFC-4556-compliant KDCs may be unable to decode the initial AS-REQ. If failures are encountered, verbose output for kinit should show failures while sending/receiving the messages modified by this change (PA-PK-AS-REQ, PA-PK-AS-REP). Use `KRB5_TRACE=/dev/stderr kinit -V`. As of July 20, 2026, the changes introduced by the patch have not been modified upstream, with the exception of 4c8ec1637 which fixes build issues on Solaris. [ Other information ] See the Microsoft spec for PA-PK-AS-REQ PAChecksum2 [1]. Upstream commits [2][3]. I explored the possibility of backporting this change to Ubuntu 22.04 but conflicts in expected test output make the backport significantly less trivial than for 24.04. Users with a hard dependency on Windows Server 2025 domain controllers should migrate to 24.04 or newer. [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/8270b791-0201-4231-9d89-e5074459be2f [2] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00 [3] https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161440 Title: Smartcard auth with Windows Server 2025 fails with "Checksum must be included" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2161440/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
