Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-22206

Errors in krb5_child.log every time a user authenticates - Pre-authentication failed: No pkinit_anchors supplied

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Normal Normal
    • rhel-9.5
    • rhel-9.3.0
    • sssd
    • sssd-2.9.5-1.el9
    • None
    • Moderate
    • rhel-sst-idm-sssd
    • ssg_idm
    • 12
    • 14
    • 0
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None

      Issue:  Errors in krb5_child.log every time a user authenticates - Pre-authentication failed: No pkinit_anchors supplied

      NOTE: User authentication is working fine.

      Expected results: The krb5_child.log should not contain "Pre-authentication failed: No pkinit_anchors supplied" error after every successful authentication.

      Actual results: The logs are filled with these errors:

      ~~~~

      Dec 28 05:00:46 dc01zld0141 krb5_child[1758711]: Pre-authentication failed: No pkinit_anchors supplied
      Dec 28 05:00:46 dc01zld0155 krb5_child[1732435]: Pre-authentication failed: No pkinit_anchors supplied
      Dec 28 05:00:46 dc01zld0147 krb5_child[657019]: Pre-authentication failed: No pkinit_anchors supplied
      Dec 28 05:00:47 dc01zld0148 krb5_child[666607]: Pre-authentication failed: No pkinit_anchors supplied
      Dec 28 05:03:51 dc01zld0143 krb5_child[700393]: Pre-authentication failed: No pkinit_anchors supplied
      Dec 28 05:03:51 dc01zld0138 krb5_child[1748037]: Pre-authentication failed: No pkinit_anchors supplied

      ~~~~

       

      Steps Taken:


      Added "pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt" line in krb5.conf file.


       

      Now, the following error can be seen in the krb5_child logs:
      --------
      [112262] 1705492282.364723: PKINIT client has no configured identity; giving up
      [112262] 1705492282.364724: PKINIT client has no configured identity; giving up
      [112262] 1705492282.364725: Preauth module pkinit (16) (real) returned: 22/Invalid argument
      --------

      >> How do we get rid of those errors?

       

              sbose@redhat.com Sumit Bose
              rhn-support-sjawale Shradha Jawale
              SSSD Maintainers SSSD Maintainers
              Anuj Borah Anuj Borah
              Louise McGarry Louise McGarry
              Votes:
              0 Vote for this issue
              Watchers:
              18 Start watching this issue

                Created:
                Updated:
                Resolved: