Loading...

Type: Bug
Resolution: Unresolved
Priority: Minor
Fix Version/s: None
Affects Version/s: rhel-9.1.0
Component/s: krb5
Labels:
- MigratedToJIRA
- Triaged

Regression:
None
Severity:
Moderate

Pool Team:

rhel-sst-idm-ipa
Sub-System Group:

ssg_idm

Story Points:
None
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Product Documentation Required:
None
Sprint:
None

Preliminary Testing:
None
Test Coverage:
None

Release Note Type:
Known Issue
Release Note Text:

Hide
.Heimdal client fails to authenticate a user using PKINIT against RHEL 9 KDC

By default, a Heimdal Kerberos client initiates the PKINIT authentication of an IdM user by using Modular Exponential (MODP) Diffie-Hellman Group 2 for Internet Key Exchange (IKE). However, the MIT Kerberos Distribution Center (KDC) on RHEL 9 only supports MODP Group 14 and 16.

Consequently, the pre-autentication request fails with the `krb5_get_init_creds: PREAUTH_FAILED` error on the Heimdal client and `Key parameters not accepted` on the RHEL MIT KDC.

To work around this problem, ensure that the Heimdal client uses MODP Group 14. Set the `pkinit_dh_min_bits` parameter in the `libdefaults` section of the client configuration file to 1759:

[literal]
----
[libdefaults]
pkinit_dh_min_bits = 1759
----

As a result, the Heimdal client completes the PKINIT pre-authentication against the RHEL MIT KDC.

Show
.Heimdal client fails to authenticate a user using PKINIT against RHEL 9 KDC By default, a Heimdal Kerberos client initiates the PKINIT authentication of an IdM user by using Modular Exponential (MODP) Diffie-Hellman Group 2 for Internet Key Exchange (IKE). However, the MIT Kerberos Distribution Center (KDC) on RHEL 9 only supports MODP Group 14 and 16. Consequently, the pre-autentication request fails with the `krb5_get_init_creds: PREAUTH_FAILED` error on the Heimdal client and `Key parameters not accepted` on the RHEL MIT KDC. To work around this problem, ensure that the Heimdal client uses MODP Group 14. Set the `pkinit_dh_min_bits` parameter in the `libdefaults` section of the client configuration file to 1759: [literal] ---- [libdefaults] pkinit_dh_min_bits = 1759 ---- As a result, the Heimdal client completes the PKINIT pre-authentication against the RHEL MIT KDC.
Release Note Status:
Done

Experience:
Architecture:

Unspecified
Bugzilla Bug:
RHBZ: 2106296

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Planning:
None

Description of problem:
Heimdal client fails to authenticate a user against MIT krb5 KDC.

Version-Release number of selected component (if applicable):
krb5-server-1.19.1-22.el9.x86_64
heimdal-workstation-7.7.0-8.fc34.x86_64
crypto-policies=DEFAULT
RHEL-9.1.0-20220708.0

How reproducible:

Steps to Reproduce:
1. Install MIT krb5 KDC and add user (with REQUIRES_PRE_AUTH attribute)
(conf file kdc.conf was attached)

Generate certificates for client and KDC with the help of this script:
https://gitlab.cee.redhat.com/identity-management/krb5-tests/-/blob/RHEL9.1/tests/Sanity/heimdal-sanity/make_pkinit_cert.sh
./make_pkinit_cert.sh ca ca
server certs:
./make_pkinit_cert.sh kdc kdc CA=ca CN=$HostName REALM=TEST.REDHAT.COM CLIENT=$HostName
client certs:
./make_pkinit_cert.sh client $krb5User CA=ca CN=$krb5User"
./make_pkinit_cert.sh client-sign $krb5User CA=ca CN=$krb5User REALM=TEST.REDHAT.COM CLIENT=$krb5User"

2. Set Heimdal client
(conf file heimdal-kdc.conf was attached)

3. try kinit alice:
#KRB5_CONFIG=/tmp/heimdal_krb5.conf heimdal-kinit -C FILE:/tmp/alice.pem,/tmp/alicekey.pem alice@TEST.REDHAT.COM

Actual results:
#KRB5_CONFIG=/tmp/tmp.i1QDKE5BV9/heimdal_krb5.conf heimdal-kinit -C FILE:/tmp/tmp.i1QDKE5BV9/alice.pem,/tmp/tmp.i1QDKE5BV9/alicekey.pem alice@TEST.REDHAT.COM
heimdal-kinit: krb5_get_init_creds: PREAUTH_FAILED

krb5kdc log:
Jul 12 03:40:22 ci-vm-10-0-138-184.hosted.upshift.rdu2.redhat.com krb5kdc[18481](info): preauth (pkinit) verify failure: Key parameters not accepted
Jul 12 03:40:22 ci-vm-10-0-138-184.hosted.upshift.rdu2.redhat.com krb5kdc[18481](info): AS_REQ (2 etypes

{aes256-cts-hmac-sha384-192(20), aes256-cts-hmac-sha1-96(18)}

) 10.0.138.184: PREAUTH_FAILED: alice@TEST.REDHAT.COM for krbtgt/TEST.REDHAT.COM@TEST.REDHAT.COM, Key parameters not accepted

Expected results:
heimdal-kinit should passed with MIT krb5 KDC

Additional info:
NOTE: Heimdal client can be authenticate without PKINIT against Heimdal KDC
NOTE: the certificates should be correct because PKINIT works and user was authenticated when Heimdal client and Heimdal KDC was used.

KRB5_CONFIG=/tmp/tmp.DYLNOriJro/heimdal_krb5.conf heimdal-kinit -C FILE:/tmp/tmp.DYLNOriJro/alice.pem,/tmp/tmp.DYLNOriJro/alicekey.pem alice
KRB5_CONFIG=/tmp/tmp.DYLNOriJro/heimdal_krb5.conf heimdal-klist
Credentials cache: FILE:/tmp/heimdal_ccache
Principal: alice@TEST.REDHAT.COM

Issued Expires Principal
Jul 12 04:11:31 2022 Jul 13 04:11:31 2022 krbtgt/TEST.REDHAT.COM@TEST.REDHAT.COM

heimdal-kdc.log

2022-07-12T04:11:01 KDC started master process pid=24225
2022-07-12T04:11:01 KDC worker process started: 24226
2022-07-12T04:11:31 AS-REQ alice@TEST.REDHAT.COM from IPv4:10.0.138.184 for krbtgt/TEST.REDHAT.COM@TEST.REDHAT.COM
2022-07-12T04:11:31 Client sent patypes: PK-INIT(ietf), 132, REQ-ENC-PA-REP
2022-07-12T04:11:31 Looking for PK-INIT(ietf) pa-data – alice@TEST.REDHAT.COM
2022-07-12T04:11:31 PK-INIT request of type PK-INIT-IETF
2022-07-12T04:11:31 Trying to authorize PK-INIT subject DN CN=alice,OU=dummyunit,O=DummyCompany Ltd,L=Brno,S=Moravia,C=CZ
2022-07-12T04:11:31 Found matching PK-INIT SAN in certificate
2022-07-12T04:11:31 PKINIT pre-authentication succeeded – alice@TEST.REDHAT.COM using CN=alice,OU=dummyunit,O=DummyCompany Ltd,L=Brno,S=Moravia,C=CZ
2022-07-12T04:11:31 PK-INIT using dh RFC2412-MODP-group2
2022-07-12T04:11:31 PK-INIT(ietf) pre-authentication succeeded – alice@TEST.REDHAT.COM
2022-07-12T04:11:31 AS-REQ authtime: 2022-07-12T04:11:31 starttime: unset endtime: 2022-07-13T04:11:31 renew till: unset
2022-07-12T04:11:31 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha384-192, aes128-cts-hmac-sha256-128, des3-cbc-sha1, arcfour-hmac-md5, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
2022-07-12T04:11:31 Requested flags: forwardable
2022-07-12T04:11:31 sending 2668 bytes to IPv4:10.0.138.184