<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-GB>Hello,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>I am trying to install a rhel6 machine with the ipa-1.2.2 client.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>Everything appears to work fine, with the exception of updating users passwords from the client.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>From the user perspective, I get this:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><i><span lang=EN-GB>Changing password for user andytest.<o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>Kerberos 5 Password: <o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>New password: <o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>Retype new password: <o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>passwd: Authentication token manipulation error<o:p></o:p></span></i></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>From the local secure log, I see this:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><i><span lang=EN-GB>Mar 22 10:57:19 rhel6-test2 passwd: pam_unix(passwd:chauthtok): user "andytest" does not exist in /etc/passwd<o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>Mar 22 10:57:29 rhel6-test2 passwd: pam_unix(passwd:chauthtok): user "andytest" does not exist in /etc/passwd<o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>Mar 22 10:58:01 rhel6-test2 passwd: pam_krb5[25306]: password change failed for andytest@LIVE.TIPP24.NET: Cannot contact any KDC for requested realm</span></i><span lang=EN-GB><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>There are no local or network firewalls between the client and the IPA server, and every other piece of IPA functionality appears to work fine.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>On the IPA server itself, I see this in krb5kdc:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): no valid preauth type found: Success<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): AS_REQ (4 etypes {18 17 16 23}) XX.XX.XX.XX: PREAUTH_FAILED: andytest@LIVE.TIPP24.NET for kadmin/changepw@LIVE.TIPP24.NET, Preauthentication failed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): AS_REQ (4 etypes {18 17 16 23}) XX.XX.XX.XX: NEEDED_PREAUTH: andytest@LIVE.TIPP24.NET for kadmin/changepw@LIVE.TIPP24.NET, Additional pre-authentication required<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): AS_REQ (4 etypes {18 17 16 23}) XX.XX.XX.XX: ISSUE: authtime 1300787846, etypes {rep=18 tkt=18 ses=18}, andytest@LIVE.TIPP24.NET for <a href="mailto:kadmin/changepw@LIVE.TIPP24.NET">kadmin/changepw@LIVE.TIPP24.NET</a><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>nsswitch.conf has the usual stuff:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><i><span lang=EN-GB>passwd: files ldap<o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>shadow: files ldap<o:p></o:p></span></i></p><p class=MsoNormal><i><span lang=EN-GB>group: files ldap</span></i><span lang=EN-GB><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>I’m not sure what else to check.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>Andy<o:p></o:p></span></p></div></body></html>