<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 03/22/2011 06:11 AM, Andy Singleton wrote:
<blockquote
cite="mid:1CD40A4DEEA320479C98D8A93A5C690603F41FDE@waterloo.t24uk.tipp24.net"
type="cite">
<pre wrap="">Hello,
I am trying to install a rhel6 machine with the ipa-1.2.2 client.
Everything appears to work fine, with the exception of updating users
passwords from the client.
>From the user perspective, I get this:
Changing password for user andytest.
Kerberos 5 Password:
New password:
Retype new password:
passwd: Authentication token manipulation error
>From the local secure log, I see this:
Mar 22 10:57:19 rhel6-test2 passwd: pam_unix(passwd:chauthtok): user
"andytest" does not exist in /etc/passwd
Mar 22 10:57:29 rhel6-test2 passwd: pam_unix(passwd:chauthtok): user
"andytest" does not exist in /etc/passwd
Mar 22 10:58:01 rhel6-test2 passwd: pam_krb5[25306]: password change
failed for <a class="moz-txt-link-abbreviated" href="mailto:andytest@LIVE.TIPP24.NET:">andytest@LIVE.TIPP24.NET:</a> Cannot contact any KDC for
requested realm
There are no local or network firewalls between the client and the IPA
server, and every other piece of IPA functionality appears to work fine.
On the IPA server itself, I see this in krb5kdc:
Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): no valid preauth
type found: Success
Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): AS_REQ (4 etypes {18
17 16 23}) XX.XX.XX.XX: PREAUTH_FAILED: <a class="moz-txt-link-abbreviated" href="mailto:andytest@LIVE.TIPP24.NET">andytest@LIVE.TIPP24.NET</a> for
<a class="moz-txt-link-abbreviated" href="mailto:kadmin/changepw@LIVE.TIPP24.NET">kadmin/changepw@LIVE.TIPP24.NET</a>, Preauthentication failed
Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): AS_REQ (4 etypes {18
17 16 23}) XX.XX.XX.XX: NEEDED_PREAUTH: <a class="moz-txt-link-abbreviated" href="mailto:andytest@LIVE.TIPP24.NET">andytest@LIVE.TIPP24.NET</a> for
<a class="moz-txt-link-abbreviated" href="mailto:kadmin/changepw@LIVE.TIPP24.NET">kadmin/changepw@LIVE.TIPP24.NET</a>, Additional pre-authentication required
Mar 22 10:57:26 myipa.mydomain krb5kdc[2255](info): AS_REQ (4 etypes {18
17 16 23}) XX.XX.XX.XX: ISSUE: authtime 1300787846, etypes {rep=18
tkt=18 ses=18}, <a class="moz-txt-link-abbreviated" href="mailto:andytest@LIVE.TIPP24.NET">andytest@LIVE.TIPP24.NET</a> for
<a class="moz-txt-link-abbreviated" href="mailto:kadmin/changepw@LIVE.TIPP24.NET">kadmin/changepw@LIVE.TIPP24.NET</a>
nsswitch.conf has the usual stuff:
passwd: files ldap
shadow: files ldap
group: files ldap
I'm not sure what else to check.
Andy
</pre>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>