<div dir="ltr"><div>I got some extra log output: seems that FAST IS being used. I am running SSSD 1.11.6, which is supposed to have above mentioned issues fixed:<br><br></div>Log:<br>=================<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [find_principal_in_keytab] (0x4000): Trying to find principal host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> in keytab.<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [match_principal] (0x1000): Principal matched to the sample (host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a>).<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.361296: Retrieving host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krbtgt/<a href="mailto:MY.DOMAIN.COM@MY.DOMAIN.COM">MY.DOMAIN.COM@MY.DOMAIN.COM</a> from FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a> with result: 0/Success<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [check_fast_ccache] (0x0200): FAST TGT is still valid.<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [main] (0x0400): Will perform online auth<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [tgt_req_child] (0x1000): Attempting to get a TGT<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [<a href="http://MY.DOMAIN.COM">MY.DOMAIN.COM</a>]<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.361440: Getting initial credentials for <a href="mailto:michael@MY.DOMAIN.COM">michael@MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.361508: FAST armor ccache: FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.361575: Retrieving host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krb5_ccache_conf_data/fast_avail/krbtgt\/<a href="http://MY.DOMAIN.COM">MY.DOMAIN.COM</a>\@MY.DOMAIN.COM@X-CACHECONF: from FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a> with result: -1765328243/Matching credential not found<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.361648: Sending request (188 bytes) to <a href="http://MY.DOMAIN.COM">MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.361842: Sending initial UDP request to dgram <a href="http://1.1.1.2:88">1.1.1.2:88</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.365901: Received answer from dgram <a href="http://1.1.1.2:88">1.1.1.2:88</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.365981: Response was from master KDC<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366020: Received error from KDC: -1765328359/Additional pre-authentication required<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366051: Upgrading to FAST due to presence of PA_FX_FAST in reply<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366075: Restarting to upgrade to FAST<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366102: FAST armor ccache: FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366161: Retrieving host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krb5_ccache_conf_data/fast_avail/krbtgt\/<a href="http://MY.DOMAIN.COM">MY.DOMAIN.COM</a>\@MY.DOMAIN.COM@X-CACHECONF: from FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a> with result: -1765328243/Matching credential not found<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366191: Upgrading to FAST due to presence of PA_FX_FAST in reply<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366215: FAST armor ccache: FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366267: Retrieving host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krb5_ccache_conf_data/fast_avail/krbtgt\/<a href="http://MY.DOMAIN.COM">MY.DOMAIN.COM</a>\@MY.DOMAIN.COM@X-CACHECONF: from FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a> with result: -1765328243/Matching credential not found<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366322: Getting credentials host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krbtgt/<a href="mailto:MY.DOMAIN.COM@MY.DOMAIN.COM">MY.DOMAIN.COM@MY.DOMAIN.COM</a> using ccache FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366380: Retrieving host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krbtgt/<a href="mailto:MY.DOMAIN.COM@MY.DOMAIN.COM">MY.DOMAIN.COM@MY.DOMAIN.COM</a> from FILE:/var/lib/sss/db/<a href="http://fast_ccache_MY.DOMAIN.COM">fast_ccache_MY.DOMAIN.COM</a> with result: 0/Success<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366425: Armor ccache sesion key: aes256-cts/9082<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366476: Creating authenticator for host/<a href="mailto:ipaclient.my.domain.com@MY.DOMAIN.COM">ipaclient.my.domain.com@MY.DOMAIN.COM</a> -> krbtgt/<a href="mailto:MY.DOMAIN.COM@MY.DOMAIN.COM">MY.DOMAIN.COM@MY.DOMAIN.COM</a>, seqnum 0, subkey aes256-cts/F5B0, session key aes256-cts/9082<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366562: FAST armor key: aes256-cts/0D88<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366605: Encoding request body and padata into FAST request<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366675: Sending request (1089 bytes) to <a href="http://MY.DOMAIN.COM">MY.DOMAIN.COM</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.366752: Sending initial UDP request to dgram <a href="http://1.1.1.2:88">1.1.1.2:88</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370122: Received answer from dgram <a href="http://1.1.1.2:88">1.1.1.2:88</a><br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370193: Response was from master KDC<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370232: Received error from KDC: -1765328359/Additional pre-authentication required<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370262: Decoding FAST response<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370333: Processing preauth types: 136, 141, 133, 137<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370364: Received cookie: MIT<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [sss_child_krb5_trace_cb] (0x4000): [2451] 1416693343.370404: Produced preauth for next request: 133<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [get_and_save_tgt] (0x0020): 981: [-1765328174][Generic preauthentication failure]<br>(Sat Nov 22 14:55:43 2014) [[sssd[krb5_child[2451]]]] [map_krb5_error] (0x0020): 1043: [-1765328174][Generic preauthentication failure]<br><br>=================<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Nov 22, 2014 at 1:14 PM, Michael Lasevich <span dir="ltr"><<a href="mailto:mlasevich@lasevich.net" target="_blank">mlasevich@lasevich.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>Reviving this as I am still stuck with CentOS 6. <br><br>CentOS 6.6 now has sssd 1.11 - yet I still cannot get the OTP to work under PAM:<br><br></div>I created a test user and added an otp. User works fine without the OTP, however I keep getting this when trying to test with OTP via pamtester:<br><br>pamtester: pam_sss(login:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=michael<br>pamtester: pam_sss(login:auth): received for user michael: 17 (Failure setting user credentials)<br><br></div>Is there a way to get more information as to what is going on?<br><br></div>Is my expectation that I would provide otp in a form of "password123456" correct (assuming my password is "password" and otp token is "123456")?<br><br><br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 15, 2014 at 2:29 AM, Michael Lasevich <span dir="ltr"><<a href="mailto:mlasevich@lasevich.net" target="_blank">mlasevich@lasevich.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks, glad I asked before wasting time.<br></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 15, 2014 at 1:07 AM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On Thu, Aug 14, 2014 at 01:19:58PM -0700, Michael Lasevich wrote:<br> > I did not dive into this yet, but before I waste too much time I wanted to<br> > ask if centos 6.5 default ipa client expected to work with 2FA or not.<br> <br> </div>No it's not, sorry. The 6.5 client is SSSD 1.9.x and there's a couple of<br> fixes that landed during the 1.11 development such as:<br> <a href="https://fedorahosted.org/sssd/ticket/2186" target="_blank">https://fedorahosted.org/sssd/ticket/2186</a><br> or:<br> <a href="https://fedorahosted.org/sssd/ticket/2271" target="_blank">https://fedorahosted.org/sssd/ticket/2271</a><br> plus some other commits I see in git log which don't reference any ticket.<br> <br> I'd suggest to test using a centos 7.0 client.<br> <span><font color="#888888"><br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br> </font></span></blockquote></div><br></div> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div>