<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Thanks.</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"> </div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Let me figure out possible alternatives. </div></div><div class="gmail_extra"> <div class="gmail_quote">On 3 March 2016 at 00:20, Simo Sorce <<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Wed, 2016-03-02 at 16:25 +0530, Prashant Bapat wrote: > Thanks. But my problem is not OTP per se but Kerberos thru Java. > Specifically i'm getting below error. > > javax.security.auth.login.LoginException: Pre-authentication information > was invalid (24) - PREAUTH_FAILED > at > com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:804) > Caused by: sun.security.krb5.KrbException: Pre-authentication information > was invalid (24) - PREAUTH_FAILED > at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:82) > Caused by: sun.security.krb5.Asn1Exception: Identifier doesn't match > expected value (906) > at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140) > > Any pointers ? Unfortunately Java tends to lag way behind with Krb5 and GSSAPI featurs an APIs (years behind). In this case what happens is that your Java module probably does not support FAST preauth. > On 1 March 2016 at 21:01, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com">abokovoy@redhat.com</a>> wrote: > > > On Tue, 01 Mar 2016, Prashant Bapat wrote: > > > >> Hi, > >> > >> I'm trying to use Shibboleth IdP with FreeIPA and Kerberos Authentication. > >> I'm aware of Ipsilon, just that Shibboleth is more suited for my use case. > >> > >> I've installed ipa-client on a server and connected it to ipa. Shibboleth > >> is installed on this server and I'm able to get the Kerberos > >> authentication > >> working. Documented here > >> < > >> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration</a> > >> > > >> . > >> > >> However if I bring OTP into picture, authentication fails. Error message > >> is > >> like "Pre-authentication information was invalid (24) - PREAUTH_FAILED". > >> > >> Any pointers on how to make OTP work? > >> > > <a href="http://www.freeipa.org/page/V4/OTP" rel="noreferrer" target="_blank">http://www.freeipa.org/page/V4/OTP</a> > > <a href="http://www.freeipa.org/page/V4/OTP/Detail" rel="noreferrer" target="_blank">http://www.freeipa.org/page/V4/OTP/Detail</a> > > > > -- > > / Alexander Bokovoy > > > -- > Manage your subscription for the Freeipa-users mailing list: > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project -- Simo Sorce * Red Hat, Inc * New York </blockquote></div> </div>