[Freeipa-users] NEEDED_PREAUTH: Additional pre-authentication required - User can't access any centos server

[Rob Crittenden]

Gady Notrica wrote:
> Hi guys,
>
>  From the ipa server, I am having issue with the single user. Everyone
> else is fine, just this one single user and no help anywhere online.
>
> Please help!

Decrypt integrity check failed almost always means bad password.

rob

>
> Thank you
>
> Apr 15 15:43:36 ipa.domain.com krb5kdc[2568](info): AS_REQ (6 etypes {18
> 17 16 23 25 26}) 172.20.10.40: *NEEDED_PREAUTH*: bcosmos at IPA.DOMAIN.COM
> for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, *Additional pre-authentication
> required*
>
> Apr 15 15:43:36 ipa.domain.com krb5kdc[2568](info): closing down fd 12
>
> Apr 15 15:43:41 ipa.domain.com krb5kdc[2565](info): preauth
> (encrypted_timestamp) verify failure: *Decrypt integrity check failed*
>
> Apr 15 15:43:41 ipa.domain.com krb5kdc[2565](info): AS_REQ (6 etypes {18
> 17 16 23 25 26}) 172.20.10.40: *PREAUTH_FAILED*: bcosmos at IPA.DOMAIN.COM
> for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, Decrypt integrity check failed
>
> Apr 15 15:43:41 ipa.domain.com krb5kdc[2565](info): closing down fd 12
>
> Apr 15 15:43:49 ipa.domain.com krb5kdc[2568](info): AS_REQ (6 etypes {18
> 17 16 23 25 26}) 172.20.10.40: *NEEDED_PREAUTH*: bcosmos at IPA.DOMAIN.COM
> for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, *Additional pre-authentication
> required*
>
> Apr 15 15:43:49 ipa.domain.com krb5kdc[2568](info): closing down fd 12
>
> Apr 15 15:43:55 ipa.domain.com krb5kdc[2565](info): preauth
> (encrypted_timestamp) verify failure: *Decrypt integrity check failed*
>
> Apr 15 15:43:55 ipa.domain.com krb5kdc[2565](info): AS_REQ (6 etypes {18
> 17 16 23 25 26}) 172.20.10.40: *PREAUTH_FAILED*: bcosmos at IPA.DOMAIN.COM
> for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, Decrypt integrity check failed
>
> Gady Notrica| IT Systems Analyst | 416.814.7800 Ext. 7921 | Cell.
> 416.818.4797 | gnotrica at candeal.com <mailto:gnotrica at candeal.com>
>
> CanDeal | 152 King St. E, 4th Floor, Toronto ON M5A 1J4 |
> www.candeal.com <http://www.candeal.ca/>| Follow us:Description:
> Description: cid:image003.jpg at 01CBD419.622CDF90
> <http://www.twitter.com/candeal>*Description: Description: Description:
> cid:image002.jpg at 01CBD419.622CDF90*
> <http://www.linkedin.com/profile/view?id=36869324&trk=tab_pro>
>
>
>