[Freeipa-users] NEEDED_PREAUTH: Additional pre-authentication required - User can't access any centos server

[Sumit Bose]

On Mon, Apr 18, 2016 at 03:08:28PM +0000, Gady Notrica wrote:
> Hi guys,
> 
> >From the ipa server, I am having issue with the single user. Everyone else is fine, just this one single user and no help anywhere online.
> 
> Please help!
> 
> Thank you
> 
> Apr 15 15:43:36 ipa.domain.com krb5kdc[2568](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 172.20.10.40: NEEDED_PREAUTH: bcosmos at IPA.DOMAIN.COM for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, Additional pre-authentication required

NEEDED_PREAUTH is expected

> Apr 15 15:43:36 ipa.domain.com krb5kdc[2568](info): closing down fd 12
> Apr 15 15:43:41 ipa.domain.com krb5kdc[2565](info): preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed

This indicates a wrong password.

HTH

bye,
Sumit

> Apr 15 15:43:41 ipa.domain.com krb5kdc[2565](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 172.20.10.40: PREAUTH_FAILED: bcosmos at IPA.DOMAIN.COM for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, Decrypt integrity check failed
> Apr 15 15:43:41 ipa.domain.com krb5kdc[2565](info): closing down fd 12
> Apr 15 15:43:49 ipa.domain.com krb5kdc[2568](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 172.20.10.40: NEEDED_PREAUTH: bcosmos at IPA.DOMAIN.COM for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, Additional pre-authentication required
> Apr 15 15:43:49 ipa.domain.com krb5kdc[2568](info): closing down fd 12
> Apr 15 15:43:55 ipa.domain.com krb5kdc[2565](info): preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed
> Apr 15 15:43:55 ipa.domain.com krb5kdc[2565](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 172.20.10.40: PREAUTH_FAILED: bcosmos at IPA.DOMAIN.COM for krbtgt/IPA.DOMAIN.COM at IPA.DOMAIN.COM, Decrypt integrity check failed
> 
> Gady Notrica | IT Systems Analyst | 416.814.7800 Ext. 7921 | Cell. 416.818.4797 | gnotrica at candeal.com<mailto:gnotrica at candeal.com>
> CanDeal | 152 King St. E, 4th Floor, Toronto ON M5A 1J4 | www.candeal.com<http://www.candeal.ca/> | Follow us: [Description: Description: cid:image003.jpg at 01CBD419.622CDF90] <http://www.twitter.com/candeal>   [Description: Description: Description: cid:image002.jpg at 01CBD419.622CDF90] <http://www.linkedin.com/profile/view?id=36869324&trk=tab_pro>
> 




> -- 
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project