Domainkey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=message-id:date:from:user-agent:mime-version:to:cc:subject:content-type:content-transfer-encoding; b=pzNuPtjskF6Sv84HAHG7RLLaV0zcUaauDjSFC57kLnUhwtVpfn7Nz4mjOrv5TesIvTLlHNpB4YlyrHEEO0isZEkNXmNq8A5d3XaTx6IBx8ux2if6nqQJp8YxWe33agtKLbFoOtfmk63vPmLhkp+k6ZF1dcWqvd5HnYZ3/CENNhc=
Message-ID: <47F34AFC.2050502@gmail.com>
Date: Wed, 02 Apr 2008 12:59:40 +0400
From: Igor Mammedov <niallain@gmail.com>
User-Agent: Thunderbird 2.0.0.12 (X11/20080213)
MIME-Version: 1.0
To: krb5-bugs@mit.edu
Subject: "Key table entry not found while getting initial credentials" + KRB5KDC_ERR_PREAUTH_REQUIRED
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
CC: krbdev@mit.edu
Precedence: list
Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU
Content-Length: 2702

Hi folks,
Maybe I've found a bug in krb5 libs code.
Here is the thing:
When we store user password in keytab with des-cbc-md5 encryption

with "addent -password -p TESTUSERNAME -k 1 -e des-cbc-md5"

we receive error KRB5KDC_ERR_PREAUTH_REQUIRED from the server and
kinit says "Key table entry not found while getting initial credentials".

Also note that in the dump of the client-server conversation there is no
field "padata" in the request.

-------------- Incorrect case --------------------
User Datagram Protocol, Src Port: 46944 (46944), Dst Port: kerberos (88)
Kerberos AS-REQ
    Pvno: 5
    MSG Type: AS-REQ (10)
    KDC_REQ_BODY
        Padding: 0
        KDCOptions: 40000010 (Forwardable, Renewable OK)
        Client Name (Principal): TESTUSERNAME
        Realm: MY.TEST.REALM
        Server Name (Unknown): krbtgt/MY.TEST.REALM
        from: 2008-04-02 07:56:30 (Z)
        till: 2008-04-03 07:56:30 (Z)
        Nonce: 1207122990
        Encryption Types: rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

User Datagram Protocol, Src Port: kerberos (88), Dst Port: 46944 (46944)
Kerberos KRB-ERROR
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    stime: 2008-04-02 07:55:18 (Z)
    susec: 502936
    error_code: KRB5KDC_ERR_PREAUTH_REQUIRED (25)
    Realm: MY.TEST.REALM
    Server Name (Unknown): krbtgt/MY.TEST.REALM
    e-data

However if we add entry into keytab this way:

"addent -password -p TESTUSERNAME -k 1 -e rc4-hmac"

Then client sends "padata" in the request and the server replies with a valid TGT.

So this is probably a bug in the client code (kinit or krb5 libs), if it is not then
could someone clarify why it works this way?

------------- Normal case --------------------------

User Datagram Protocol, Src Port: 41142 (41142), Dst Port: kerberos (88)
Kerberos AS-REQ
    Pvno: 5
    MSG Type: AS-REQ (10)
    padata: PA-ENC-TIMESTAMP
        Type: PA-ENC-TIMESTAMP (2)
            Value: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX... rc4-hmac
    KDC_REQ_BODY
        Padding: 0
        KDCOptions: 40000010 (Forwardable, Renewable OK)
        Client Name (Principal): TESTUSERNAME
        Realm: MY.TEST.REALM
        Server Name (Unknown): krbtgt/MY.TEST.REALM
        from: 2008-04-02 08:05:01 (Z)
        till: 2008-04-03 08:05:01 (Z)
        Nonce: 1207123501
        Encryption Types: rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

User Datagram Protocol, Src Port: kerberos (88), Dst Port: 41142 (41142)
Kerberos AS-REP
    Pvno: 5
    MSG Type: AS-REP (11)
    Client Realm: MY.TEST.REALM
    Client Name (Principal): TESTUSERNAME
    Ticket
    enc-part rc4-hmac


-- 

Best regards,

-------------------------
Igor Mammedov,
niallain "at" gmail.com