Kerberos authentication against FreeIPA - FAST Tunnel support

[Prashant Bapat]

Hi ,

I'm trying to implement a IdP authentication against FreeIPA/Kerberos. For
user without an OTP in FreeIPA the authentication works fine. But if the
user has an OTP, login fails with below error.

javax.security.auth.login.LoginException: Pre-authentication information
was invalid (24) - PREAUTH_FAILED
at
com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:804)
Caused by: sun.security.krb5.KrbException: Pre-authentication information
was invalid (24) - PREAUTH_FAILED
at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:82)
Caused by: sun.security.krb5.Asn1Exception: Identifier doesn't match
expected value (906)
at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)

FreeIPA uses a Kerberos FAST tunnel for OTP authentication (
https://tools.ietf.org/html/rfc6113). From the command line, running kinit
fails. We need to run kinit with -T option (armor credential cache).

How to get this working with Shibboleth IdP ? Any help is appreciated.

Thanks.
--Prashant
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160302/6519c19e/attachment.html>