heimdal and mit kinit doesn't handle expired credentials

[urusha]

Hi.

ubuntu 12.04 i386,amd64

For now kerberos (both - mit and heimdal) kinit doesn't handle expired (or 'must change') passwords. That's a serious regression (lucid is fine) - no integration (pam) into kerberos environments that use password expiration could be done. Tested with heimdal kdc (file and ldap db) and win2008r2 kdc on several machines. This bug stops us from migrating to the next LTS in our environment. Thinking it should be fixed.
Heimdal KDC logs are in the attachment. What I can see in these logs is that lucid heimdal kinit doesn't send REQ-ENC-PA-REP patype while precise kinits send. May this be the reason? If more info is needed please just ask.

How to reproduce:

# apt-get -y install heimdal-kdc
# cat > /etc/krb5.conf
[libdefaults]
 default_realm = TEST.LAN

[realms]
 TEST.LAN = {
     kdc=127.0.0.1
 }

# kadmin -l init TEST.LAN
# kadmin -l add test
Max ticket life [1 day]:
Max renewable life [1 week]:
Principal expiration time [never]:
Password expiration time [never]:2000-01-01 # Set expiration time to the past
Attributes []:
Policy [default]:
<email address hidden>'s Password:
Verify password - <email address hidden>'s Password:

# apt-get -y install heimdal-clients
# dpkg -l |grep heimdal-clients
ii heimdal-clients 1.6~git20120311.dfsg.1-2 Heimdal Kerberos - clients
# kinit --version
kinit (Heimdal 1.5.99)
Copyright 1995-2011 Kungliga Tekniska Högskolan
Send bug-reports to <email address hidden>
# kinit test
<email address hidden>'s Password:
kinit: krb5_get_init_creds: Password has expired

And no asking for changing password.

# apt-get -y install krb5-user
# dpkg -l |grep krb5-user
ii krb5-user 1.10+dfsg~beta1-2 Basic programs to authenticate using MIT Kerberos
# kinit test
Password for <email address hidden>:
kinit: Generic preauthentication failure while getting initial credentials

And no asking for changing password again.
But kpasswd works fine (heimdal & mit):
# kpasswd test
<email address hidden>'s Password:
Your password will expire at Tue Jan 2 02:59:59 2000

New password for <email address hidden>:
Verify password - New password for <email address hidden>:
Success : Password changed

The same time all works fine with ubuntu 10.04 heimdal (1.2) and freebsd 9.0 heimdal (1.1) (kdc is still from ubuntu 12.04), it does change password if it's required.

Thanks.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[urusha (urusha)]

The part of this bug about mit kinit seems to be duplicate of https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/1003369
So, I think it's better to discuss it there.

But heimdal part is a new bug, let's discuss it here.

[Olivier Diotte (vhann3000)]

Hum, this is weird, things work fine here (12.04) with MIT Kerberos:
superuser@Enzo:~$ su - vhann
Password:
vhann@Enzo:~$ exit
déconnexion
superuser@Enzo:~$ kadmin -p kadmin/admin
Authenticating as principal kadmin/admin with password.
Password for <email address hidden>:
kadmin: modprinc -pwexpire now vhann
Principal "<email address hidden>" modified.
kadmin: exit
superuser@Enzo:~$ su - vhann
Password:
Password expired. You must change it now.
Enter new password:
Enter it again:
vhann@Enzo:~$

I can provide configuration files if needed.

[Olivier Diotte (vhann3000)]

Hum, I also tested with the 'modprinc -pwexpire 2011-12-01 vhann' syntax. Both works. That being said, my KDC/kadmind server is MIT Kerberos too.

[urusha (urusha)]

mit kinit has been fixed here: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/988520

[Nish Aravamudan (nacc)]

Fixed in Debian heimdal 1.7~git20150920+dfsg-4.

rmadison reports:

 heimdal | 1.7~git20150920+dfsg-4ubuntu1 | xenial | source
 heimdal | 1.7~git20150920+dfsg-4ubuntu1 | yakkety | source
 heimdal | 1.7~git20160703+dfsg-1ubuntu1 | zesty | source

[Nish Aravamudan (nacc)]

If you are still affected by this issue on 12.04 or 14.40, please reply in this bug and we can consider it for SRU.