Kerberos principle not getting updated after IPA user password change

Solution In Progress - Updated -

Environment

  • Red Hat Enterprise Linux 6
  • IPA 3.0

Issue

  • Kerberos principle not getting updated after password reset. Its always points to password that was set initially.

Resolution

  • The following plugins should be enabled:
dn: cn=ipa_pwd_extop,cn=plugins,cn=config
nsslapd-pluginEnabled: off
  • The plugins mentioned in the file /etc/dirsrv/slapd-DOMAIN/dse.ldif are normally enabled by default
dn: cn=IPA MODRDN,cn=plugins,cn=config
dn: cn=IPA Range-Check,cn=plugins,cn=config
dn: cn=IPA UUID,cn=plugins,cn=config
dn: cn=IPA Version Replication,cn=plugins,cn=config
dn: cn=ipa-winsync,cn=plugins,cn=config
dn: cn=ipa_enrollment_extop,cn=plugins,cn=config
dn: cn=ipa_pwd_extop,cn=plugins,cn=config
dn: cn=ipaUniqueID uniqueness,cn=plugins,cn=config

Root Cause

  • the ipa_pwd_extop plug-in of the Directory Server should be enabled, it handles password changes and also enforces the password policies

Diagnostic Steps

  • Resetting the password with ipa user-mod or in the GUI , the kerberos principle is not getting updated.
  • Using kpasswd the kerberos principle is getting updated but using the old password which was used to create the user initially.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.