fedora-packager

#176 Add kpasswd_server to the Kerberos configuration
Merged by kevin. Opened by abompard.
abompard/fedora-packager kpasswd-server  into  main

Download 176.patch

According to the KdcProxy docs, the configuration should have a kpasswd_server entry. It will enable the necessary password change flow for users with an expired password,
and prevent issues such as noggin #895.

Without this value:

$ kinit -T FILE:/tmp/armor.ccache abompard@STG.FEDORAPROJECT.ORG
Enter OTP Token Value: [password+OTP]
Password expired.  You must change it now.
Enter new password: [new password]
Enter it again: [new password]
kinit: Cannot find KDC for realm "STG.FEDORAPROJECT.ORG" while getting initial credentials

With this value:

$ kinit -T FILE:$HOME/armor.ccache abompard@STG.FEDORAPROJECT.ORG
Enter OTP Token Value: [password+OTP]
Password expired.  You must change it now.
Enter new password: [new password]
Enter it again: [new password]
Enter OTP Token Value: [password+OTP]

Huh. I thought this wouldn't work with OTP... but it sounds like it does?

If so, +1 from me.

Is there also a DNS entry for kpasswd server we should add?

The updated krb5 config with a defined kpasswd_server let me unlock my account. The web password reset flow is still having issues. I've updated my comments in the Github issue.

There is one clarifying item here:

init -T FILE:$HOME/armor.ccache user@REALM
Enter OTP Token Value: [current password+OTP]
Password expired.  You must change it now.
Enter new password: [new password]
Enter it again: [new password]
Enter OTP Token Value: [new password+OTP]

Lets go ahead and merge this.

Pull-Request has been merged by kevin
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.