freeipa

#2496 krbpasswordexpiration field in LDAP can not have value >= 20380119031408Z
Closed: fixed by sumenon. Opened by dpal.

Closed: fixed
Reopen Issue

https://bugzilla.redhat.com/show_bug.cgi?id=797333 (Red Hat Enterprise Linux 6)

+++ This bug was initially created as a clone of Bug #796641 +++
Description of problem:
kinit fails with the message:
kinit: ASN.1 failed call to system time library while getting initial
credentials
Or (krbpasswordexpiration == 20380119031408Z) tels you to change your password:
Password expired.  You must change it now.
Enter new password:
Version-Release number of selected component (if applicable):
krb5-server-1.9.2-6.fc16.x86_64
krb5-workstation-1.9.2-6.fc16.x86_64
freeipa-server-2.1.4-5.fc16.x86_64
389-ds-base-1.2.10-0.10.rc1.fc16.x86_64
How reproducible:
-
- use "kinit <user>"
Steps to Reproduce:
1.
Use ldapmodify to change the value of "krbpasswordexpiration" to
20380119031408Z "<user>"
2.
Use "kinit <user>" to get a ticket
3. repeat steps 1 and 2 with a value larger than 20380119031408Z
4. repeat steps 1 and 2 with a valu of 20380119031407Z or lower
Actual results:
2.
Password expired.  You must change it now.
3.
kinit: ASN.1 failed call to system time library while getting initial
credentials
Expected results:
- like in the case 4.
ticket granted, klist lists the ticket
Additional info:

This is no longer reproducible. The underlying issue has been fixed, see:

0e8a329048629f639ae64ff32e01e12a495e7763

https://fedorahosted.org/freeipa/ticket/3312

I do not think that the real issue is fixed, krbpasswordexpiration field in LDAP still can not have value >= 20380119031408Z.

We just worked around the issue and forbid such values. To fix the real issue and be able to create expiration beyond 2038, we need the underlying fixes in Kerberos KDC.

Testing on CentOS 7 (x86_64) and FreeIPA v4.2 shows this issue may have been overtaken by events, or possibly only a problem for 32bit architectures?

I have a password policy with a maxage of 20000. I then changed my password and now have a krbPasswordExpiration of 23/04/2071 12:00:32 PM (20710423023032Z).

I can perform a kdestroy and kinit for this user. Also restarted all IPA services and tried again. The KDC appears to support passwords with expirations beyond 2038 now.

Metadata Update from @dpal:
- Issue assigned to rcritten
- Issue set to the milestone: Tickets Deferred

master:

  • 9f49a8daa6d5a2af247efb81e6cddbf9a777a17f Test that certificates beyond 2038 can be parsed
  • f2a8f5cc9f6ff8f1d6af59f3a384fda3ca8aa93a Test that password expiration date past 2038 works

ipa-4-12:

  • ec92f726c3e14db135e11268983e9e842fcaf485 Test that certificates beyond 2038 can be parsed
  • be7255ea6025df423348ad58abcea6c23df1d634 Test that password expiration date past 2038 works

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
defect
IPA
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.