freeipa

#4411 Unable to kinit with OTP
Closed: fixed by frenaud. Opened by edewata.

Closed: fixed
Reopen Issue

If OTP is enabled the user cannot perform kinit.

Steps to reproduce:
1. As admin, create a new user with password.
2. Enable OTP authentication for this user.
3. Create an either TOTP or HOTP token for this user.
4. Run kinit as this user.

Actual result:

$ kinit testuser
kinit: Generic preauthentication failure while getting initial credentials

When the OTP authentication is disabled for this user, kinit will work normally (i.e. prompting for password).

Expected result: The kinit should work with OTP.

Currently, this is either "by design" or "known issue." FAST is required, so you need to use the kinit -T option. We are currently exploring enabling FAST automatically where possible. For more details, see: http://mailman.mit.edu/pipermail/krbdev/2014-May/011958.html

Nathaniel, please update the design document to mention this limitation and then close this ticket.

FreeIPA 4.0.1 was released, moving to next bugfixing release milestone.

Not a priority for 4.0 - postponing.

FreeIPA 4.1.1 was released.

4.1.2 was released.

4.1.3 was released.

4.1.4 was released, moving to new milestone

Moving tickets as per freeipa-devel message.

FreeIPA 4.2.1 was released, moving to 4.2.x.

It seems like this makes it impossible to enrol a new system with ipa-client-install , if the user(s) who can enrol new systems are 2FA-only?

I wanted to make it so my FreeIPA admin user is 2FA-only, but if I try to enrol a new client with freeipa-client-install , it seems it calls 'kinit admin@mydomain -c /tmp/sometmpfile' and hits exactly this error...so I'm kinda stuck, right, unless I temporarily disable 2FA for my admin user? That sucks.

edit: well, you can use a one-time password for enrolment I guess.

This is the current limitation of kinit. Sorry.

Requires SPAKE or #5678 therefore moving out of 4.3.x

Metadata Update from @edewata:
- Issue assigned to npmccallum
- Issue set to the milestone: FreeIPA 4.5 backlog

It seems like this makes it impossible to enrol a new system with ipa-client-install , if the user(s) who can enrol new systems are 2FA-only?
I wanted to make it so my FreeIPA admin user is 2FA-only, but if I try to enrol a new client with freeipa-client-install , it seems it calls 'kinit admin @mydomain -c /tmp/sometmpfile' and hits exactly this error...so I'm kinda stuck, right, unless I temporarily disable 2FA for my admin user? That sucks.
edit: well, you can use a one-time password for enrolment I guess.

@adamwill How did you solve this?

@rdegraaff We have a separate issue to track enrollment with 2FA enabled. Since we now support PKINIT in 4.5+, this can be done by utilizing anonymous PKINIT. See https://pagure.io/freeipa/issue/6665

Metadata Update from @abbra:
- Issue close_status updated to: None

@rdegraaff sorry, I honestly don't remember whether or how I did. I probably temporarily disabled 2FA.

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1510734 (was: 0)

Issue linked to bug 1510734

For anyone ending up in this thread, please follow these steps to make kinit work with OTP: https://docs.fedoraproject.org/en-US/fedora-accounts/user/#pkinit

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7954 (was: 0)
- Issue assigned to abbra (was: npmccallum)
- Issue set to the milestone: None (was: FreeIPA 4.5 backlog)

Upstream PR: https://github.com/freeipa/freeipa/pull/7954

The fix requires krb5 build from rawhide https://bodhi.fedoraproject.org/updates/FEDORA-2025-fec02ace45 krb5-1.21.3-8.fc44

master:

  • 166dbfb630440819eb17c6d7a268a5b5e736908b krb5.conf templates: remove Kerberos 4 support
  • 890474ae3c48eec1aca180fc1db0613e67572a85 krb5.conf templates: move IPA domain configuration into a separate snippet
  • 7a6391f245257e53ec1d648e2186c9ece069e901 Require krb5.conf.d because we install snippets there

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
defect
Wiki
None
https://github.com/freeipa/freeipa/pull/7954
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.