#799243 krb5-user: kadmin should use more verbose output in case of errors

Package:
krb5-user
Source:
krb5
Description:
basic programs to authenticate using MIT Kerberos
Submitter:
Andreas Tille
Date:
2015-09-19 01:12:06 UTC
Severity:
wishlist
#799243#5
Date:
2015-09-17 07:13:33 UTC
From:
To:
Hi,

if I call kadmin after adding those parameters to /etc/krb5.conf that
should be sufficient to my understanding I get:


 kadmin -p admin/admin
Authenticating as principal admin/admin with password.
kadmin: Missing parameters in krb5.conf required for kadmin client while initializing kadmin interface


It would really help if kadmin would tell the user *what* parameters are
missing to simplify providing this parameter.

Thanks for maintaining krb5

      Andreas.
#799243#10
Date:
2015-09-18 03:58:38 UTC
From:
To:
I agree, and I thought that I had asked about this with upstream before,
but I can't find a record of it, so maybe I did not actually ask.  In any
case, I remember getting an answer that by the time the error was
propagated up the stack to where an error could be printed, knowledge of
the actual missing piece(s) of configuration information was lost.
Perhaps it would be possible to add tracepoints for KRB5_TRACE, though --
I'll check with upstream.

In any case, the pieces of information needed are the realm, the hostname
of the kadmin server, and the port if non-default.

If you are interested in debugging your specific case (as opposed to just
requesting the additional diagnostic), is there a hang before the error is
printed?  Can you supply the krb5.conf (and kdc.conf, if applicable) from
the system in question?
#799243#15
Date:
2015-09-18 08:16:10 UTC
From:
To:
Hi Benjamin,

thanks for your quick reply.

OK.

I do not have a kdc.conf but attached krb5.conf.  My application is to
authenticate users on a Debian machine to users maintained in ADS.

I took over the values from some other host that can do the
authentication but kadmin has the same problem.  May be I do not even
need a working kadmin in this application.  I was just following a
howto that started with getting kadmin working.

Kind regards

       Andreas.
#799243#20
Date:
2015-09-18 12:36:01 UTC
From:
To:
A kdc = line is not enough for kadmin to find a server.
You need a admin_server (or I think master_kdc) line.
However, AD doesn't support kadmin, so even if you set up krb5.conf
you'll just get an error because it won't even listen on the right port.
#799243#25
Date:
2015-09-19 01:09:49 UTC
From:
To:
AD does support kpasswd, though.  But the SRV records should work for
that, without manual configuration.