Rocksolid Light

Welcome to Rocksolid Light

mail  files  register  newsreader  groups  login

Message-ID:  

"I am your density." -- George McFly in "Back to the Future"


devel / comp.protocols.kerberos / Re: Force to change password for users

SubjectAuthor
o Re: Force to change password for usersGreg Hudson

1
Re: Force to change password for users

<mailman.92.1713544045.2322.kerberos@mit.edu>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=1160&group=comp.protocols.kerberos#1160

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ghudson@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: Force to change password for users
Date: Fri, 19 Apr 2024 12:27:18 -0400
Organization: TNet Consulting
Lines: 13
Message-ID: <mailman.92.1713544045.2322.kerberos@mit.edu>
References: <PRAP251MB056715F9F72A4C47C0AE558CDB0D2@PRAP251MB0567.EURP251.PROD.OUTLOOK.COM>
<eea80750-d5a6-48f9-b2c4-4efc399655e5@mit.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="14535"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla Thunderbird
To: Carlos Lopez <clopmz@outlook.com>, "kerberos@mit.edu" <kerberos@mit.edu>
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu;
dkim=pass (1024-bit key, unprotected) header.d=mit.edu header.i=@mit.edu
header.a=rsa-sha256 header.s=selector2 header.b=iT9Smjup;
dkim=pass (2048-bit key,
unprotected) header.d=mit.edu header.i=@mit.edu header.a=rsa-sha256
header.s=outgoing header.b=TDQabqro
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=it9ea1vrxyhG/BVU+3SACaYYT6EFXrHrweIKMPKbtY6XnjhYUB8tzrVOXardhEfd38raXrGwLyxCSYQcotUv2euplaD5Z42qtIqoXKuXYG+qWZKptpsXOSFRgB27k/0nB75QDp1bcpzAbCLW797q63UN+nhZv5LKnKvHpdvBgs7OYzsM18ESWQRi0DF/Q3yIzsgku0zV0KAzzHhACmvDyaP2lLHeLoJaLIcNpcJUs6vx/5TM3hlHTUT4Ljx1tCNO4Twoa8785bpbQkxSQDlpT41qRc2u5Rj9DkDLCLTCkrL0NuncQD6zbky7GKHAA3HJm/pG/fUcjtc2m3y+SpMJYw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=GIixSBGeZB+D9NvyIt9J2T6S5ATQSYWqx6tTVJNX69U=;
b=AnMGXpHr/AQH6ZZt1SD97VLZOJiGEBG4B8CIGpRHV2cbb1WhCX+FPTVtvexyv9l2l06J6abs9RaiNOKeVnamOXzv4efX013fgBYE9hxNcSwFxVqw+1i3WgNVz736EFjlUnmWpR3zUKAjfFC4Vno7JHfOf2GVy8m6qypRysTRQNk6L/TVOnS6/hTg4bEQi3sIBwh1BqDPbV5HZLgErrGYMoRuVgBPuYkwLrpct1eInMd7KRy9IdZLZWyEv/HBYnIZvq2CzsyxD9q10cRTy5x4qQZAPeT7SVBRlfZeapLuepmTUYr7kd2u0gq4QvpPaINxt9pVMl3JLUO2LvqyTtAaxA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
18.9.28.11) smtp.rcpttodomain=mit.edu smtp.mailfrom=mit.edu; dmarc=pass
(p=none sp=none pct=100) action=none header.from=mit.edu; dkim=pass
(signature was verified) header.d=mit.edu; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=GIixSBGeZB+D9NvyIt9J2T6S5ATQSYWqx6tTVJNX69U=;
b=iT9SmjupxStHf2yFbjbDZarJZp9mjC1vsv4NQSqN7VGT2b9sHYVUOGgnC5bMmGqCfxN9sUvhCVknIuPRREn5ftrd7lUq1N85RZri/mak+HICs/WaeMXYwvlMJgpaWEb/m4MMI/oa60magIZs8UgeGKBsoz4YzrkYJIExUb015Cw=
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; dkim=pass (signature was verified)
header.d=mit.edu;dmarc=pass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing;
t=1713544041; bh=GIixSBGeZB+D9NvyIt9J2T6S5ATQSYWqx6tTVJNX69U=;
h=Message-ID:Date:MIME-Version:Subject:From:Content-Type;
b=TDQabqroObiDJ5V6j3QWIjiRchmDo9nx++sAu3ysaYoczA9PdtAL7q3sw0RdBqV2S
tYY25BE9Bm8RtWc9KA+s9/9W7M8Jo3UBG4ZOaU1ebc+LPBnbMr53+txD6JQY5okK0E
A/nBPsaDnoSkv0Yx6EMLOIGUWI8dhH2Tf48UoO4W4HP6oNsVcl5TSd1zhdmnl3bBsl
EQJbpCwt68z52BSEmQWpqolYDidIQ0k88NUC3j0i3gZdyuVGY6yKC4IslW2+PF0i7r
bDtI2+/02AOrPtUtCEbnalFFF+05lwPd5J975uACl25FOZisjHf/SIaFePkfgdteNL
D6xQNNXLCW7/A==
Content-Language: en-US
In-Reply-To: <PRAP251MB056715F9F72A4C47C0AE558CDB0D2@PRAP251MB0567.EURP251.PROD.OUTLOOK.COM>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SJ5PEPF000001D6:EE_|PH0PR01MB7255:EE_
X-MS-Office365-Filtering-Correlation-Id: bd5ff42b-ac1f-403f-8278-08dc608d974d
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: rzSj8rGT833N3teUX8zf2k8Yi/1/HhW3aoRG6wQf5jk82wE7gfuhDY3oocet7UETA7t564lVLv9fhs2sas2bDbzRIXjanFjDobmux/OafUgl69reHbOfnk7+99Cxg2phWQMZ1DuLORBMgSw58QsqTPNJEiIzvU1XrfZi1r9u/6KXhkN+jMgqx9ZGzYdiLy7l0nyRYChg7nb3jIZ+150x26prcrB8/AU19CF3+A4R2T0J0dsCcB/J+0+MEL4i6e1tsDzYjyil31CWR0LKPrLyLcv1v9lcbBuBedh8L3WUvT+ko/Be6qgPZeSYhn8qh1LaVIqegOR4bzfHhROrcHxnHY/2Xn++FGY0TSaXc/wxq52gCf8X5kTdDHvq3JC2g5ZL9bxJgbjqRfv7IHsjDWzzwty5X/OXXXY17fbPo0wHyexntiYsBDRieIF1ZC/72BzkESQrLB3Rw1oq5bmxSC8RM2uOH9vB8IKuY7jM1Pjqg0hm8GO+SqeoMciOF73s0LVW2iC+eZ4ikApazgyQKbZV2sSQMHq77Zavn1+wH4Zl0I6QecEIePKtk6tkxMqCD10kEunnEH0DJKB7wpoOwjcu7wP5Txz4/Jk8I/3Up9w607n9eIaeb1skSpsHuWzLtljtEL2WqaQV9vCQX3gc7j4xoFf4MRuklMxlSLkWGcU3yA1fJwfMmMaQxmSW+saAbHnNflMkE1E7R/q6Cfia+BBh56kMivIjlptk9efD7Fmax1qSslIiUCw5F4mpVwgMcAvebnjsTmghYn5Ihy6opdiGH0OuGGsTmtFBtDgL7CQTz/E=
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu; PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(13230031)(376005)(1800799015); DIR:OUT; SFP:1102;
X-ExternalRecipientOutboundConnectors: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Apr 2024 16:27:22.0018 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: bd5ff42b-ac1f-403f-8278-08dc608d974d
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: SJ5PEPF000001D6.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR01MB7255
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <eea80750-d5a6-48f9-b2c4-4efc399655e5@mit.edu>
X-Mailman-Original-References: <PRAP251MB056715F9F72A4C47C0AE558CDB0D2@PRAP251MB0567.EURP251.PROD.OUTLOOK.COM>
 by: Greg Hudson - Fri, 19 Apr 2024 16:27 UTC

On 4/19/24 08:06, Carlos Lopez wrote:
> [...] AS_REQ [...] REQUIRED PWCHANGE: user1@MYDOM.ORG for krbtgt/MYDOM.ORG@MYDOM.ORG, Password has expired
> [...] AS_REQ [...] NEEDED_PREAUTH: user1@MYDOM.ORG for kadmin/changepw@MYDOM.ORG, Additional pre-authentication required
> [...] AS_REQ [...] ISSUE: [...] user1@MYDOM.ORG for kadmin/changepw@MYDOM.ORG
>
> But in the client side, user can login without problems and no password change is requested.

These are the messages I would expect in the log, including user1
getting a ticket to perform a password change.

You say the user can log in. Do they have tickets, or do you just mean
a login session is authorized based on the Kerberos interaction? What
client-side software is being used?

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor