Hi All We’re getting the following entries in the error logs [10/May/2018:15:37:18.628665013 +0100] - ERR - ipapwd_encrypt_encode_key - [file encoding.c, line 143]: no krbPrincipalName present in this entry [10/May/2018:15:37:18.630473873 +0100] - ERR - ipapwd_gen_hashes - [file encoding.c, line 234]: key encryption/encoding failed Is this related to the failed binds? is there any ways of turning on debug logging

The connection string is $ds = ldap_connect($hostport, $port); then we are setting some connection options: ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3); ldap_set_option($ds, LDAP_OPT_REFERRALS, 0); Then binding using admin credential:$result = ldap_bind($ds, $rdn, $pass) We can connect to freeipa but we are suspecting that we might be using the wrong encryption {SHA} in plain text then results in err 19 which results in operations error.

Hi Alexander  Here is the object we are trying to change the password with: dn: uid=tester@jisc3.ac.uk <mailto:uid=tester@jisc3.ac.uk>,cn=users,cn=accounts,dc=jisc,dc=ac,dc=uk changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: krbPrincipalName objectClass: ipaobject objectClass: ipasshuser objectClass: ipaSshGroupOfPubKeys objectClass: mepOriginEntry objectClass: eduPerson uid: tester@jisc3.ac.uk <mailto:tester@jisc3.ac.uk> givenName: NULL sn: NULL cn: wnQ6gpxNEbYDP4e0xSi42QvNLR4= displayName: displayName not set ou: Local eduPersonAffiliation: affiliate mail: tester@jisc3.ac.uk <mailto:tester@jisc3.ac.uk> userPassword: e1NIQX1rYjBwdk45WkpLVGpmMHdiMGJqYm5LSk10Vnk7 loginshell: /bin/sh homedirectory: /home/tester(a)jisc3.ac.uk <mailto:home/tester@jisc3.ac.uk> gidnumber: 1092000014 uidnumber: 1092000014

Is there anything you can suggest? Regards Per > On 11 May 2018, at 10:31, Alexander Bokovoy via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> wrote: > > On pe, 11 touko 2018, Per Qvindesland via FreeIPA-users wrote: >> Hi All >> >> We’re getting the following entries in the error logs >> >> [10/May/2018:15:37:18.628665013 +0100] - ERR - >> ipapwd_encrypt_encode_key - [file encoding.c, line 143]: no >> krbPrincipalName present in this entry >> [10/May/2018:15:37:18.630473873 +0100] - ERR - ipapwd_gen_hashes - >> [file encoding.c, line 234]: key encryption/encoding failed >> >> Is this related to the failed binds? is there any ways of turning on >> debug logging > You have or are trying to add an object in LDAP that is not a Kerberos > principal, yet somehow > object classes imply it should be a Kerberos principal. > You'd need to show the object or explain what are you doing. > >> >> The connection string is  $ds = ldap_connect($hostport, $port); then >> we are setting some connection options: ldap_set_option($ds, >> LDAP_OPT_PROTOCOL_VERSION, 3); >>   ldap_set_option($ds, LDAP_OPT_REFERRALS, 0); Then binding using >> admin credential:$result = ldap_bind($ds, $rdn, $pass) >> >> We can connect to freeipa but we are suspecting that we might be >> using the wrong encryption  {SHA} in plain text then results in err >> 19 which results in operations error. > No, this is not about connection to ldap but rather adding an LDAP > object or attempting to modify a password on existing object. > > > -- > / Alexander Bokovoy > Sr. Principal Software Engineer > Security / Identity Management Engineering > Red Hat Limited, Finland > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org