Creating a keytabFile for FreeIPA

[Denis-shl]

Hello!

I am using the function

func gen()(err error, keytabFileByte []byte){
var (
	kt = key.New()
	ts = time.Now()
        kvno = 10
        password  = "test" 
        encryption = "aes256-cts-hmac-sha1-96"
)

	et := etypeID.EtypeSupported(strings.ToLower(encryption))
	err = kt.AddEntry("User", "EXAMPLE.COM", password, ts, kvno, et)
	if err != nil {
		return  err, keytabFileByte
	}

	keytabFileByte, err := kt.Marshal()
	if err != nil {
		return  err, keytabFileByte
	}
}

I get kvno using the kvno console utility.
The password has been verified using kinit.

The file was saved to disk. Executing the command (kinit -k -t kt.key principal). I get an error: (kinit: Preauthentication failed while getting initial credentials)

Why can't I generate a valid keytabFile?

My krb5.conf 
[libdefaults]
	default_realm = EXAMPLE.COM
	ticket_lifetime = 100m
[realms]
	EXAMPLE.COM = {
        	kdc = ipa.example.com:88
        	admin_server = ipa.example.com:464
        }
[domain_realm]
	 .example.com = EXAMPLE.COM
    	example.com = EXAMPLE.COM

[meoww-bot]

hello, i have same issue, have u solve this problem?

[meoww-bot]

I know the reason why we got the error, KDC enabled 'preauth' flag, only the key in KDC can be authed (check the KVNO via kadmin.local -q 'getprinc User') but kt.AddEntry("User", "EXAMPLE.COM", password, ts, kvno, et) way generate key from password, not go through preauth

[Denis-shl]

@meoww-bot Tell me please , did you manage to successfully generate a keytabfile?I tried to figure out how the original freeipa-getkeytab generation function works and rewrite it to Go, but I failed.

[meoww-bot]

@meoww-bot Tell me please , did you manage to successfully generate a keytabfile?I tried to figure out how the original freeipa-getkeytab generation function works and rewrite it to Go, but I failed.

Nope, do u know mean ipa-getkeytab , AFAIK , its not a good way for generating a keytab file.

ipa-getkeytab requires valid Credential Cache , then revoke current keytab while generating new keytab file.

But I want to export current valid keytab file.

Because "KDC enabled 'preauth' flag, only the key in KDC can be authed", we can only export keytab file by kadmin.local
"kadmin: xst -norandkey -k /tmp/user.keytab user@REALM". (xst is alias of ktadd)

I want to try to use gokrb5 to call kadmin command, but can't find corresponding function in https://github.com/jcmturner/gokrb5/tree/master/kadmin

ktadd original code : https://github.com/krb5/krb5/blob/ff4d99b1e4f7b652fc98330c21d1c92e01f14736/src/kadmin/cli/keytab.c#L55

how to implement it in Go? its hard for me, i dont know how to read C, seems u are good at C, maybe u can find a way?