infra/tickets
24
11
Fork 2
Code Issues 74 Projects Wiki Activity Actions

Possible intermittent communication issue between Kerberos and Packit #13539

New issue
Closed
opened 2026-09-02 14:50:15 +00:00 by tuliom · 16 comments
tuliom commented 2026-09-02 14:50:15 +00:00
Copy link

Description of request

For the past few weeks I noticed that scratch builds on PRs have been failing with:

Kerberos authentication error: kinit: Preauthentication failed while getting initial credentials.

If we wait some time and re-request the build, it works fine.
Example of PR that still has the failing build: https://src.fedoraproject.org/rpms/llvm/pull-request/638

Could you take a look at this, please?

### Description of request For the past few weeks I noticed that scratch builds on PRs have been failing with: ``` Kerberos authentication error: kinit: Preauthentication failed while getting initial credentials. ``` If we wait some time and re-request the build, it works fine. Example of PR that still has the failing build: https://src.fedoraproject.org/rpms/llvm/pull-request/638 Could you take a look at this, please?
Screenshot 2026-09-02 at 09-03-42 PR#638 Update to 23.1.0 - rpms_llvm - src.fedoraproject.org.png
16 KiB
Screenshot 2026-09-02 at 09-03-42 PR#638 Update to 23.1.0 - rpms_llvm - src.fedoraproject.org.png
yselkowitz commented 2026-09-02 14:57:51 +00:00
Copy link

Today's ELN composes (the most recent attempt was within the hour) have failed with koji: GSSAPIAuthError: unable to obtain a session (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://koji.fedoraproject.org/kojihub/ssllogin)

Today's ELN composes (the most recent attempt was within the hour) have failed with `koji: GSSAPIAuthError: unable to obtain a session (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://koji.fedoraproject.org/kojihub/ssllogin)`
nforro commented 2026-09-02 15:16:51 +00:00
Copy link

Here is a debug log from a worker running kinit packit@FEDORAPROJECT.ORG -k -t /secrets/fedora.keytab:

Matching packit@FEDORAPROJECT.ORG in collection with result: 0/Success
Getting initial credentials for packit@FEDORAPROJECT.ORG
Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts
Resolving unique ccache of type MEMORY
Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG
Sending unauthenticated request
Sending request (223 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (347 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328359/Additional pre-authentication required
Preauthenticating using KDC method data
Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params ""
Received cookie: MIT
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client received freshness token from KDC
Preauth module pkinit (150) (info) returned: 0/Success
PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt
PKINIT client computed checksums: CFF2716479E3D0E165B83D734FA0F9A483D3265C D38D20ACC8E386C3A8E79AB8006674C5B3E6E7B6CD4A3BD091A84CF299B9430C
PKINIT client making DH request
PKINIT using 2048-bit DH key exchange group
Preauth module pkinit (16) (real) returned: 0/Success
Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
Sending request (1548 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (2972 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147)
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client verified DH reply
PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org
PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required
PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/11F1
Preauth module pkinit (17) (real) returned: 0/Success
Produced preauth for next request: (empty)
AS key determined by preauth: aes256-sha2/11F1
Decrypted AS reply; session key is: aes256-cts/FABF
FAST negotiation: available
Resolving unique ccache of type MEMORY
Initializing MEMORY:t9WKmO4 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4
Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4
Storing config in MEMORY:t9WKmO4 for : start_realm: FEDORAPROJECT.ORG
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:t9WKmO4
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:t9WKmO4
Moving ccache MEMORY:t9WKmO4 to MEMORY:gpd7Onk
Destroying ccache MEMORY:t9WKmO4
FAST armor ccache: MEMORY:gpd7Onk
Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success
Read config in MEMORY:gpd7Onk for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
Using FAST due to armor ccache negotiation result
Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:gpd7Onk
Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success
Read config in MEMORY:gpd7Onk for : start_realm: FEDORAPROJECT.ORG
Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:gpd7Onk with result: 0/Success
Armor ccache session key: aes256-cts/FABF
Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/BE85, session key aes256-cts/FABF
FAST armor key: aes256-cts/F638
Sending unauthenticated request
Encoding request body and padata into FAST request
Sending request (1019 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (800 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328359/Additional pre-authentication required
Decoding FAST response
Preauthenticating using KDC method data
Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
Received cookie: MIT1\x00\x00\x00\x01\x94.l\xe8\x14w\xc1\xf1t\xf4\x0dLd\x04gQY\xa65\x0a\xcc\x0a4\x00a\xc7\xc4\xe8\xe6v#\x0eU\xdbE\x01\xe5\x8fn\xd5<\x1e\x0cU9s\x99;\xa23\xd3\xfaE\xcc\xbej\x84\xf7\xfc-z\x09\x92l\x9e\x9a\x8c\x9b A%\x09\x82\xd3\x0f\x84\x98\xbbq\xc4\xc0\xe3\x16\xe6 \x0b\xd4\xf6u\xeeI\x88\x95'n\x1b\x82\x00\xfdt\xe0kk\xc5\xfc\xd7\xfc#\xa3\xf9\x95\xfa\xed[\xc9\xbd\x8b\xfa$\xa3\xe64\x86h,]f\xb4F?
PKINIT client has no configured identity; giving up
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client received freshness token from KDC
Preauth module pkinit (150) (info) returned: 0/Success
PKINIT client has no configured identity; giving up
Preauth module pkinit (16) (real) returned: 22/Invalid argument
SPAKE challenge received with group 1, pubkey B38109F35D335EDD4EBBA62AD4D2CE7E98967656FD4054AE56C2460B284466CA
Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success
SPAKE key generated with pubkey 7FEEFF171B0F115707D1945CF03976813DC1EC0A1716D93A2348DC698D8792E9
SPAKE algorithm result: 90DFE156107E3D509976FC531F55863CC22E4C9C4285981EB854580C46809471
SPAKE final transcript hash: 0B435324B8005D8C9055511FE3A07AD8B68646FBF7284274D28D0CBB0730A5B5
Sending SPAKE response
Preauth module spake (151) (real) returned: 0/Success
Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151)
Encoding request body and padata into FAST request
Sending request (1281 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (594 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328359/Additional pre-authentication required
Decoding FAST response
Preauthenticating using KDC method data
Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
Received cookie: MIT
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client received freshness token from KDC
Preauth module pkinit (150) (info) returned: 0/Success
Preauth module encrypted_challenge (138) (real) returned: 0/Success
Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138)
Encoding request body and padata into FAST request
Sending request (1118 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (592 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328360/Preauthentication failed
Decoding FAST response
Destroying ccache MEMORY:gpd7Onk
Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
Getting initial credentials for packit@FEDORAPROJECT.ORG
Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts
Resolving unique ccache of type MEMORY
Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG
Sending unauthenticated request
Sending request (223 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (556 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328359/Additional pre-authentication required
Preauthenticating using KDC method data
Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params ""
Received cookie: MIT1\x00\x00\x00\x01\xbc\xd8\x19\xc0W\x1aU\xd9\xd9&L\xc6\xf8A\x84i\xd0\xa2\x7f_:\xdc\x0a%\xd3\x06v\xd1dS\xe8\xe39\xcc\x9c\x02\x8b\x16\xb6j\xf6\xaa\x10\xf4u\x13+\x80j\xf6\\x85\xae\x00+\xf6q\xff\xb0\x1cZ\x91v1\x1d\xccJ\xc5L\x1e\xa9\x05\xa7\x18oZ\xe69\x89\xc9\xc9\xd7\xf1\xf1K\x98\xe8\xa3p\xc0\xa3yU/O\xe9bH5\xec\xb4\xa2\xe4\\xe9\xe48U\xf11fC+n53\xb5f\xfdk\x12nAq\xf5\x16Y\xe0\x83*
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client received freshness token from KDC
Preauth module pkinit (150) (info) returned: 0/Success
PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt
PKINIT client computed checksums: 5589B8195A9F021D490DB75297AC64DD4E369FA5 4D094838C782CB2752650F599A416C5AE4D11C028974D4914B156474C1C892AA
PKINIT client making DH request
PKINIT using 2048-bit DH key exchange group
Preauth module pkinit (16) (real) returned: 0/Success
Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
Sending request (1685 bytes) to FEDORAPROJECT.ORG
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (2972 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147)
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client verified DH reply
PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org
PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required
PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/5754
Preauth module pkinit (17) (real) returned: 0/Success
Produced preauth for next request: (empty)
AS key determined by preauth: aes256-sha2/5754
Decrypted AS reply; session key is: aes256-cts/B527
FAST negotiation: available
Resolving unique ccache of type MEMORY
Initializing MEMORY:URxV4XJ with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ
Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ
Storing config in MEMORY:URxV4XJ for : start_realm: FEDORAPROJECT.ORG
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:URxV4XJ
Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:URxV4XJ
Moving ccache MEMORY:URxV4XJ to MEMORY:xTKep4B
Destroying ccache MEMORY:URxV4XJ
FAST armor ccache: MEMORY:xTKep4B
Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success
Read config in MEMORY:xTKep4B for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
Using FAST due to armor ccache negotiation result
Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:xTKep4B
Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success
Read config in MEMORY:xTKep4B for : start_realm: FEDORAPROJECT.ORG
Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:xTKep4B with result: 0/Success
Armor ccache session key: aes256-cts/B527
Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/4B71, session key aes256-cts/B527
FAST armor key: aes256-cts/D22A
Sending unauthenticated request
Encoding request body and padata into FAST request
Sending request (1019 bytes) to FEDORAPROJECT.ORG (primary)
Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (800 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328359/Additional pre-authentication required
Decoding FAST response
Preauthenticating using KDC method data
Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
Received cookie: MIT1\x00\x00\x00\x01\x9d@\x0c\x1fb\x92\x9c0\xdb8D+Y\xf1\xff\x02h\x16\xc9v)\x06\x9e\x89\xa2<|Zc\xe8\xd9\xf9pZ'\x87Fb\x96\xadYa\xd7\xa8l\x1a\x09\x9d\xb1M\xa0\xc5*m\x94O0J\xfeL\x8b#W#W\xd8k\xa8\xd7\xb5.z(\xa6(\xa2\x0d\xaf\xc1n\xd8w\xb8\x01\xce\xfc_\x93\x97\x0d>\xf2\xfbuq\xd1e\xf2h8W\xbdk\\xc0\xd1\xc0^\x07\xfe\xc5\xd0\xb2\xfb\xdf\xc4\x136\x9b\x00\xcdy\xb1\xc4\xb7\xads\x00\xa4[
PKINIT client has no configured identity; giving up
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client received freshness token from KDC
Preauth module pkinit (150) (info) returned: 0/Success
PKINIT client has no configured identity; giving up
Preauth module pkinit (16) (real) returned: 22/Invalid argument
SPAKE challenge received with group 1, pubkey 94CF07AB9530258297C0BC5F3555525370ACDA775EE1C32C5206E58A0BB0A693
Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success
SPAKE key generated with pubkey 8AC5FF7DA572D6333099A0BB9D24509B2BB522C6BB6D529454254B9D2650E015
SPAKE algorithm result: 661ED732C4913D827AAA28F6B7873CACA57DC907781301F0C68E16AC8FC7EAA3
SPAKE final transcript hash: 8AE8107586D0C85345733C43223FFB73E9578029A19C7380C2A185088E459F89
Sending SPAKE response
Preauth module spake (151) (real) returned: 0/Success
Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151)
Encoding request body and padata into FAST request
Sending request (1281 bytes) to FEDORAPROJECT.ORG (primary)
Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (594 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328359/Additional pre-authentication required
Decoding FAST response
Preauthenticating using KDC method data
Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
Received cookie: MIT
Preauth module pkinit (147) (info) returned: 0/Success
PKINIT client received freshness token from KDC
Preauth module pkinit (150) (info) returned: 0/Success
Preauth module encrypted_challenge (138) (real) returned: 0/Success
Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138)
Encoding request body and padata into FAST request
Sending request (1118 bytes) to FEDORAPROJECT.ORG (primary)
Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
Resolving hostname id.fedoraproject.org
TLS certificate name matched "id.fedoraproject.org"
Sending HTTPS request to https 38.145.32.20:443
Received answer (594 bytes) from https 38.145.32.20:443
Terminating TCP connection to https 38.145.32.20:443
Received error from KDC: -1765328360/Preauthentication failed
Decoding FAST response
Destroying ccache MEMORY:xTKep4B
Here is a debug log from a worker running `kinit packit@FEDORAPROJECT.ORG -k -t /secrets/fedora.keytab`: ``` Matching packit@FEDORAPROJECT.ORG in collection with result: 0/Success Getting initial credentials for packit@FEDORAPROJECT.ORG Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts Resolving unique ccache of type MEMORY Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG Sending unauthenticated request Sending request (223 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (347 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328359/Additional pre-authentication required Preauthenticating using KDC method data Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params "" Received cookie: MIT Preauth module pkinit (147) (info) returned: 0/Success PKINIT client received freshness token from KDC Preauth module pkinit (150) (info) returned: 0/Success PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt PKINIT client computed checksums: CFF2716479E3D0E165B83D734FA0F9A483D3265C D38D20ACC8E386C3A8E79AB8006674C5B3E6E7B6CD4A3BD091A84CF299B9430C PKINIT client making DH request PKINIT using 2048-bit DH key exchange group Preauth module pkinit (16) (real) returned: 0/Success Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) Sending request (1548 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (2972 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147) Preauth module pkinit (147) (info) returned: 0/Success PKINIT client verified DH reply PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/11F1 Preauth module pkinit (17) (real) returned: 0/Success Produced preauth for next request: (empty) AS key determined by preauth: aes256-sha2/11F1 Decrypted AS reply; session key is: aes256-cts/FABF FAST negotiation: available Resolving unique ccache of type MEMORY Initializing MEMORY:t9WKmO4 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4 Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16 Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4 Storing config in MEMORY:t9WKmO4 for : start_realm: FEDORAPROJECT.ORG Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:t9WKmO4 Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:t9WKmO4 Moving ccache MEMORY:t9WKmO4 to MEMORY:gpd7Onk Destroying ccache MEMORY:t9WKmO4 FAST armor ccache: MEMORY:gpd7Onk Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success Read config in MEMORY:gpd7Onk for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes Using FAST due to armor ccache negotiation result Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:gpd7Onk Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success Read config in MEMORY:gpd7Onk for : start_realm: FEDORAPROJECT.ORG Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:gpd7Onk with result: 0/Success Armor ccache session key: aes256-cts/FABF Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/BE85, session key aes256-cts/FABF FAST armor key: aes256-cts/F638 Sending unauthenticated request Encoding request body and padata into FAST request Sending request (1019 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (800 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328359/Additional pre-authentication required Decoding FAST response Preauthenticating using KDC method data Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" Received cookie: MIT1\x00\x00\x00\x01\x94.l\xe8\x14w\xc1\xf1t\xf4\x0dLd\x04gQY\xa65\x0a\xcc\x0a4\x00a\xc7\xc4\xe8\xe6v#\x0eU\xdbE\x01\xe5\x8fn\xd5<\x1e\x0cU9s\x99;\xa23\xd3\xfaE\xcc\xbej\x84\xf7\xfc-z\x09\x92l\x9e\x9a\x8c\x9b A%\x09\x82\xd3\x0f\x84\x98\xbbq\xc4\xc0\xe3\x16\xe6 \x0b\xd4\xf6u\xeeI\x88\x95'n\x1b\x82\x00\xfdt\xe0kk\xc5\xfc\xd7\xfc#\xa3\xf9\x95\xfa\xed[\xc9\xbd\x8b\xfa$\xa3\xe64\x86h,]f\xb4F? PKINIT client has no configured identity; giving up Preauth module pkinit (147) (info) returned: 0/Success PKINIT client received freshness token from KDC Preauth module pkinit (150) (info) returned: 0/Success PKINIT client has no configured identity; giving up Preauth module pkinit (16) (real) returned: 22/Invalid argument SPAKE challenge received with group 1, pubkey B38109F35D335EDD4EBBA62AD4D2CE7E98967656FD4054AE56C2460B284466CA Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success SPAKE key generated with pubkey 7FEEFF171B0F115707D1945CF03976813DC1EC0A1716D93A2348DC698D8792E9 SPAKE algorithm result: 90DFE156107E3D509976FC531F55863CC22E4C9C4285981EB854580C46809471 SPAKE final transcript hash: 0B435324B8005D8C9055511FE3A07AD8B68646FBF7284274D28D0CBB0730A5B5 Sending SPAKE response Preauth module spake (151) (real) returned: 0/Success Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151) Encoding request body and padata into FAST request Sending request (1281 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (594 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328359/Additional pre-authentication required Decoding FAST response Preauthenticating using KDC method data Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" Received cookie: MIT Preauth module pkinit (147) (info) returned: 0/Success PKINIT client received freshness token from KDC Preauth module pkinit (150) (info) returned: 0/Success Preauth module encrypted_challenge (138) (real) returned: 0/Success Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138) Encoding request body and padata into FAST request Sending request (1118 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (592 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328360/Preauthentication failed Decoding FAST response Destroying ccache MEMORY:gpd7Onk Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" Getting initial credentials for packit@FEDORAPROJECT.ORG Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts Resolving unique ccache of type MEMORY Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG Sending unauthenticated request Sending request (223 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (556 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328359/Additional pre-authentication required Preauthenticating using KDC method data Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params "" Received cookie: MIT1\x00\x00\x00\x01\xbc\xd8\x19\xc0W\x1aU\xd9\xd9&L\xc6\xf8A\x84i\xd0\xa2\x7f_:\xdc\x0a%\xd3\x06v\xd1dS\xe8\xe39\xcc\x9c\x02\x8b\x16\xb6j\xf6\xaa\x10\xf4u\x13+\x80j\xf6\\x85\xae\x00+\xf6q\xff\xb0\x1cZ\x91v1\x1d\xccJ\xc5L\x1e\xa9\x05\xa7\x18oZ\xe69\x89\xc9\xc9\xd7\xf1\xf1K\x98\xe8\xa3p\xc0\xa3yU/O\xe9bH5\xec\xb4\xa2\xe4\\xe9\xe48U\xf11fC+n53\xb5f\xfdk\x12nAq\xf5\x16Y\xe0\x83* Preauth module pkinit (147) (info) returned: 0/Success PKINIT client received freshness token from KDC Preauth module pkinit (150) (info) returned: 0/Success PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt PKINIT client computed checksums: 5589B8195A9F021D490DB75297AC64DD4E369FA5 4D094838C782CB2752650F599A416C5AE4D11C028974D4914B156474C1C892AA PKINIT client making DH request PKINIT using 2048-bit DH key exchange group Preauth module pkinit (16) (real) returned: 0/Success Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) Sending request (1685 bytes) to FEDORAPROJECT.ORG Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (2972 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147) Preauth module pkinit (147) (info) returned: 0/Success PKINIT client verified DH reply PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/5754 Preauth module pkinit (17) (real) returned: 0/Success Produced preauth for next request: (empty) AS key determined by preauth: aes256-sha2/5754 Decrypted AS reply; session key is: aes256-cts/B527 FAST negotiation: available Resolving unique ccache of type MEMORY Initializing MEMORY:URxV4XJ with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16 Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ Storing config in MEMORY:URxV4XJ for : start_realm: FEDORAPROJECT.ORG Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:URxV4XJ Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:URxV4XJ Moving ccache MEMORY:URxV4XJ to MEMORY:xTKep4B Destroying ccache MEMORY:URxV4XJ FAST armor ccache: MEMORY:xTKep4B Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success Read config in MEMORY:xTKep4B for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes Using FAST due to armor ccache negotiation result Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:xTKep4B Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success Read config in MEMORY:xTKep4B for : start_realm: FEDORAPROJECT.ORG Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:xTKep4B with result: 0/Success Armor ccache session key: aes256-cts/B527 Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/4B71, session key aes256-cts/B527 FAST armor key: aes256-cts/D22A Sending unauthenticated request Encoding request body and padata into FAST request Sending request (1019 bytes) to FEDORAPROJECT.ORG (primary) Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (800 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328359/Additional pre-authentication required Decoding FAST response Preauthenticating using KDC method data Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" Received cookie: MIT1\x00\x00\x00\x01\x9d@\x0c\x1fb\x92\x9c0\xdb8D+Y\xf1\xff\x02h\x16\xc9v)\x06\x9e\x89\xa2<|Zc\xe8\xd9\xf9pZ'\x87Fb\x96\xadYa\xd7\xa8l\x1a\x09\x9d\xb1M\xa0\xc5*m\x94O0J\xfeL\x8b#W#W\xd8k\xa8\xd7\xb5.z(\xa6(\xa2\x0d\xaf\xc1n\xd8w\xb8\x01\xce\xfc_\x93\x97\x0d>\xf2\xfbuq\xd1e\xf2h8W\xbdk\\xc0\xd1\xc0^\x07\xfe\xc5\xd0\xb2\xfb\xdf\xc4\x136\x9b\x00\xcdy\xb1\xc4\xb7\xads\x00\xa4[ PKINIT client has no configured identity; giving up Preauth module pkinit (147) (info) returned: 0/Success PKINIT client received freshness token from KDC Preauth module pkinit (150) (info) returned: 0/Success PKINIT client has no configured identity; giving up Preauth module pkinit (16) (real) returned: 22/Invalid argument SPAKE challenge received with group 1, pubkey 94CF07AB9530258297C0BC5F3555525370ACDA775EE1C32C5206E58A0BB0A693 Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success SPAKE key generated with pubkey 8AC5FF7DA572D6333099A0BB9D24509B2BB522C6BB6D529454254B9D2650E015 SPAKE algorithm result: 661ED732C4913D827AAA28F6B7873CACA57DC907781301F0C68E16AC8FC7EAA3 SPAKE final transcript hash: 8AE8107586D0C85345733C43223FFB73E9578029A19C7380C2A185088E459F89 Sending SPAKE response Preauth module spake (151) (real) returned: 0/Success Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151) Encoding request body and padata into FAST request Sending request (1281 bytes) to FEDORAPROJECT.ORG (primary) Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (594 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328359/Additional pre-authentication required Decoding FAST response Preauthenticating using KDC method data Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" Received cookie: MIT Preauth module pkinit (147) (info) returned: 0/Success PKINIT client received freshness token from KDC Preauth module pkinit (150) (info) returned: 0/Success Preauth module encrypted_challenge (138) (real) returned: 0/Success Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138) Encoding request body and padata into FAST request Sending request (1118 bytes) to FEDORAPROJECT.ORG (primary) Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" Resolving hostname id.fedoraproject.org TLS certificate name matched "id.fedoraproject.org" Sending HTTPS request to https 38.145.32.20:443 Received answer (594 bytes) from https 38.145.32.20:443 Terminating TCP connection to https 38.145.32.20:443 Received error from KDC: -1765328360/Preauthentication failed Decoding FAST response Destroying ccache MEMORY:xTKep4B ```
kevin self-assigned this 2026-09-02 16:49:28 +00:00
kevin commented 2026-09-02 17:55:02 +00:00
Owner
Copy link

Is it always the initial scratch build from packit that gets the error? Does it always happen or sporadic?

Are the eln composes always failing? I see the last two I guess... I do see openssl was updated on the eln composer, wonder if that could be related?

For packit, is the time set correctly where it's running? Can you give a exact timestamp for a Preauthentication failure so I can try and match it in logs?

Is it always the initial scratch build from packit that gets the error? Does it always happen or sporadic? Are the eln composes always failing? I see the last two I guess... I do see openssl was updated on the eln composer, wonder if that could be related? For packit, is the time set correctly where it's running? Can you give a exact timestamp for a Preauthentication failure so I can try and match it in logs?
nforro commented 2026-09-02 18:12:47 +00:00
Copy link

Sorry, pasting again with timestamps (UTC):

2026-09-02 14:50:50,974: Matching packit@FEDORAPROJECT.ORG in collection with result: 0/Success
2026-09-02 14:50:50,974: Getting initial credentials for packit@FEDORAPROJECT.ORG
2026-09-02 14:50:50,975: Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts
2026-09-02 14:50:50,976: Resolving unique ccache of type MEMORY
2026-09-02 14:50:50,977: Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG
2026-09-02 14:50:50,977: Sending unauthenticated request
2026-09-02 14:50:50,977: Sending request (223 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:50,977: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:51,071: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:51,071: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:51,198: Received answer (347 bytes) from https 38.145.32.20:443
2026-09-02 14:50:51,198: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:51,199: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:50:51,199: Preauthenticating using KDC method data
2026-09-02 14:50:51,199: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
2026-09-02 14:50:51,199: Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params ""
2026-09-02 14:50:51,199: Received cookie: MIT
2026-09-02 14:50:51,199: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:51,199: PKINIT client received freshness token from KDC
2026-09-02 14:50:51,199: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:50:51,200: PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt
2026-09-02 14:50:51,200: PKINIT client computed checksums: CFF2716479E3D0E165B83D734FA0F9A483D3265C D38D20ACC8E386C3A8E79AB8006674C5B3E6E7B6CD4A3BD091A84CF299B9430C
2026-09-02 14:50:51,200: PKINIT client making DH request
2026-09-02 14:50:51,200: PKINIT using 2048-bit DH key exchange group
2026-09-02 14:50:51,200: Preauth module pkinit (16) (real) returned: 0/Success
2026-09-02 14:50:51,200: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
2026-09-02 14:50:51,200: Sending request (1548 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:51,201: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:51,263: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:51,263: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:51,420: Received answer (2972 bytes) from https 38.145.32.20:443
2026-09-02 14:50:51,420: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:51,420: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147)
2026-09-02 14:50:51,420: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:51,420: PKINIT client verified DH reply
2026-09-02 14:50:51,421: PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org
2026-09-02 14:50:51,421: PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
2026-09-02 14:50:51,421: PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required
2026-09-02 14:50:51,421: PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/11F1
2026-09-02 14:50:51,421: Preauth module pkinit (17) (real) returned: 0/Success
2026-09-02 14:50:51,421: Produced preauth for next request: (empty)
2026-09-02 14:50:51,421: AS key determined by preauth: aes256-sha2/11F1
2026-09-02 14:50:51,422: Decrypted AS reply; session key is: aes256-cts/FABF
2026-09-02 14:50:51,422: FAST negotiation: available
2026-09-02 14:50:51,422: Resolving unique ccache of type MEMORY
2026-09-02 14:50:51,422: Initializing MEMORY:t9WKmO4 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
2026-09-02 14:50:51,422: Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:50:51,422: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4
2026-09-02 14:50:51,423: Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16
2026-09-02 14:50:51,423: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4
2026-09-02 14:50:51,423: Storing config in MEMORY:t9WKmO4 for : start_realm: FEDORAPROJECT.ORG
2026-09-02 14:50:51,423: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:t9WKmO4
2026-09-02 14:50:51,423: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:t9WKmO4
2026-09-02 14:50:51,423: Moving ccache MEMORY:t9WKmO4 to MEMORY:gpd7Onk
2026-09-02 14:50:51,423: Destroying ccache MEMORY:t9WKmO4
2026-09-02 14:50:51,424: FAST armor ccache: MEMORY:gpd7Onk
2026-09-02 14:50:51,424: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success
2026-09-02 14:50:51,424: Read config in MEMORY:gpd7Onk for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:50:51,424: Using FAST due to armor ccache negotiation result
2026-09-02 14:50:51,424: Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:gpd7Onk
2026-09-02 14:50:51,424: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success
2026-09-02 14:50:51,424: Read config in MEMORY:gpd7Onk for : start_realm: FEDORAPROJECT.ORG
2026-09-02 14:50:51,424: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:gpd7Onk with result: 0/Success
2026-09-02 14:50:51,425: Armor ccache session key: aes256-cts/FABF
2026-09-02 14:50:51,425: Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/BE85, session key aes256-cts/FABF
2026-09-02 14:50:51,425: FAST armor key: aes256-cts/F638
2026-09-02 14:50:51,425: Sending unauthenticated request
2026-09-02 14:50:51,425: Encoding request body and padata into FAST request
2026-09-02 14:50:51,425: Sending request (1019 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:51,425: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:51,464: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:51,464: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:51,601: Received answer (800 bytes) from https 38.145.32.20:443
2026-09-02 14:50:51,601: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:51,602: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:50:51,602: Decoding FAST response
2026-09-02 14:50:51,602: Preauthenticating using KDC method data
2026-09-02 14:50:51,602: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
2026-09-02 14:50:51,602: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
2026-09-02 14:50:51,602: Received cookie: MIT1\x00\x00\x00\x01\x94.l\xe8\x14w\xc1\xf1t\xf4\x0dLd\x04gQY\xa65\x0a\xcc\x0a4\x00a\xc7\xc4\xe8\xe6v#\x0eU\xdbE\x01\xe5\x8fn\xd5<\x1e\x0cU9s\x99;\xa23\xd3\xfaE\xcc\xbej\x84\xf7\xfc-z\x09\x92l\x9e\x9a\x8c\x9b A%\x09\x82\xd3\x0f\x84\x98\xbbq\xc4\xc0\xe3\x16\xe6 \x0b\xd4\xf6u\xeeI\x88\x95'n\x1b\x82\x00\xfdt\xe0kk\xc5\xfc\xd7\xfc#\xa3\xf9\x95\xfa\xed[\xc9\xbd\x8b\xfa$\xa3\xe64\x86h,]f\xb4F?
2026-09-02 14:50:51,602: PKINIT client has no configured identity; giving up
2026-09-02 14:50:51,602: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:51,602: PKINIT client received freshness token from KDC
2026-09-02 14:50:51,603: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:50:51,603: PKINIT client has no configured identity; giving up
2026-09-02 14:50:51,603: Preauth module pkinit (16) (real) returned: 22/Invalid argument
2026-09-02 14:50:51,603: SPAKE challenge received with group 1, pubkey B38109F35D335EDD4EBBA62AD4D2CE7E98967656FD4054AE56C2460B284466CA
2026-09-02 14:50:51,603: Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success
2026-09-02 14:50:51,603: SPAKE key generated with pubkey 7FEEFF171B0F115707D1945CF03976813DC1EC0A1716D93A2348DC698D8792E9
2026-09-02 14:50:51,603: SPAKE algorithm result: 90DFE156107E3D509976FC531F55863CC22E4C9C4285981EB854580C46809471
2026-09-02 14:50:51,603: SPAKE final transcript hash: 0B435324B8005D8C9055511FE3A07AD8B68646FBF7284274D28D0CBB0730A5B5
2026-09-02 14:50:51,603: Sending SPAKE response
2026-09-02 14:50:51,603: Preauth module spake (151) (real) returned: 0/Success
2026-09-02 14:50:51,603: Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151)
2026-09-02 14:50:51,604: Encoding request body and padata into FAST request
2026-09-02 14:50:51,604: Sending request (1281 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:51,604: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:51,663: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:51,664: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:51,791: Received answer (594 bytes) from https 38.145.32.20:443
2026-09-02 14:50:51,791: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:51,792: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:50:51,792: Decoding FAST response
2026-09-02 14:50:51,792: Preauthenticating using KDC method data
2026-09-02 14:50:51,792: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
2026-09-02 14:50:51,792: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
2026-09-02 14:50:51,792: Received cookie: MIT
2026-09-02 14:50:51,792: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:51,792: PKINIT client received freshness token from KDC
2026-09-02 14:50:51,793: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:50:51,793: Preauth module encrypted_challenge (138) (real) returned: 0/Success
2026-09-02 14:50:51,793: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138)
2026-09-02 14:50:51,793: Encoding request body and padata into FAST request
2026-09-02 14:50:51,793: Sending request (1118 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:51,793: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:51,853: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:51,854: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:52,037: Received answer (592 bytes) from https 38.145.32.20:443
2026-09-02 14:50:52,037: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:52,038: Received error from KDC: -1765328360/Preauthentication failed
2026-09-02 14:50:52,038: Decoding FAST response
2026-09-02 14:50:52,038: Destroying ccache MEMORY:gpd7Onk
2026-09-02 14:50:52,038: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
2026-09-02 14:50:52,058: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
2026-09-02 14:50:52,059: Getting initial credentials for packit@FEDORAPROJECT.ORG
2026-09-02 14:50:52,059: Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts
2026-09-02 14:50:52,059: Resolving unique ccache of type MEMORY
2026-09-02 14:50:52,059: Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG
2026-09-02 14:50:52,059: Sending unauthenticated request
2026-09-02 14:50:52,059: Sending request (223 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:52,059: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:52,129: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:52,129: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:52,278: Received answer (556 bytes) from https 38.145.32.20:443
2026-09-02 14:50:52,278: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:52,278: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:50:52,279: Preauthenticating using KDC method data
2026-09-02 14:50:52,279: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
2026-09-02 14:50:52,279: Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params ""
2026-09-02 14:50:52,279: Received cookie: MIT1\x00\x00\x00\x01\xbc\xd8\x19\xc0W\x1aU\xd9\xd9&L\xc6\xf8A\x84i\xd0\xa2\x7f_:\xdc\x0a%\xd3\x06v\xd1dS\xe8\xe39\xcc\x9c\x02\x8b\x16\xb6j\xf6\xaa\x10\xf4u\x13+\x80j\xf6\\x85\xae\x00+\xf6q\xff\xb0\x1cZ\x91v1\x1d\xccJ\xc5L\x1e\xa9\x05\xa7\x18oZ\xe69\x89\xc9\xc9\xd7\xf1\xf1K\x98\xe8\xa3p\xc0\xa3yU/O\xe9bH5\xec\xb4\xa2\xe4\\xe9\xe48U\xf11fC+n53\xb5f\xfdk\x12nAq\xf5\x16Y\xe0\x83*
2026-09-02 14:50:52,279: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:52,279: PKINIT client received freshness token from KDC
2026-09-02 14:50:52,279: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:50:52,279: PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt
2026-09-02 14:50:52,279: PKINIT client computed checksums: 5589B8195A9F021D490DB75297AC64DD4E369FA5 4D094838C782CB2752650F599A416C5AE4D11C028974D4914B156474C1C892AA
2026-09-02 14:50:52,280: PKINIT client making DH request
2026-09-02 14:50:52,280: PKINIT using 2048-bit DH key exchange group
2026-09-02 14:50:52,280: Preauth module pkinit (16) (real) returned: 0/Success
2026-09-02 14:50:52,280: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
2026-09-02 14:50:52,280: Sending request (1685 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:50:52,280: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:52,342: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:52,343: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:52,473: Received answer (2972 bytes) from https 38.145.32.20:443
2026-09-02 14:50:52,473: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:52,474: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147)
2026-09-02 14:50:52,474: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:52,474: PKINIT client verified DH reply
2026-09-02 14:50:52,475: PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org
2026-09-02 14:50:52,475: PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
2026-09-02 14:50:52,475: PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required
2026-09-02 14:50:52,475: PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/5754
2026-09-02 14:50:52,475: Preauth module pkinit (17) (real) returned: 0/Success
2026-09-02 14:50:52,475: Produced preauth for next request: (empty)
2026-09-02 14:50:52,476: AS key determined by preauth: aes256-sha2/5754
2026-09-02 14:50:52,476: Decrypted AS reply; session key is: aes256-cts/B527
2026-09-02 14:50:52,476: FAST negotiation: available
2026-09-02 14:50:52,476: Resolving unique ccache of type MEMORY
2026-09-02 14:50:52,476: Initializing MEMORY:URxV4XJ with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
2026-09-02 14:50:52,476: Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ
2026-09-02 14:50:52,477: Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16
2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ
2026-09-02 14:50:52,477: Storing config in MEMORY:URxV4XJ for : start_realm: FEDORAPROJECT.ORG
2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:URxV4XJ
2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:URxV4XJ
2026-09-02 14:50:52,477: Moving ccache MEMORY:URxV4XJ to MEMORY:xTKep4B
2026-09-02 14:50:52,477: Destroying ccache MEMORY:URxV4XJ
2026-09-02 14:50:52,477: FAST armor ccache: MEMORY:xTKep4B
2026-09-02 14:50:52,478: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success
2026-09-02 14:50:52,478: Read config in MEMORY:xTKep4B for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:50:52,478: Using FAST due to armor ccache negotiation result
2026-09-02 14:50:52,478: Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:xTKep4B
2026-09-02 14:50:52,478: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success
2026-09-02 14:50:52,478: Read config in MEMORY:xTKep4B for : start_realm: FEDORAPROJECT.ORG
2026-09-02 14:50:52,478: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:xTKep4B with result: 0/Success
2026-09-02 14:50:52,479: Armor ccache session key: aes256-cts/B527
2026-09-02 14:50:52,479: Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/4B71, session key aes256-cts/B527
2026-09-02 14:50:52,479: FAST armor key: aes256-cts/D22A
2026-09-02 14:50:52,479: Sending unauthenticated request
2026-09-02 14:50:52,479: Encoding request body and padata into FAST request
2026-09-02 14:50:52,479: Sending request (1019 bytes) to FEDORAPROJECT.ORG (primary)
2026-09-02 14:50:52,480: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
2026-09-02 14:50:52,480: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
2026-09-02 14:50:52,480: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:52,548: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:52,548: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:52,683: Received answer (800 bytes) from https 38.145.32.20:443
2026-09-02 14:50:52,683: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:52,684: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:50:52,684: Decoding FAST response
2026-09-02 14:50:52,684: Preauthenticating using KDC method data
2026-09-02 14:50:52,684: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
2026-09-02 14:50:52,684: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
2026-09-02 14:50:52,685: Received cookie: MIT1\x00\x00\x00\x01\x9d@\x0c\x1fb\x92\x9c0\xdb8D+Y\xf1\xff\x02h\x16\xc9v)\x06\x9e\x89\xa2<|Zc\xe8\xd9\xf9pZ'\x87Fb\x96\xadYa\xd7\xa8l\x1a\x09\x9d\xb1M\xa0\xc5*m\x94O0J\xfeL\x8b#W#W\xd8k\xa8\xd7\xb5.z(\xa6(\xa2\x0d\xaf\xc1n\xd8w\xb8\x01\xce\xfc_\x93\x97\x0d>\xf2\xfbuq\xd1e\xf2h8W\xbdk\\xc0\xd1\xc0^\x07\xfe\xc5\xd0\xb2\xfb\xdf\xc4\x136\x9b\x00\xcdy\xb1\xc4\xb7\xads\x00\xa4[
2026-09-02 14:50:52,685: PKINIT client has no configured identity; giving up
2026-09-02 14:50:52,685: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:52,685: PKINIT client received freshness token from KDC
2026-09-02 14:50:52,685: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:50:52,685: PKINIT client has no configured identity; giving up
2026-09-02 14:50:52,685: Preauth module pkinit (16) (real) returned: 22/Invalid argument
2026-09-02 14:50:52,685: SPAKE challenge received with group 1, pubkey 94CF07AB9530258297C0BC5F3555525370ACDA775EE1C32C5206E58A0BB0A693
2026-09-02 14:50:52,685: Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success
2026-09-02 14:50:52,685: SPAKE key generated with pubkey 8AC5FF7DA572D6333099A0BB9D24509B2BB522C6BB6D529454254B9D2650E015
2026-09-02 14:50:52,686: SPAKE algorithm result: 661ED732C4913D827AAA28F6B7873CACA57DC907781301F0C68E16AC8FC7EAA3
2026-09-02 14:50:52,686: SPAKE final transcript hash: 8AE8107586D0C85345733C43223FFB73E9578029A19C7380C2A185088E459F89
2026-09-02 14:50:52,686: Sending SPAKE response
2026-09-02 14:50:52,686: Preauth module spake (151) (real) returned: 0/Success
2026-09-02 14:50:52,686: Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151)
2026-09-02 14:50:52,686: Encoding request body and padata into FAST request
2026-09-02 14:50:52,686: Sending request (1281 bytes) to FEDORAPROJECT.ORG (primary)
2026-09-02 14:50:52,686: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
2026-09-02 14:50:52,686: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
2026-09-02 14:50:52,686: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:52,746: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:52,747: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:52,876: Received answer (594 bytes) from https 38.145.32.20:443
2026-09-02 14:50:52,876: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:52,877: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:50:52,877: Decoding FAST response
2026-09-02 14:50:52,877: Preauthenticating using KDC method data
2026-09-02 14:50:52,877: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
2026-09-02 14:50:52,877: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
2026-09-02 14:50:52,877: Received cookie: MIT
2026-09-02 14:50:52,877: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:50:52,877: PKINIT client received freshness token from KDC
2026-09-02 14:50:52,877: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:50:52,878: Preauth module encrypted_challenge (138) (real) returned: 0/Success
2026-09-02 14:50:52,878: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138)
2026-09-02 14:50:52,878: Encoding request body and padata into FAST request
2026-09-02 14:50:52,878: Sending request (1118 bytes) to FEDORAPROJECT.ORG (primary)
2026-09-02 14:50:52,878: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG.
2026-09-02 14:50:52,878: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/"
2026-09-02 14:50:52,878: Resolving hostname id.fedoraproject.org
2026-09-02 14:50:52,943: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:50:52,943: Sending HTTPS request to https 38.145.32.20:443
2026-09-02 14:50:53,149: Received answer (594 bytes) from https 38.145.32.20:443
2026-09-02 14:50:53,149: Terminating TCP connection to https 38.145.32.20:443
2026-09-02 14:50:53,150: Received error from KDC: -1765328360/Preauthentication failed
2026-09-02 14:50:53,150: Decoding FAST response
2026-09-02 14:50:53,150: Destroying ccache MEMORY:xTKep4B

It definitely doesn't happen every time, here is one successful kinit for comparison:

2026-09-02 14:26:48,997: Matching packit@FEDORAPROJECT.ORG in collection with result: 0/Success
2026-09-02 14:26:48,997: Getting initial credentials for packit@FEDORAPROJECT.ORG
2026-09-02 14:26:48,997: Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts
2026-09-02 14:26:48,998: Resolving unique ccache of type MEMORY
2026-09-02 14:26:48,998: Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG
2026-09-02 14:26:48,998: Sending unauthenticated request
2026-09-02 14:26:48,998: Sending request (223 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:26:48,998: Resolving hostname id.fedoraproject.org
2026-09-02 14:26:49,038: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:26:49,038: Sending HTTPS request to https 38.145.32.21:443
2026-09-02 14:26:49,163: Received answer (556 bytes) from https 38.145.32.21:443
2026-09-02 14:26:49,163: Terminating TCP connection to https 38.145.32.21:443
2026-09-02 14:26:49,163: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:26:49,164: Preauthenticating using KDC method data
2026-09-02 14:26:49,164: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133)
2026-09-02 14:26:49,164: Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params ""
2026-09-02 14:26:49,164: Received cookie: MIT1\x00\x00\x00\x01\xbd\xa3\xac\xc4\x8e\xc8|}\xed\xf6W\xd2\xb2T\x94\xb0\xc3A[{\xbak\xa6z%\xe13\xea\xda\x9f\xd4\x0e\x1b\x9f\x11\x80\xc8`D\x02\xca\\x9d\xa4m\x94\x94\xd2\xc1\x09u)`\x97@.h,G\xf6\x02\xe9\xa2jCpN\x9e\xb4\x9a\xf7\x95_\xb8\xc9\x1a\xe4\xe3\xc8\xf3GT\x11\xa2\xe0\x16\xcdJ\x884"\xd1\xb6Ws\xf2I\x03\xb9\xc8|\x93\xca\xab\xc7\xbb\xf2\x06c\xb4\xf3s$\xe0\xfd\xc9a>\xf4laU\xa4\xf3\xc5\xd1p\x00ao
2026-09-02 14:26:49,164: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:26:49,164: PKINIT client received freshness token from KDC
2026-09-02 14:26:49,164: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:26:49,164: PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt
2026-09-02 14:26:49,164: PKINIT client computed checksums: B29098FA25B5D0354EF8544D6337CEF19AB763EC 69354422FECACE7E68B850C7075BD8D6962D8E9B1F9C16F0FADA683DD6C9BC09
2026-09-02 14:26:49,165: PKINIT client making DH request
2026-09-02 14:26:49,165: PKINIT using 2048-bit DH key exchange group
2026-09-02 14:26:49,165: Preauth module pkinit (16) (real) returned: 0/Success
2026-09-02 14:26:49,165: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16)
2026-09-02 14:26:49,165: Sending request (1685 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:26:49,165: Resolving hostname id.fedoraproject.org
2026-09-02 14:26:49,231: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:26:49,232: Sending HTTPS request to https 38.145.32.21:443
2026-09-02 14:26:49,383: Received answer (2973 bytes) from https 38.145.32.21:443
2026-09-02 14:26:49,383: Terminating TCP connection to https 38.145.32.21:443
2026-09-02 14:26:49,384: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147)
2026-09-02 14:26:49,384: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:26:49,384: PKINIT client verified DH reply
2026-09-02 14:26:49,384: PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa03.rdu3.fedoraproject.org
2026-09-02 14:26:49,384: PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
2026-09-02 14:26:49,385: PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required
2026-09-02 14:26:49,385: PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/5454
2026-09-02 14:26:49,385: Preauth module pkinit (17) (real) returned: 0/Success
2026-09-02 14:26:49,385: Produced preauth for next request: (empty)
2026-09-02 14:26:49,385: AS key determined by preauth: aes256-sha2/5454
2026-09-02 14:26:49,385: Decrypted AS reply; session key is: aes256-cts/EBBC
2026-09-02 14:26:49,385: FAST negotiation: available
2026-09-02 14:26:49,385: Resolving unique ccache of type MEMORY
2026-09-02 14:26:49,385: Initializing MEMORY:6fTkNGl with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
2026-09-02 14:26:49,385: Storing config in MEMORY:6fTkNGl for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:6fTkNGl
2026-09-02 14:26:49,386: Storing config in MEMORY:6fTkNGl for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16
2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:6fTkNGl
2026-09-02 14:26:49,386: Storing config in MEMORY:6fTkNGl for : start_realm: FEDORAPROJECT.ORG
2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:6fTkNGl
2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:6fTkNGl
2026-09-02 14:26:49,386: Moving ccache MEMORY:6fTkNGl to MEMORY:enUJJbD
2026-09-02 14:26:49,386: Destroying ccache MEMORY:6fTkNGl
2026-09-02 14:26:49,386: FAST armor ccache: MEMORY:enUJJbD
2026-09-02 14:26:49,386: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:enUJJbD with result: 0/Success
2026-09-02 14:26:49,386: Read config in MEMORY:enUJJbD for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:26:49,387: Using FAST due to armor ccache negotiation result
2026-09-02 14:26:49,387: Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:enUJJbD
2026-09-02 14:26:49,387: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:enUJJbD with result: 0/Success
2026-09-02 14:26:49,387: Read config in MEMORY:enUJJbD for : start_realm: FEDORAPROJECT.ORG
2026-09-02 14:26:49,387: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:enUJJbD with result: 0/Success
2026-09-02 14:26:49,387: Armor ccache session key: aes256-cts/EBBC
2026-09-02 14:26:49,387: Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/E8F7, session key aes256-cts/EBBC
2026-09-02 14:26:49,387: FAST armor key: aes256-cts/A1E9
2026-09-02 14:26:49,387: Sending unauthenticated request
2026-09-02 14:26:49,387: Encoding request body and padata into FAST request
2026-09-02 14:26:49,387: Sending request (1019 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:26:49,388: Resolving hostname id.fedoraproject.org
2026-09-02 14:26:49,455: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:26:49,455: Sending HTTPS request to https 38.145.32.21:443
2026-09-02 14:26:49,586: Received answer (592 bytes) from https 38.145.32.21:443
2026-09-02 14:26:49,586: Terminating TCP connection to https 38.145.32.21:443
2026-09-02 14:26:49,587: Received error from KDC: -1765328359/Additional pre-authentication required
2026-09-02 14:26:49,587: Decoding FAST response
2026-09-02 14:26:49,587: Preauthenticating using KDC method data
2026-09-02 14:26:49,587: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137)
2026-09-02 14:26:49,587: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
2026-09-02 14:26:49,587: Received cookie: MIT
2026-09-02 14:26:49,588: PKINIT client has no configured identity; giving up
2026-09-02 14:26:49,588: Preauth module pkinit (147) (info) returned: 0/Success
2026-09-02 14:26:49,588: PKINIT client received freshness token from KDC
2026-09-02 14:26:49,588: Preauth module pkinit (150) (info) returned: 0/Success
2026-09-02 14:26:49,588: PKINIT client has no configured identity; giving up
2026-09-02 14:26:49,588: Preauth module pkinit (16) (real) returned: 22/Invalid argument
2026-09-02 14:26:49,588: Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success
2026-09-02 14:26:49,588: Preauth module encrypted_challenge (138) (real) returned: 0/Success
2026-09-02 14:26:49,588: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138)
2026-09-02 14:26:49,588: Encoding request body and padata into FAST request
2026-09-02 14:26:49,589: Sending request (1117 bytes) to FEDORAPROJECT.ORG
2026-09-02 14:26:49,589: Resolving hostname id.fedoraproject.org
2026-09-02 14:26:49,654: TLS certificate name matched "id.fedoraproject.org"
2026-09-02 14:26:49,654: Sending HTTPS request to https 38.145.32.21:443
2026-09-02 14:26:49,910: Received answer (2055 bytes) from https 38.145.32.21:443
2026-09-02 14:26:49,910: Terminating TCP connection to https 38.145.32.21:443
2026-09-02 14:26:49,911: Decoding FAST response
2026-09-02 14:26:49,911: Processing preauth types: PA-ENCRYPTED-CHALLENGE (138), PA-ETYPE-INFO2 (19)
2026-09-02 14:26:49,911: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params ""
2026-09-02 14:26:49,911: Preauth module encrypted_challenge (138) (real) returned: 0/Success
2026-09-02 14:26:49,911: Produced preauth for next request: (empty)
2026-09-02 14:26:49,911: AS key determined by preauth: aes256-cts/FD25
2026-09-02 14:26:49,912: FAST reply key: aes256-cts/1304
2026-09-02 14:26:49,912: Decrypted AS reply; session key is: aes256-cts/F06B
2026-09-02 14:26:49,912: FAST negotiation: available
2026-09-02 14:26:49,912: Resolving unique ccache of type MEMORY
2026-09-02 14:26:49,912: Initializing MEMORY:xT6Xlaj with default princ packit@FEDORAPROJECT.ORG
2026-09-02 14:26:49,912: Storing config in MEMORY:xT6Xlaj for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes
2026-09-02 14:26:49,912: Storing packit@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:xT6Xlaj
2026-09-02 14:26:49,912: Storing config in MEMORY:xT6Xlaj for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 138
2026-09-02 14:26:49,912: Storing packit@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:xT6Xlaj
2026-09-02 14:26:49,912: Storing packit@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:xT6Xlaj
2026-09-02 14:26:49,913: Moving ccache MEMORY:xT6Xlaj to DIR::/home/packit/kerberos/tkt
2026-09-02 14:26:49,913: Destroying ccache MEMORY:xT6Xlaj
2026-09-02 14:26:49,913: Destroying ccache MEMORY:enUJJbD
Sorry, pasting again with timestamps (UTC): ``` 2026-09-02 14:50:50,974: Matching packit@FEDORAPROJECT.ORG in collection with result: 0/Success 2026-09-02 14:50:50,974: Getting initial credentials for packit@FEDORAPROJECT.ORG 2026-09-02 14:50:50,975: Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts 2026-09-02 14:50:50,976: Resolving unique ccache of type MEMORY 2026-09-02 14:50:50,977: Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG 2026-09-02 14:50:50,977: Sending unauthenticated request 2026-09-02 14:50:50,977: Sending request (223 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:50,977: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:51,071: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:51,071: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:51,198: Received answer (347 bytes) from https 38.145.32.20:443 2026-09-02 14:50:51,198: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:51,199: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:50:51,199: Preauthenticating using KDC method data 2026-09-02 14:50:51,199: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) 2026-09-02 14:50:51,199: Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params "" 2026-09-02 14:50:51,199: Received cookie: MIT 2026-09-02 14:50:51,199: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:51,199: PKINIT client received freshness token from KDC 2026-09-02 14:50:51,199: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:50:51,200: PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt 2026-09-02 14:50:51,200: PKINIT client computed checksums: CFF2716479E3D0E165B83D734FA0F9A483D3265C D38D20ACC8E386C3A8E79AB8006674C5B3E6E7B6CD4A3BD091A84CF299B9430C 2026-09-02 14:50:51,200: PKINIT client making DH request 2026-09-02 14:50:51,200: PKINIT using 2048-bit DH key exchange group 2026-09-02 14:50:51,200: Preauth module pkinit (16) (real) returned: 0/Success 2026-09-02 14:50:51,200: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) 2026-09-02 14:50:51,200: Sending request (1548 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:51,201: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:51,263: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:51,263: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:51,420: Received answer (2972 bytes) from https 38.145.32.20:443 2026-09-02 14:50:51,420: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:51,420: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147) 2026-09-02 14:50:51,420: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:51,420: PKINIT client verified DH reply 2026-09-02 14:50:51,421: PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org 2026-09-02 14:50:51,421: PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG 2026-09-02 14:50:51,421: PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required 2026-09-02 14:50:51,421: PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/11F1 2026-09-02 14:50:51,421: Preauth module pkinit (17) (real) returned: 0/Success 2026-09-02 14:50:51,421: Produced preauth for next request: (empty) 2026-09-02 14:50:51,421: AS key determined by preauth: aes256-sha2/11F1 2026-09-02 14:50:51,422: Decrypted AS reply; session key is: aes256-cts/FABF 2026-09-02 14:50:51,422: FAST negotiation: available 2026-09-02 14:50:51,422: Resolving unique ccache of type MEMORY 2026-09-02 14:50:51,422: Initializing MEMORY:t9WKmO4 with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS 2026-09-02 14:50:51,422: Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:50:51,422: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4 2026-09-02 14:50:51,423: Storing config in MEMORY:t9WKmO4 for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16 2026-09-02 14:50:51,423: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:t9WKmO4 2026-09-02 14:50:51,423: Storing config in MEMORY:t9WKmO4 for : start_realm: FEDORAPROJECT.ORG 2026-09-02 14:50:51,423: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:t9WKmO4 2026-09-02 14:50:51,423: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:t9WKmO4 2026-09-02 14:50:51,423: Moving ccache MEMORY:t9WKmO4 to MEMORY:gpd7Onk 2026-09-02 14:50:51,423: Destroying ccache MEMORY:t9WKmO4 2026-09-02 14:50:51,424: FAST armor ccache: MEMORY:gpd7Onk 2026-09-02 14:50:51,424: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success 2026-09-02 14:50:51,424: Read config in MEMORY:gpd7Onk for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:50:51,424: Using FAST due to armor ccache negotiation result 2026-09-02 14:50:51,424: Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:gpd7Onk 2026-09-02 14:50:51,424: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:gpd7Onk with result: 0/Success 2026-09-02 14:50:51,424: Read config in MEMORY:gpd7Onk for : start_realm: FEDORAPROJECT.ORG 2026-09-02 14:50:51,424: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:gpd7Onk with result: 0/Success 2026-09-02 14:50:51,425: Armor ccache session key: aes256-cts/FABF 2026-09-02 14:50:51,425: Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/BE85, session key aes256-cts/FABF 2026-09-02 14:50:51,425: FAST armor key: aes256-cts/F638 2026-09-02 14:50:51,425: Sending unauthenticated request 2026-09-02 14:50:51,425: Encoding request body and padata into FAST request 2026-09-02 14:50:51,425: Sending request (1019 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:51,425: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:51,464: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:51,464: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:51,601: Received answer (800 bytes) from https 38.145.32.20:443 2026-09-02 14:50:51,601: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:51,602: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:50:51,602: Decoding FAST response 2026-09-02 14:50:51,602: Preauthenticating using KDC method data 2026-09-02 14:50:51,602: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) 2026-09-02 14:50:51,602: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" 2026-09-02 14:50:51,602: Received cookie: MIT1\x00\x00\x00\x01\x94.l\xe8\x14w\xc1\xf1t\xf4\x0dLd\x04gQY\xa65\x0a\xcc\x0a4\x00a\xc7\xc4\xe8\xe6v#\x0eU\xdbE\x01\xe5\x8fn\xd5<\x1e\x0cU9s\x99;\xa23\xd3\xfaE\xcc\xbej\x84\xf7\xfc-z\x09\x92l\x9e\x9a\x8c\x9b A%\x09\x82\xd3\x0f\x84\x98\xbbq\xc4\xc0\xe3\x16\xe6 \x0b\xd4\xf6u\xeeI\x88\x95'n\x1b\x82\x00\xfdt\xe0kk\xc5\xfc\xd7\xfc#\xa3\xf9\x95\xfa\xed[\xc9\xbd\x8b\xfa$\xa3\xe64\x86h,]f\xb4F? 2026-09-02 14:50:51,602: PKINIT client has no configured identity; giving up 2026-09-02 14:50:51,602: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:51,602: PKINIT client received freshness token from KDC 2026-09-02 14:50:51,603: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:50:51,603: PKINIT client has no configured identity; giving up 2026-09-02 14:50:51,603: Preauth module pkinit (16) (real) returned: 22/Invalid argument 2026-09-02 14:50:51,603: SPAKE challenge received with group 1, pubkey B38109F35D335EDD4EBBA62AD4D2CE7E98967656FD4054AE56C2460B284466CA 2026-09-02 14:50:51,603: Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success 2026-09-02 14:50:51,603: SPAKE key generated with pubkey 7FEEFF171B0F115707D1945CF03976813DC1EC0A1716D93A2348DC698D8792E9 2026-09-02 14:50:51,603: SPAKE algorithm result: 90DFE156107E3D509976FC531F55863CC22E4C9C4285981EB854580C46809471 2026-09-02 14:50:51,603: SPAKE final transcript hash: 0B435324B8005D8C9055511FE3A07AD8B68646FBF7284274D28D0CBB0730A5B5 2026-09-02 14:50:51,603: Sending SPAKE response 2026-09-02 14:50:51,603: Preauth module spake (151) (real) returned: 0/Success 2026-09-02 14:50:51,603: Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151) 2026-09-02 14:50:51,604: Encoding request body and padata into FAST request 2026-09-02 14:50:51,604: Sending request (1281 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:51,604: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:51,663: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:51,664: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:51,791: Received answer (594 bytes) from https 38.145.32.20:443 2026-09-02 14:50:51,791: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:51,792: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:50:51,792: Decoding FAST response 2026-09-02 14:50:51,792: Preauthenticating using KDC method data 2026-09-02 14:50:51,792: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) 2026-09-02 14:50:51,792: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" 2026-09-02 14:50:51,792: Received cookie: MIT 2026-09-02 14:50:51,792: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:51,792: PKINIT client received freshness token from KDC 2026-09-02 14:50:51,793: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:50:51,793: Preauth module encrypted_challenge (138) (real) returned: 0/Success 2026-09-02 14:50:51,793: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138) 2026-09-02 14:50:51,793: Encoding request body and padata into FAST request 2026-09-02 14:50:51,793: Sending request (1118 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:51,793: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:51,853: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:51,854: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:52,037: Received answer (592 bytes) from https 38.145.32.20:443 2026-09-02 14:50:52,037: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:52,038: Received error from KDC: -1765328360/Preauthentication failed 2026-09-02 14:50:52,038: Decoding FAST response 2026-09-02 14:50:52,038: Destroying ccache MEMORY:gpd7Onk 2026-09-02 14:50:52,038: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. 2026-09-02 14:50:52,058: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" 2026-09-02 14:50:52,059: Getting initial credentials for packit@FEDORAPROJECT.ORG 2026-09-02 14:50:52,059: Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts 2026-09-02 14:50:52,059: Resolving unique ccache of type MEMORY 2026-09-02 14:50:52,059: Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG 2026-09-02 14:50:52,059: Sending unauthenticated request 2026-09-02 14:50:52,059: Sending request (223 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:52,059: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:52,129: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:52,129: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:52,278: Received answer (556 bytes) from https 38.145.32.20:443 2026-09-02 14:50:52,278: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:52,278: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:50:52,279: Preauthenticating using KDC method data 2026-09-02 14:50:52,279: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) 2026-09-02 14:50:52,279: Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params "" 2026-09-02 14:50:52,279: Received cookie: MIT1\x00\x00\x00\x01\xbc\xd8\x19\xc0W\x1aU\xd9\xd9&L\xc6\xf8A\x84i\xd0\xa2\x7f_:\xdc\x0a%\xd3\x06v\xd1dS\xe8\xe39\xcc\x9c\x02\x8b\x16\xb6j\xf6\xaa\x10\xf4u\x13+\x80j\xf6\\x85\xae\x00+\xf6q\xff\xb0\x1cZ\x91v1\x1d\xccJ\xc5L\x1e\xa9\x05\xa7\x18oZ\xe69\x89\xc9\xc9\xd7\xf1\xf1K\x98\xe8\xa3p\xc0\xa3yU/O\xe9bH5\xec\xb4\xa2\xe4\\xe9\xe48U\xf11fC+n53\xb5f\xfdk\x12nAq\xf5\x16Y\xe0\x83* 2026-09-02 14:50:52,279: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:52,279: PKINIT client received freshness token from KDC 2026-09-02 14:50:52,279: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:50:52,279: PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt 2026-09-02 14:50:52,279: PKINIT client computed checksums: 5589B8195A9F021D490DB75297AC64DD4E369FA5 4D094838C782CB2752650F599A416C5AE4D11C028974D4914B156474C1C892AA 2026-09-02 14:50:52,280: PKINIT client making DH request 2026-09-02 14:50:52,280: PKINIT using 2048-bit DH key exchange group 2026-09-02 14:50:52,280: Preauth module pkinit (16) (real) returned: 0/Success 2026-09-02 14:50:52,280: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) 2026-09-02 14:50:52,280: Sending request (1685 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:50:52,280: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:52,342: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:52,343: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:52,473: Received answer (2972 bytes) from https 38.145.32.20:443 2026-09-02 14:50:52,473: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:52,474: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147) 2026-09-02 14:50:52,474: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:52,474: PKINIT client verified DH reply 2026-09-02 14:50:52,475: PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa01.rdu3.fedoraproject.org 2026-09-02 14:50:52,475: PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG 2026-09-02 14:50:52,475: PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required 2026-09-02 14:50:52,475: PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/5754 2026-09-02 14:50:52,475: Preauth module pkinit (17) (real) returned: 0/Success 2026-09-02 14:50:52,475: Produced preauth for next request: (empty) 2026-09-02 14:50:52,476: AS key determined by preauth: aes256-sha2/5754 2026-09-02 14:50:52,476: Decrypted AS reply; session key is: aes256-cts/B527 2026-09-02 14:50:52,476: FAST negotiation: available 2026-09-02 14:50:52,476: Resolving unique ccache of type MEMORY 2026-09-02 14:50:52,476: Initializing MEMORY:URxV4XJ with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS 2026-09-02 14:50:52,476: Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ 2026-09-02 14:50:52,477: Storing config in MEMORY:URxV4XJ for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16 2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:URxV4XJ 2026-09-02 14:50:52,477: Storing config in MEMORY:URxV4XJ for : start_realm: FEDORAPROJECT.ORG 2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:URxV4XJ 2026-09-02 14:50:52,477: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:URxV4XJ 2026-09-02 14:50:52,477: Moving ccache MEMORY:URxV4XJ to MEMORY:xTKep4B 2026-09-02 14:50:52,477: Destroying ccache MEMORY:URxV4XJ 2026-09-02 14:50:52,477: FAST armor ccache: MEMORY:xTKep4B 2026-09-02 14:50:52,478: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success 2026-09-02 14:50:52,478: Read config in MEMORY:xTKep4B for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:50:52,478: Using FAST due to armor ccache negotiation result 2026-09-02 14:50:52,478: Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:xTKep4B 2026-09-02 14:50:52,478: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:xTKep4B with result: 0/Success 2026-09-02 14:50:52,478: Read config in MEMORY:xTKep4B for : start_realm: FEDORAPROJECT.ORG 2026-09-02 14:50:52,478: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:xTKep4B with result: 0/Success 2026-09-02 14:50:52,479: Armor ccache session key: aes256-cts/B527 2026-09-02 14:50:52,479: Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/4B71, session key aes256-cts/B527 2026-09-02 14:50:52,479: FAST armor key: aes256-cts/D22A 2026-09-02 14:50:52,479: Sending unauthenticated request 2026-09-02 14:50:52,479: Encoding request body and padata into FAST request 2026-09-02 14:50:52,479: Sending request (1019 bytes) to FEDORAPROJECT.ORG (primary) 2026-09-02 14:50:52,480: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. 2026-09-02 14:50:52,480: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" 2026-09-02 14:50:52,480: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:52,548: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:52,548: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:52,683: Received answer (800 bytes) from https 38.145.32.20:443 2026-09-02 14:50:52,683: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:52,684: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:50:52,684: Decoding FAST response 2026-09-02 14:50:52,684: Preauthenticating using KDC method data 2026-09-02 14:50:52,684: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) 2026-09-02 14:50:52,684: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" 2026-09-02 14:50:52,685: Received cookie: MIT1\x00\x00\x00\x01\x9d@\x0c\x1fb\x92\x9c0\xdb8D+Y\xf1\xff\x02h\x16\xc9v)\x06\x9e\x89\xa2<|Zc\xe8\xd9\xf9pZ'\x87Fb\x96\xadYa\xd7\xa8l\x1a\x09\x9d\xb1M\xa0\xc5*m\x94O0J\xfeL\x8b#W#W\xd8k\xa8\xd7\xb5.z(\xa6(\xa2\x0d\xaf\xc1n\xd8w\xb8\x01\xce\xfc_\x93\x97\x0d>\xf2\xfbuq\xd1e\xf2h8W\xbdk\\xc0\xd1\xc0^\x07\xfe\xc5\xd0\xb2\xfb\xdf\xc4\x136\x9b\x00\xcdy\xb1\xc4\xb7\xads\x00\xa4[ 2026-09-02 14:50:52,685: PKINIT client has no configured identity; giving up 2026-09-02 14:50:52,685: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:52,685: PKINIT client received freshness token from KDC 2026-09-02 14:50:52,685: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:50:52,685: PKINIT client has no configured identity; giving up 2026-09-02 14:50:52,685: Preauth module pkinit (16) (real) returned: 22/Invalid argument 2026-09-02 14:50:52,685: SPAKE challenge received with group 1, pubkey 94CF07AB9530258297C0BC5F3555525370ACDA775EE1C32C5206E58A0BB0A693 2026-09-02 14:50:52,685: Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success 2026-09-02 14:50:52,685: SPAKE key generated with pubkey 8AC5FF7DA572D6333099A0BB9D24509B2BB522C6BB6D529454254B9D2650E015 2026-09-02 14:50:52,686: SPAKE algorithm result: 661ED732C4913D827AAA28F6B7873CACA57DC907781301F0C68E16AC8FC7EAA3 2026-09-02 14:50:52,686: SPAKE final transcript hash: 8AE8107586D0C85345733C43223FFB73E9578029A19C7380C2A185088E459F89 2026-09-02 14:50:52,686: Sending SPAKE response 2026-09-02 14:50:52,686: Preauth module spake (151) (real) returned: 0/Success 2026-09-02 14:50:52,686: Produced preauth for next request: PA-FX-COOKIE (133), PA-SPAKE (151) 2026-09-02 14:50:52,686: Encoding request body and padata into FAST request 2026-09-02 14:50:52,686: Sending request (1281 bytes) to FEDORAPROJECT.ORG (primary) 2026-09-02 14:50:52,686: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. 2026-09-02 14:50:52,686: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" 2026-09-02 14:50:52,686: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:52,746: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:52,747: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:52,876: Received answer (594 bytes) from https 38.145.32.20:443 2026-09-02 14:50:52,876: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:52,877: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:50:52,877: Decoding FAST response 2026-09-02 14:50:52,877: Preauthenticating using KDC method data 2026-09-02 14:50:52,877: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) 2026-09-02 14:50:52,877: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" 2026-09-02 14:50:52,877: Received cookie: MIT 2026-09-02 14:50:52,877: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:50:52,877: PKINIT client received freshness token from KDC 2026-09-02 14:50:52,877: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:50:52,878: Preauth module encrypted_challenge (138) (real) returned: 0/Success 2026-09-02 14:50:52,878: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138) 2026-09-02 14:50:52,878: Encoding request body and padata into FAST request 2026-09-02 14:50:52,878: Sending request (1118 bytes) to FEDORAPROJECT.ORG (primary) 2026-09-02 14:50:52,878: Sending DNS URI query for _kerberos.FEDORAPROJECT.ORG. 2026-09-02 14:50:52,878: URI answer: 10 1 "krb5srv:m:kkdcp:https://id.fedoraproject.org/KdcProxy/" 2026-09-02 14:50:52,878: Resolving hostname id.fedoraproject.org 2026-09-02 14:50:52,943: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:50:52,943: Sending HTTPS request to https 38.145.32.20:443 2026-09-02 14:50:53,149: Received answer (594 bytes) from https 38.145.32.20:443 2026-09-02 14:50:53,149: Terminating TCP connection to https 38.145.32.20:443 2026-09-02 14:50:53,150: Received error from KDC: -1765328360/Preauthentication failed 2026-09-02 14:50:53,150: Decoding FAST response 2026-09-02 14:50:53,150: Destroying ccache MEMORY:xTKep4B ``` It definitely doesn't happen every time, here is one successful kinit for comparison: ``` 2026-09-02 14:26:48,997: Matching packit@FEDORAPROJECT.ORG in collection with result: 0/Success 2026-09-02 14:26:48,997: Getting initial credentials for packit@FEDORAPROJECT.ORG 2026-09-02 14:26:48,997: Found entries for packit@FEDORAPROJECT.ORG in keytab: aes256-cts 2026-09-02 14:26:48,998: Resolving unique ccache of type MEMORY 2026-09-02 14:26:48,998: Getting initial credentials for WELLKNOWN/ANONYMOUS@FEDORAPROJECT.ORG 2026-09-02 14:26:48,998: Sending unauthenticated request 2026-09-02 14:26:48,998: Sending request (223 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:26:48,998: Resolving hostname id.fedoraproject.org 2026-09-02 14:26:49,038: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:26:49,038: Sending HTTPS request to https 38.145.32.21:443 2026-09-02 14:26:49,163: Received answer (556 bytes) from https 38.145.32.21:443 2026-09-02 14:26:49,163: Terminating TCP connection to https 38.145.32.21:443 2026-09-02 14:26:49,163: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:26:49,164: Preauthenticating using KDC method data 2026-09-02 14:26:49,164: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) 2026-09-02 14:26:49,164: Selected etype info: etype aes256-cts, salt "FEDORAPROJECT.ORGWELLKNOWNANONYMOUS", params "" 2026-09-02 14:26:49,164: Received cookie: MIT1\x00\x00\x00\x01\xbd\xa3\xac\xc4\x8e\xc8|}\xed\xf6W\xd2\xb2T\x94\xb0\xc3A[{\xbak\xa6z%\xe13\xea\xda\x9f\xd4\x0e\x1b\x9f\x11\x80\xc8`D\x02\xca\\x9d\xa4m\x94\x94\xd2\xc1\x09u)`\x97@.h,G\xf6\x02\xe9\xa2jCpN\x9e\xb4\x9a\xf7\x95_\xb8\xc9\x1a\xe4\xe3\xc8\xf3GT\x11\xa2\xe0\x16\xcdJ\x884"\xd1\xb6Ws\xf2I\x03\xb9\xc8|\x93\xca\xab\xc7\xbb\xf2\x06c\xb4\xf3s$\xe0\xfd\xc9a>\xf4laU\xa4\xf3\xc5\xd1p\x00ao 2026-09-02 14:26:49,164: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:26:49,164: PKINIT client received freshness token from KDC 2026-09-02 14:26:49,164: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:26:49,164: PKINIT loading CA certs and CRLs from FILE /etc/pki/ipa/fedoraproject_ipa_ca.crt 2026-09-02 14:26:49,164: PKINIT client computed checksums: B29098FA25B5D0354EF8544D6337CEF19AB763EC 69354422FECACE7E68B850C7075BD8D6962D8E9B1F9C16F0FADA683DD6C9BC09 2026-09-02 14:26:49,165: PKINIT client making DH request 2026-09-02 14:26:49,165: PKINIT using 2048-bit DH key exchange group 2026-09-02 14:26:49,165: Preauth module pkinit (16) (real) returned: 0/Success 2026-09-02 14:26:49,165: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) 2026-09-02 14:26:49,165: Sending request (1685 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:26:49,165: Resolving hostname id.fedoraproject.org 2026-09-02 14:26:49,231: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:26:49,232: Sending HTTPS request to https 38.145.32.21:443 2026-09-02 14:26:49,383: Received answer (2973 bytes) from https 38.145.32.21:443 2026-09-02 14:26:49,383: Terminating TCP connection to https 38.145.32.21:443 2026-09-02 14:26:49,384: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147) 2026-09-02 14:26:49,384: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:26:49,384: PKINIT client verified DH reply 2026-09-02 14:26:49,384: PKINIT client found 3 SANs (1 princs, 0 UPNs, 0 DNS names) in certificate /O=FEDORAPROJECT.ORG/CN=ipa03.rdu3.fedoraproject.org 2026-09-02 14:26:49,384: PKINIT client found id-pkinit-san in KDC cert: krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG 2026-09-02 14:26:49,385: PKINIT client matched KDC principal krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG against id-pkinit-san; no EKU check required 2026-09-02 14:26:49,385: PKINIT used KDF 2B06010502030602 to compute reply key aes256-sha2/5454 2026-09-02 14:26:49,385: Preauth module pkinit (17) (real) returned: 0/Success 2026-09-02 14:26:49,385: Produced preauth for next request: (empty) 2026-09-02 14:26:49,385: AS key determined by preauth: aes256-sha2/5454 2026-09-02 14:26:49,385: Decrypted AS reply; session key is: aes256-cts/EBBC 2026-09-02 14:26:49,385: FAST negotiation: available 2026-09-02 14:26:49,385: Resolving unique ccache of type MEMORY 2026-09-02 14:26:49,385: Initializing MEMORY:6fTkNGl with default princ WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS 2026-09-02 14:26:49,385: Storing config in MEMORY:6fTkNGl for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:6fTkNGl 2026-09-02 14:26:49,386: Storing config in MEMORY:6fTkNGl for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 16 2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:6fTkNGl 2026-09-02 14:26:49,386: Storing config in MEMORY:6fTkNGl for : start_realm: FEDORAPROJECT.ORG 2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: in MEMORY:6fTkNGl 2026-09-02 14:26:49,386: Storing WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:6fTkNGl 2026-09-02 14:26:49,386: Moving ccache MEMORY:6fTkNGl to MEMORY:enUJJbD 2026-09-02 14:26:49,386: Destroying ccache MEMORY:6fTkNGl 2026-09-02 14:26:49,386: FAST armor ccache: MEMORY:enUJJbD 2026-09-02 14:26:49,386: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: from MEMORY:enUJJbD with result: 0/Success 2026-09-02 14:26:49,386: Read config in MEMORY:enUJJbD for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:26:49,387: Using FAST due to armor ccache negotiation result 2026-09-02 14:26:49,387: Getting credentials WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG using ccache MEMORY:enUJJbD 2026-09-02 14:26:49,387: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:enUJJbD with result: 0/Success 2026-09-02 14:26:49,387: Read config in MEMORY:enUJJbD for : start_realm: FEDORAPROJECT.ORG 2026-09-02 14:26:49,387: Retrieving WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from MEMORY:enUJJbD with result: 0/Success 2026-09-02 14:26:49,387: Armor ccache session key: aes256-cts/EBBC 2026-09-02 14:26:49,387: Creating authenticator for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, seqnum 0, subkey aes256-cts/E8F7, session key aes256-cts/EBBC 2026-09-02 14:26:49,387: FAST armor key: aes256-cts/A1E9 2026-09-02 14:26:49,387: Sending unauthenticated request 2026-09-02 14:26:49,387: Encoding request body and padata into FAST request 2026-09-02 14:26:49,387: Sending request (1019 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:26:49,388: Resolving hostname id.fedoraproject.org 2026-09-02 14:26:49,455: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:26:49,455: Sending HTTPS request to https 38.145.32.21:443 2026-09-02 14:26:49,586: Received answer (592 bytes) from https 38.145.32.21:443 2026-09-02 14:26:49,586: Terminating TCP connection to https 38.145.32.21:443 2026-09-02 14:26:49,587: Received error from KDC: -1765328359/Additional pre-authentication required 2026-09-02 14:26:49,587: Decoding FAST response 2026-09-02 14:26:49,587: Preauthenticating using KDC method data 2026-09-02 14:26:49,587: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-ENCRYPTED-CHALLENGE (138), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133), PA-FX-ERROR (137) 2026-09-02 14:26:49,587: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" 2026-09-02 14:26:49,587: Received cookie: MIT 2026-09-02 14:26:49,588: PKINIT client has no configured identity; giving up 2026-09-02 14:26:49,588: Preauth module pkinit (147) (info) returned: 0/Success 2026-09-02 14:26:49,588: PKINIT client received freshness token from KDC 2026-09-02 14:26:49,588: Preauth module pkinit (150) (info) returned: 0/Success 2026-09-02 14:26:49,588: PKINIT client has no configured identity; giving up 2026-09-02 14:26:49,588: Preauth module pkinit (16) (real) returned: 22/Invalid argument 2026-09-02 14:26:49,588: Retrieving packit@FEDORAPROJECT.ORG from FILE:/secrets/fedora.keytab (vno 0, enctype aes256-cts) with result: 0/Success 2026-09-02 14:26:49,588: Preauth module encrypted_challenge (138) (real) returned: 0/Success 2026-09-02 14:26:49,588: Produced preauth for next request: PA-FX-COOKIE (133), PA-ENCRYPTED-CHALLENGE (138) 2026-09-02 14:26:49,588: Encoding request body and padata into FAST request 2026-09-02 14:26:49,589: Sending request (1117 bytes) to FEDORAPROJECT.ORG 2026-09-02 14:26:49,589: Resolving hostname id.fedoraproject.org 2026-09-02 14:26:49,654: TLS certificate name matched "id.fedoraproject.org" 2026-09-02 14:26:49,654: Sending HTTPS request to https 38.145.32.21:443 2026-09-02 14:26:49,910: Received answer (2055 bytes) from https 38.145.32.21:443 2026-09-02 14:26:49,910: Terminating TCP connection to https 38.145.32.21:443 2026-09-02 14:26:49,911: Decoding FAST response 2026-09-02 14:26:49,911: Processing preauth types: PA-ENCRYPTED-CHALLENGE (138), PA-ETYPE-INFO2 (19) 2026-09-02 14:26:49,911: Selected etype info: etype aes256-cts, salt "Cn90 Y,B :A0D)5/", params "" 2026-09-02 14:26:49,911: Preauth module encrypted_challenge (138) (real) returned: 0/Success 2026-09-02 14:26:49,911: Produced preauth for next request: (empty) 2026-09-02 14:26:49,911: AS key determined by preauth: aes256-cts/FD25 2026-09-02 14:26:49,912: FAST reply key: aes256-cts/1304 2026-09-02 14:26:49,912: Decrypted AS reply; session key is: aes256-cts/F06B 2026-09-02 14:26:49,912: FAST negotiation: available 2026-09-02 14:26:49,912: Resolving unique ccache of type MEMORY 2026-09-02 14:26:49,912: Initializing MEMORY:xT6Xlaj with default princ packit@FEDORAPROJECT.ORG 2026-09-02 14:26:49,912: Storing config in MEMORY:xT6Xlaj for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: fast_avail: yes 2026-09-02 14:26:49,912: Storing packit@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/fast_avail/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:xT6Xlaj 2026-09-02 14:26:49,912: Storing config in MEMORY:xT6Xlaj for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG: pa_type: 138 2026-09-02 14:26:49,912: Storing packit@FEDORAPROJECT.ORG -> krb5_ccache_conf_data/pa_type/krbtgt\/FEDORAPROJECT.ORG\@FEDORAPROJECT.ORG@X-CACHECONF: in MEMORY:xT6Xlaj 2026-09-02 14:26:49,912: Storing packit@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG in MEMORY:xT6Xlaj 2026-09-02 14:26:49,913: Moving ccache MEMORY:xT6Xlaj to DIR::/home/packit/kerberos/tkt 2026-09-02 14:26:49,913: Destroying ccache MEMORY:xT6Xlaj 2026-09-02 14:26:49,913: Destroying ccache MEMORY:enUJJbD ```
tuliom commented 2026-09-02 18:45:18 +00:00
Author
Copy link

@kevin wrote in #13539 (comment):

Is it always the initial scratch build from packit that gets the error? Does it always happen or sporadic?

I haven't seen a failure after retrying yet, but I don't think I have enough data to take conclusions yet.
It's definitely sporadic. Some PRs work well.

@kevin wrote in https://forge.fedoraproject.org/infra/tickets/issues/13539#issuecomment-1352744: > Is it always the initial scratch build from packit that gets the error? Does it always happen or sporadic? I haven't seen a failure after retrying yet, but I don't think I have enough data to take conclusions yet. It's definitely sporadic. Some PRs work well.
kevin commented 2026-09-02 18:50:30 +00:00
Owner
Copy link

I've been digging through logs, but I can't seem to come up with enough to make a theory. ;(

I do see some:

krb5kdc5910: preauth (encrypted_timestamp) verify failure: Preauthentication failed

but not sure they line up. Thats why I asked about time being in sync...

Also this:

krb5kdc[54736](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.16.163.104: PREAUTH_FAILED: packit@FEDORAPROJECT.ORG for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, Incorrect password in encrypted challenge
I've been digging through logs, but I can't seem to come up with enough to make a theory. ;( I do see some: krb5kdc[5910](info): preauth (encrypted_timestamp) verify failure: Preauthentication failed but not sure they line up. Thats why I asked about time being in sync... Also this: ``` krb5kdc[54736](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.16.163.104: PREAUTH_FAILED: packit@FEDORAPROJECT.ORG for krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG, Incorrect password in encrypted challenge ```
zlopez commented 2026-09-03 08:05:19 +00:00
Owner
Copy link

One thing that I recently dealt with was the different kvno between the server and the local key.

On IPA side we have this:

Number of keys: 3
Key: vno 6, aes256-cts-hmac-sha1-96:special
Key: vno 6, aes128-cts-hmac-sha1-96:special
Key: vno 6, DEPRECATED:arcfour-hmac:special

Could you try to run klist -kte /path/to/packit.keytab and share the kvno for the generated packit keytab?

One thing that I recently dealt with was the different kvno between the server and the local key. On IPA side we have this: ``` Number of keys: 3 Key: vno 6, aes256-cts-hmac-sha1-96:special Key: vno 6, aes128-cts-hmac-sha1-96:special Key: vno 6, DEPRECATED:arcfour-hmac:special ``` Could you try to run `klist -kte /path/to/packit.keytab` and share the kvno for the generated packit keytab?
nforro commented 2026-09-03 09:09:14 +00:00
Copy link
$ klist -kte  secrets/packit/prod/fedora.keytab 
Keytab name: FILE:secrets/packit/prod/fedora.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   6 2023-04-25 18:46:32 packit@FEDORAPROJECT.ORG (aes256-cts-hmac-sha1-96)
```bash $ klist -kte secrets/packit/prod/fedora.keytab Keytab name: FILE:secrets/packit/prod/fedora.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 6 2023-04-25 18:46:32 packit@FEDORAPROJECT.ORG (aes256-cts-hmac-sha1-96) ```
zlopez commented 2026-09-03 10:00:47 +00:00
Owner
Copy link

In that case the kvno doesn't seem to be the issue.

In that case the kvno doesn't seem to be the issue.
kashyapc commented 2026-09-03 16:02:05 +00:00
Copy link

FWIW, I'm seeing it too on RISC-V Koji; query operations like riscv-koji list-tags work, but scratch builds and even riscv-koji hello fails.

This works:

$> riscv-koji list-tags | tail -2
f46-updates
rawhide

$> riscv-koji hello
2026-09-03 18:00:19,383 [ERROR] koji: (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://riscv-koji.fedoraproject.org/kojihub/ssllogin)
Use following documentation to debug kerberos/gssapi auth issues. https://docs.pagure.org/koji/kerberos_gssapi_debug/
2026-09-03 18:00:19,384 [ERROR] koji: GSSAPIAuthError: unable to obtain a session (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://riscv-koji.fedoraproject.org/kojihub/ssllogin)
Use following documentation to debug kerberos/gssapi auth issues. https://docs.pagure.org/koji/kerberos_gssapi_debug/
FWIW, I'm seeing it too on RISC-V Koji; query operations like `riscv-koji list-tags` work, but scratch builds and even `riscv-koji hello` fails. This works: ``` $> riscv-koji list-tags | tail -2 f46-updates rawhide $> riscv-koji hello 2026-09-03 18:00:19,383 [ERROR] koji: (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://riscv-koji.fedoraproject.org/kojihub/ssllogin) Use following documentation to debug kerberos/gssapi auth issues. https://docs.pagure.org/koji/kerberos_gssapi_debug/ 2026-09-03 18:00:19,384 [ERROR] koji: GSSAPIAuthError: unable to obtain a session (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://riscv-koji.fedoraproject.org/kojihub/ssllogin) Use following documentation to debug kerberos/gssapi auth issues. https://docs.pagure.org/koji/kerberos_gssapi_debug/ ```
kevin commented 2026-09-03 16:23:37 +00:00
Owner
Copy link

Can you attach output of:

KRB5_TRACE=/dev/stdout riscv-koji hello

(list-tags I think doesn't require auth)

Can you attach output of: KRB5_TRACE=/dev/stdout riscv-koji hello (list-tags I think doesn't require auth)
nforro commented 2026-09-04 06:34:45 +00:00
Copy link

This is what Claude Sonnet 5 deduced from the logs, if that helps:

What differs between replicas

  • Against ipa03 (success): after the FAST-armored request, the KDC's
    preauth-types list only contains PA-ENCRYPTED-CHALLENGE (138) (no
    SPAKE). The client does the keytab-based encrypted-challenge exchange
    once and gets a ticket immediately.
  • Against ipa01 (failure): the KDC's preauth-types list also
    includes PA-SPAKE (151). The client engages SPAKE first (module
    reports success), the KDC asks for one more round
    ("Additional pre-authentication required" again), the client then does
    encrypted-challenge — but this time the final AS-REP comes back as
    -1765328360 / Preauthentication failed instead of succeeding.

So doing SPAKE and then encrypted-challenge in the same exchange against
ipa01 corrupts/mismatches the preauth state and the KDC rejects it,
whereas going straight to encrypted-challenge (as ipa03 requires) works
fine.

Conclusion

This isn't the keytab, client config, or network — it's a
version/configuration mismatch between the Fedora IPA/KDC replicas behind
id.fedoraproject.org. ipa01 is advertising PA-SPAKE in a way that
breaks the encrypted-challenge fallback for keytab-based clients, while
ipa03 (and presumably other replicas) don't offer SPAKE and work fine.
Since replicas are picked essentially at random per attempt, this produces
intermittent failures — consistent with them starting ~1 week ago, likely
from a partial rollout/upgrade across the replicas.

This is what Claude Sonnet 5 deduced from the logs, if that helps: ### What differs between replicas - Against **ipa03** (success): after the FAST-armored request, the KDC's preauth-types list only contains `PA-ENCRYPTED-CHALLENGE (138)` (no SPAKE). The client does the keytab-based encrypted-challenge exchange once and gets a ticket immediately. - Against **ipa01** (failure): the KDC's preauth-types list *also* includes `PA-SPAKE (151)`. The client engages SPAKE first (module reports success), the KDC asks for one more round ("Additional pre-authentication required" again), the client then does encrypted-challenge — but this time the final AS-REP comes back as `-1765328360 / Preauthentication failed` instead of succeeding. So doing SPAKE *and then* encrypted-challenge in the same exchange against ipa01 corrupts/mismatches the preauth state and the KDC rejects it, whereas going straight to encrypted-challenge (as ipa03 requires) works fine. ### Conclusion This isn't the keytab, client config, or network — it's a version/configuration mismatch between the Fedora IPA/KDC replicas behind `id.fedoraproject.org`. `ipa01` is advertising `PA-SPAKE` in a way that breaks the encrypted-challenge fallback for keytab-based clients, while `ipa03` (and presumably other replicas) don't offer SPAKE and work fine. Since replicas are picked essentially at random per attempt, this produces intermittent failures — consistent with them starting ~1 week ago, likely from a partial rollout/upgrade across the replicas.
kevin commented 2026-09-04 17:10:11 +00:00
Owner
Copy link

I'm not a fan of meat puppetting, but that does indeed seem like something to look further into.

All our ipa servers are installed the same exact way via ansible, so there should not actually be any differences, but will look and see if I can find anything. Thanks for the pointer.

I'm not a fan of meat puppetting, but that does indeed seem like something to look further into. All our ipa servers are installed the same exact way via ansible, so there should not actually be any differences, but will look and see if I can find anything. Thanks for the pointer.
kevin commented 2026-09-04 17:36:14 +00:00
Owner
Copy link

I can't seem to find any config differences between them so far. ;(

I did restart krb5kdc and httpd on both of them... can you test and see if that changed anything?
(On the theory that ipa01 had a old config in the running service and needed a restart).

I can't seem to find any config differences between them so far. ;( I did restart krb5kdc and httpd on both of them... can you test and see if that changed anything? (On the theory that ipa01 had a old config in the running service and needed a restart).
nforro commented 2026-09-07 06:58:04 +00:00
Copy link

@kevin So far so good, I can't reproduce the error locally anymore and the last occurence in Packit Service happened about 30 minutes before your last message 🎉

@kevin So far so good, I can't reproduce the error locally anymore and the last occurence in Packit Service happened about 30 minutes before your last message 🎉
kevin commented 2026-09-08 16:07:50 +00:00
Owner
Copy link

Excellent. So, lets hope it was just a restart needed then.

Do reopen or file a new ticket if anyone still sees anything or sees anything new.

Excellent. So, lets hope it was just a restart needed then. Do reopen or file a new ticket if anyone still sees anything or sees anything new.
❤️ 1
kevin closed this issue 2026-09-08 16:07:50 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
announcement

Archived

  
anubis
Issues related to anubis

  
authentication
Authentication related issues

  
aws
Issues related to Amazon Web Services

  
backlog
Tasks that will take longer then ~4 hours to do

Archived

  
blocked
Issue is blocked

Archived

  
bodhi
Issues with Bodhi

  
ci
Continuous Integration

  
cloud
Items in FedoraInfraCloud or COmmunishift

  
communishift
issues/questions about os.edorainfracloud.org ( Community OpenShift)

  
copr
COPR system (run by other team)

  
database
Issues related to databases

  
day-to-day
These are small self contained tasks that are part of normal operations, but are async from sprint planning.

  
dc-move
Items related to datacenter move

Archived

  
deprecated
Tools which Infrastructure may not be able to fix

Archived

  
dev
Tasks requiring some dev work

  
discourse
outsourced tool

  
dns
Changes or problems with DNS

  
downloads
rsync,dl.fp.o,AWS,torrents

  
easyfix

Archived

  
epel
Issues relating to epel

Archived

  
firmitas

   
forgejo_migration
Request migration to the new forge

  
Gain
High
 task that gets us a lot / is important / makes many people happy

Archived

  
Gain
Low
 tasks that gets us little / isn't very important / makes only 1 person or few happy

Archived

  
Gain
Medium
 task that gets us some / is somewhat important / makes some people happy

Archived

  
gitlab

   
greenwave
Issues with greenwave

  
hardware
Problem is with Fedora Infrastructure Owned/Leased Hardware

  
help wanted

   
high-trouble
task that is complex/long/difficult

Archived

  
koji
Issues with the build system

  
koschei
Items needing Koschei team

  
lists
issues with lists

  
low-trouble
task that is easy/short

Archived

  
medium-trouble
task that is medium complex / difficult

Archived

  
mirrorlists
Way to tell systems where downloads are

  
monitoring

   
Needs investigation

   
odcs
On Demand Compose Service issues

Archived

  
OpenShift
Issues with OpenShift

  
ops
ops problem now...

Archived

  
outage

   
packager_workflow_blocker
Blocks the packager workflow

Archived

  
pagure
Issues with pagure.io

  
permissions
Items which need permissions set in outside tools

  
Priority
Needs Review
 Priority of Needs Review

Archived

  
Priority
Next Meeting
 Priority of Next Meeting

Archived

  
Priority
🔥 URGENT 🔥
 Priority of 🔥 URGENT 🔥

Archived

  
Priority
Waiting on Assignee
 Priority of Waiting on Assignee

Archived

  
Priority
Waiting on External
 Priority of Waiting on External

Archived

  
Priority
Waiting on Reporter
 Priority of Waiting on Reporter

Archived

  
rabbitmq
issues with the message broker

  
release-monitoring
release-monitoring.org (Anitya)

  
releng
For problems which should be in the releng ticket system

Archived

  
request-for-resources

   
s390x
The secondary architecture hardware and problems related with it

  
security

   
SMTP
Email issues outside of lists (DMARC, SPF, aliases)

  
sprint-0

Archived

  
sprint-1

Archived

  
src.fp.o
Issues related to src.fedoraproject.org

  
staging
Issues in staging

  
unfreeze
Patches to be applied after freeze is lifted

  
waiverdb
Issues with waiverdb

  
websites-general
General items with a website focus

  
wiki
Issues with the Wiki

  
Backlog Status
Needs Review
 Work items that have been created or updated but need review, refinement, or approval before they can be considered ready for sprint planning.

  
Backlog Status
Ready
 Work items that have been reviewed, refined, and are ready to be committed to a sprint. These items have clear requirements and can be worked on immediately when capacity is available.

  
chore
Work that needs to be done but doesn't add new functionality or fix bugs. Maintenance tasks that keep the system running smoothly and the codebase clean.

  
documentation
Work focused on creating, updating, or improving documentation for users, developers, or system administrators.

  
points
01
 A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  
points
02
 This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  
points
03
 Medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  
points
05
 A significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  
points
08
 Complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  
points
13
 Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint and should be broken down.

  
Priority
High
 This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  
Priority
Low
 This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  
Priority
Medium
 This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  
Sprint Status
Blocked
 Work items that cannot progress due to external dependencies, blockers, or issues that need resolution.

  
Sprint Status
Done
 Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  
Sprint Status
In Progress
 Work items currently being worked on by a team member. Active development, research, or implementation is happening.

  
Sprint Status
Review
 Work items that are complete but need review, testing, or approval before being marked as done.

  
Sprint Status
To Do
 Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  
Technical Debt
Work that addresses shortcuts, workarounds, or suboptimal implementations that were done previously to meet deadlines. These items improve code quality, maintainability, or performance without adding new features.

  
Work Item
Bug
 Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  
Work Item
Epic
 Large initiatives that are broken down into multiple smaller work items (user stories, tasks, bugs). Epics represent significant features or projects that span multiple sprints.

  
Work Item
Spike
 Time-boxed research, investigation, or proof-of-concept work to reduce uncertainty or explore solutions. Spikes help inform future development decisions.

  
Work Item
Task
 Used to break down larger user stories into smaller, manageable implementation pieces. They focus on the specific technical steps needed to deliver the user story's value.

  
Work Item
User Story
 User-facing features or functionality that can be framed from a user perspective, describing what someone wants to accomplish and why.

No labels
announcement
anubis
authentication
aws
backlog
blocked
bodhi
ci
cloud
communishift
copr
database
day-to-day
dc-move
deprecated
dev
discourse
dns
downloads
easyfix
epel
firmitas
forgejo_migration
Gain
High
Gain
Low
Gain
Medium
gitlab
greenwave
hardware
help wanted
high-trouble
koji
koschei
lists
low-trouble
medium-trouble
mirrorlists
monitoring
Needs investigation
odcs
OpenShift
ops
outage
packager_workflow_blocker
pagure
permissions
Priority
Needs Review
Priority
Next Meeting
Priority
🔥 URGENT 🔥
Priority
Waiting on Assignee
Priority
Waiting on External
Priority
Waiting on Reporter
rabbitmq
release-monitoring
releng
request-for-resources
s390x
security
SMTP
sprint-0
sprint-1
src.fp.o
staging
unfreeze
waiverdb
websites-general
wiki
Backlog Status
Needs Review
Backlog Status
Ready
chore
documentation
points
01
points
02
points
03
points
05
points
08
points
13
Priority
High
Priority
Low
Priority
Medium
Sprint Status
Blocked
Sprint Status
Done
Sprint Status
In Progress
Sprint Status
Review
Sprint Status
To Do
Technical Debt
Work Item
Bug
Work Item
Epic
Work Item
Spike
Work Item
Task
Work Item
User Story
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Sprint ( 2026-08-24 to 2026-09-06)
Assignees
Clear assignees
No assignees
kevin
6 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
infra/tickets#13539
No description provided.