Re: [keycloak-user] Authentication fails for OTP user with kerberos

I'm running FreeIPA and have users with and without OTP. OTP users authenticate with RADIUS (Privacyidea manages the tokens). My final goal is that users with a kerberos ticket can authenticate without password and users without ticket get asked for password+OTP (when configured). In FreeIPA a user is defined with password and radius authentication: $ ipa user-show jochen User login: jochen ... Kerberos principal: jochen(a)EXAMPLE.ORG ... User authentication types: password, radius According to the FreeIPA docs LDAP bind works with password only, but kerberos needs password+OTP. That works fine with sssd and other applications. I'm now running keycloak 3.4.2 and played with it. I've added a User Federation with LDAP to my FreeIPA server and enabled "Allow Kerberos Authentication". After that I can log in with my Kerberos ticket without further authentication. If I don't have a Kerberos ticket keycloak asks me for username and password - authentication works with LDAP bind as long as "Use Kerberos For Password Authentication" is disabled. For a regular (non-OTP) user I can authenticate with a Kerberos ticket. If the user does not have a Kerberos ticket, he is asked for username and password as expected, and authentication is successful. Another user with OTP-authentication in FreeIPA can also authenticate with his Kerberos ticket. If the OTP-user does not have a Kerberos ticket, keycloak asks for username and password (as expected). If the user federation has "Use Kerberos for Password Authentication" not selected, the user in FreeIPA needs to have password+OTP (or password+RADIUS) allowed and can authenticate against FreeIPA-LDAP with password only - that's not what I want[1]. When I enable "Use Kerberos For Password Authentication" non-OTP users can still authenticate, but OTP users can't. According to https://www.freeipa.org/page/V4/OTP#How_to_Test "Kerberos FAST is required for OTP operations." - and that's true. If I just use kinit I get "Generic preauthentication failure while getting initial credentials". The kerberos log has: Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.x: NEEDED_PREAUTH: jochen(a)EXAMPLE.ORG for krbtgt/JOCHEN.ORG(a)EXAMPLE.ORG, Additional pre-authentication required Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): preauth (encrypted_timestamp) verify failure: No matching key in entry Aug 08 21:24:17 freeipa1.jochen.org krb5kdc[4442](info): AS_REQ (4 etypes {18 17 16 23}) x.x.x.127: PREAUTH_FAILED: jochen(a)EXAMPLE.ORG for krbtgt/JOCHEN.ORG(a)EXAMPLE.ORG, Preauthentication failed debg log fom keycloak: 2017-08-08 21:24:17,473 INFO [stdout] (default task-1) Debug is true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false 2017-08-08 21:24:17,473 INFO [stdout] (default task-1) [Krb5LoginModule] user entered username: jochen(a)EXAMPLE.ORG 2017-08-08 21:24:17,473 INFO [stdout] (default task-1) 2017-08-08 21:24:17,605 INFO [stdout] (default task-1) [Krb5LoginModule] authentication failed 2017-08-08 21:24:17,605 INFO [stdout] (default task-1) Pre-authentication information was invalid (24) - PREAUTH_FAILED 2017-08-08 21:24:17,606 WARN [org.keycloak.events] (default task-1) type=LOGIN_ERROR, realmId=jochen.org, clientId=account, userId=3ebc8518-a488-4dce-bd94-4a72c03a5ed9, ipAddress=192.168.yy.xx, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=https://saml.jochen.org/auth/realms/jochen.org/account/login..., code_id=eefbcc3e-f581-465c-bc28-7e37fc939ae6, username=jochen(a)example.org That look's like there is no FAST implemented, but that or Anonymous PKINIT seems to be needed for OTP authentication through Kerberos: https://www.freeipa.org/page/V4/OTP https://www.freeipa.org/page/V4/Kerberos_PKINIT On my systems the OTP-user can't kinit directly, but needs to "kinit -n" first: $ kinit otpuser kinit: Pre-authentication failed: invalid argument while getting initial credentials $ kinit -n $ klist Ticket cache: KEYRING:persistent:1004:1004 Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Valid starting Expires Service principal 04.11.2017 18:31:20 05.11.2017 18:31:20 krbtgt/EXAMPLE.ORG(a)EXAMPLE.ORG $ kinit -T KEYRING:persistent:1004:1004 otpuser Enter OTP Token Value: $ klist Ticket cache: KEYRING:persistent:1004:krb_ccache_ZKhNrfE Default principal: otpuser(a)EXAMPLE.ORG Valid starting Expires Service principal 04.11.2017 18:31:48 05.11.2017 18:31:37 krbtgt/EXAMPLE.ORG(a)EXAMPLE.ORG After some research I think that JDK doesn't implement FAST for now and the tickets/messages I found looked like it will be some time until that might be implemented (if ever). Would it be possible to implement that in keycloak? https://blog-ftweedal.rhcloud.com/2014/07/otp-authentication-in-freeipa/ has some python code that is implementing that for FreeIPA. I've looked at https://github.com/keycloak/keycloak/blob/master/federation/kerberos/src/... but don't see how that might be implemented there... I've already tried to add two providers to my user federation, LDAP and sssd. sssd can authentication my otpuser with password+OTP fine. But I couldn't get authentication with Kerberos ticket to work when I have both providers active. Is that something that should work? Any ideas? Thanks, Jochen [1] password allows authentication to LDAP (no OTP). RADIUS or OTP authentications against Kerberos, which handles OTP and RADIUS and needs password+OTP.