Regarding kerberos authentication that failed after upgrade to AM 5.1, after upgrade there is a change which kerberos encryption types are accepted by AM

Our keytab is created with etypes 1, 3, 17, 18 and 23 (encryption types are defined here: https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-1), but when loaded by AM I can see following:

Looking for keys for: HTTP/idp.nam.example@NAM.EXAMPLE
Found unsupported keytype (3) for HTTP/idp.nam.example@NAM.EXAMPLE
Found unsupported keytype (1) for HTTP/idp.nam.example@NAM.EXAMPLE
Found unsupported keytype (23) for HTTP/idp.nam.example@NAM.EXAMPLE
Added key: 17version: 1
Added key: 18version: 1
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17.

Our KDC (Domain Services for Windows) is for some reason issuing kerberos tickets with encryption type 23 and since AM does not support that etype, tickets cannot be decrypted.

I need to troubleshoot DSfW kerberos issue (some tickets are issued with aes256-cts-hmac-sha1-96 - type 18 and some with rc4-hmac - type 23) and fix that there, but if somebody else faces this problem, you can temporary enable deprecated encryption types on AM by adding allow_weak_crypto = true to [libdefaults] section in /etc/krb5.conf of each IDP server and restarting novell-idp service.

I hope this workaround saves some time for somebody else facing similar issue.

Kind regards,

Sebastijan

PS: How to find out encryption type of kerberos ticket? Run klist command on client and check "KerbTicket Encryption Type" line for AM ticket:

#1>     Client: sebastijan @ NAM.EXAMPLE
        Server: HTTP/idp.nam.example @ NAM.EXAMPLE
        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
        Ticket Flags 0x40a90000 -> forwardable renewable pre_authent name_canonicalize 0x80000
        Start Time: 5/22/2024 10:48:30 (local)
        End Time:   5/22/2024 20:25:32 (local)
        Renew Time: 5/29/2024 10:25:32 (local)
        Session Key Type: RSADSI RC4-HMAC(NT)
        Cache Flags: 0
        Kdc Called: dsfw.nam.example

Thank you for posting your findings.  Will monitor forums before we move forward with patching.  I'd rather click next next next finish and be done, but I know that is too much to ask.  Maybe look for the next patch and hope it isn't a year.