help with OTP

[Ken Hornstein]

>Making progress... but still need some pointers.
>[...]

Remember when I said setting up PKINIT is about as much fun as getting a
punch in the face from John Cena?  Well, you're about to discover what
I mean by that.

First, there's about 500x ways for PKINIT to go wrong, and when it does
go wrong 99% of the time you fall back to a password so it's hard to
figure out exactly what failed.  I work with a large PKINIT deployment
that uses smartcards on the client side, so I feel I can speak with
some authority here.  But, some pointers to get you going.

- You can use the KRB5_TRACE environment variable (on both the client
  and server) to figure out if PKINIT was even attempted.  Do something
  like:

  env KRB5_TRACE=/dev/stdout kinit [... kinit arguments ...]

  That should at least tell you if PKINIT is attempted and if it is
  being attempted why it failed (but it will produce a lot so it requires
  some experience to determine the useful bit you need).

- If you are generating the KDC certificate yourself and you do all of
  the right magic (as specified in the MIT documentation) to put the
  realm in the certificate you should not need this:

>> YOURREALM = {
>>   pkinit_kdc_hostname = yourkdc.fqdn
>> }

- Did you put the right stuff to trust the KDC certificate on the client?
  I did not see that.  The PKINIT documentation does mention that you
  need a pkinit_anchors entry on the client (at a minimum, you may need
  others).

--Ken