[24801] in Kerberos
Re: failed to authenticate using mod_auth_kerb for Apache
daemon@ATHENA.MIT.EDU (Siarhei Baidun)
Thu Oct 6 12:27:43 2005
Message-ID: <a665a890510060925q54438f19w7eac005f42996618@mail.gmail.com>
Date: Thu, 6 Oct 2005 18:25:46 +0200
From: Siarhei Baidun <siarheibaidun@gmail.com>
To: Achim Grolms <kerberosml@grolmsnet.de>,
Nikola Milutinovic <Nikola.Milutinovic@ev.co.yu>,
Markus Moeller <huaraz@moeller.plus.com>
In-Reply-To: <a665a890510050839w7084fef7w26e32d10c7b1b652@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: inline
cc: modauthkerb-help@lists.sourceforge.net
cc: kerberos@mit.edu
Reply-To: Siarhei Baidun <siarheibaidun@gmail.com>
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello Everybody,
Just little question.
Do I need to have the principal
HOST/gvepl100.test.epo@TEST.EPO for my web server machine or it is enough
to have only
HTTP/gvepl100.test.epo@TEST.EPO one?
Because this issue is not desribed in the manual (
http://www.grolmsnet.de/kerbtut/).
I`m constantly having the error : "configuration error: couldn't check
access. No groups file?: /"
And I just think that this error means that modauthkerb does not try to
authorize a user with KDC as userdatabase on the web server (in my case it
is gvepl100.test.epo). And it tries to find some file as userdatabase. And
reason might be that I do not have principal
HOST/gvepl100.test.epo@TEST.EPO for my web server, but only this one:
HTTP/gvepl100.test.epo@TEST.EPO.
Is it right suggestion?
--
Thanks,
Siarhei Baidun
On 10/5/05, Siarhei Baidun <siarheibaidun@gmail.com> wrote:
>
> Hi again Everybody,
> Second week I have been batling with the problem...
> A lot of problems a have already solved on the way thanks to your advises.
> Now I have done everything in compliance with the manual (
> http://www.grolmsnet.de/kerbtut/)
> I have created a fresh domain account in the test domain (because I
> cannot use production one) , have mapped principal to it, etc.
> And I'm getting now the error (in the Apache's error_log file) :
> --------------------- Apache's LOG
> in case
> KrbMethodK5Passwd on
> KrbMethodNegotiate off
> ------------------------
>
> [Wed Oct 05 17:20:07 2005] [debug] src/mod_auth_kerb.c(1322): [client
> 10.3.103.154 <http://10.3.103.154/>] kerb_authenticate_user entered with
> user (NULL) and auth_type Kerberos
> [Wed Oct 05 17:20:12 2005] [debug] src/mod_auth_kerb.c(1322): [client
> 10.3.103.154 <http://10.3.103.154/>] kerb_authenticate_user entered with
> user (NULL) and auth_type Kerberos
> [Wed Oct 05 17:20:12 2005] [debug] src/mod_auth_kerb.c(879): [client
> 10.3.103.154 <http://10.3.103.154/>] kerb_authenticate_user_krb5pwd ret=0
> user=TEST@TEST.EPO authtype=Basic
> [Wed Oct 05 17:20:12 2005] [crit] [client 10.3.103.154<http://10.3.103.154/>]
> configuration error: couldn't check access. No groups file?: /
> --------------------- Apache's LOG
> in case
> KrbMethodK5Passwd off
> KrbMethodNegotiate on
> ------------------------
>
> [Wed Oct 05 17:33:12 2005] [debug] src/mod_auth_kerb.c(1322): [client
> 10.3.103.194 <http://10.3.103.194/>] kerb_authenticate_user entered with
> user (NULL) and auth_type Kerberos
> [Wed Oct 05 17:33:12 2005] [debug] src/mod_auth_kerb.c(1322): [client
> 10.3.103.194 <http://10.3.103.194/>] kerb_authenticate_user entered with
> user (NULL) and auth_type Kerberos
> [Wed Oct 05 17:33:12 2005] [debug] src/mod_auth_kerb.c(1023): [client
> 10.3.103.194 <http://10.3.103.194/>] Acquiring creds for
> HTTP/gvepl100.test.epo@TEST.EPO
> [Wed Oct 05 17:33:12 2005] [debug] src/mod_auth_kerb.c(1152): [client
> 10.3.103.194 <http://10.3.103.194/>] Verifying client data using SPNEGO
> GSS-API
> [Wed Oct 05 17:33:12 2005] [debug] src/mod_auth_kerb.c(1168): [client
> 10.3.103.194 <http://10.3.103.194/>] Verification returned code 0
> [Wed Oct 05 17:33:12 2005] [debug] src/mod_auth_kerb.c(1186): [client
> 10.3.103.194 <http://10.3.103.194/>] GSS-API token of length 0 bytes will
> be sent back
> [Wed Oct 05 17:33:12 2005] [crit] [client 10.3.103.194<http://10.3.103.194/>]
> configuration error: couldn't check access. No groups file?: /
>
> What does it mean? Which groups file I do not have?
> I'm very, very appreciated for any help!
> Below are my httpd.conf and krb5.conf
> --
> Thank you very much in advance,
> Siarhei Baidun
> ------------------
> krb5.conf
> -----------------
>
> [libdefaults]
> default_realm = TEST.EPO
>
> [domain_realm]
> gvepl100.test.epo = TEST.EPO
>
> [realms]
> TEST.EPO = {
> admin_server = odessa.test.epo
> kdc = odessa.test.epo
> }
>
> ----------------------------Apache's httpd.conf----------------------------------
>
> AuthType Kerberos
> AuthName "Kerberos Login"
> Krb5KeyTab /etc/wolfi2.keytab
>
> KrbAuthRealms TEST.EPO
>
> KrbMethodK5Passwd on
> KrbMethodNegotiate off
> KrbServiceName HTTP
> require valid-user
>
>
> ------------------ result of "ktutil -k /etc/wolfi3.keytab list" command
> ------------------------------
>
> Vno Type Principal
> 1 des-cbc-md5 HTTP/gvepl100.test.epo@TEST.EPO
>
>
>
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
