[27579] in Kerberos
Re: mod_auth_kerb credential error for principal
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Thu Mar 22 15:57:11 2007
Message-ID: <4602DF7B.6000706@anl.gov>
Date: Thu, 22 Mar 2007 14:56:43 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Edson Habowsky <EdsonH@weg.net>
In-Reply-To: <4A483AA0418A3F46861FA7B7D2630FA76824CD@brjgs104.weg.net>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
A couple of things.
AD is case insenitive, but Kerberos is not.
the principal should have lowercase host name.
fix it now before it causes more problems.
kinit requires a principal as a parameter.
kinit -k \
-t /usr/local/apache2/conf/apache.keytab \
HTTP/linuxserver.domain.com@WEG.NET
Thae account name myuser, should relate tothe
principal name, aseach principal will need an account.
(MS called it a user account, it isnot a real user, it is
forthe service.)
Edson Habowsky wrote:
> Hello,
>
> I'm facing serious problem with Kerberos ticket
>
> I'm trying authenticate Windows users to the Linux apache webserver using Kerberos authenticate method, and for apache mod_auth_kerb.
>
> Having problems with keytab.
>
>
>
> Targeting domain controller: DCserver.domain.com
>
> Successfully mapped HTTP/LinuxServer.domain.com to myuser.
>
> Type the password for HTTP/LinuxServer.domain.com:
>
> Type the password again to confirm:
>
> Key created.
>
> Output keytab to c:\temp\apache.keytab:
>
> Keytab version: 0x502
>
> keysize 56 HTTP/LinuxServer.weg.net@WEG.NET ptype 1 (KRB5_NT_PRINCIPAL) vno 23 etyp
>
> e 0x3 (DES-CBC-MD5) keylength 8 (0x2f342c51891c1c68)
>
> Account myuser has been set for DES-only encryption.
>
>
>
>> I'm trying use this keytab at the linux apache server with
>
>> mod_auth_kerb; and if put the apache.keytab that was just created at windows side, into linux side, it
>
>> doesn't work. I got the error when I run the kinit command:
>
>
>> #kinit -k -t /usr/local/apache2/conf/apache.keytab
>
>> kinit(v5): Client not found in Kerberos database while getting initial
>
>> credentials
>
>
>
> If I run kinit myuser and put my passwd, it works fine, and after run this, if I run klist it bring me the cached ticket fine.
>
> Also, if I run kutil and check kvno into the keytab, it give me the right number (same as the one created at windows site through the ktpass).
>
>
>
>
>
>> May someone help me please,
>
>> I'm stuck on this, almost one week, and don't know what else to do.
>
>
>
> Edson Habowsky
> Departamento de Sistemas de Informação
> Sc Data Center - Tecnologia
> Analista de Infra - Servidores/Storage
> Fone: 55 (47) 3276 4619 - edsonh@weg.net <mailto:edsonh@weg.net>
> WEG Equipamentos Elétricos S.A. - Corporativo
> "TRANSFORMANDO ENERGIA EM SOLUÇÕES"
>
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
