[28193] in Kerberos
Re: Error while authenticating using mod_auth_kerb module
daemon@ATHENA.MIT.EDU (Markus Moeller)
Sat Aug 4 09:45:11 2007
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Sat, 4 Aug 2007 14:35:46 +0100
Message-ID: <46b480b9$0$1593$ed2619ec@ptn-nntp-reader02.plus.net>
X-Complaints-To: abuse@plus.net
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Andrew,
a couple of questions.
1) Is your client IE or Firefox on Windows XP ?
2) Are you only using AD as kdc ?
3) Can you see on your XP desktop the service ticket with kerbtray ?
4) Can you capture port 88 traffic form your XP desktop with wireshark
(after a fresh login to your desktop) ?
5) Do you use aliases for your server ?
6) Is the reverse DNS lookup OK ?
The error you see indicates the XP desktop does not find a kerberos service
ticket and sends therefore a NTLM token.
Markus
"Andrew Ortlieb" <Aortlieb@fimed.com> wrote in message
news:mailman.15.1186175009.14853.kerberos@mit.edu...
I have been facing this same issue for over a week. It's been entirely
frustrating.
While watching network traffic I'm seeing that mod_auth_kerb isn't even
attempting to communicate with the domain controller while attempting to
negotiate.
Here is my error.log:
[Fri Aug 03 14:43:06 2007] [debug] src/mod_auth_kerb.c(1485): [client
192.168.5.171] kerb_authenticate_user entered with user (NULL) and
auth_type Kerberos
[Fri Aug 03 14:43:06 2007] [debug] src/mod_auth_kerb.c(1172): [client
192.168.5.171] Acquiring creds for HTTP/site-intra.site.local@SITE.LOCAL
[Fri Aug 03 14:43:06 2007] [debug] src/mod_auth_kerb.c(1316): [client
192.168.5.171] Verifying client data using KRB5 GSS-API
[Fri Aug 03 14:43:06 2007] [debug] src/mod_auth_kerb.c(1332): [client
192.168.5.171] Verification returned code 589824
[Fri Aug 03 14:43:06 2007] [debug] src/mod_auth_kerb.c(1359): [client
192.168.5.171] Warning: received token seems to be NTLM, which isn't
supported by the Kerberos module. Check your IE configuration.
I have verified the communication with kinit and kvno, and confirmed
that the keytab kvno numbers match.
Any pointers would be greatly appreciated.
-Andy
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
