Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've have squid configured with auth in the AD via winbind

now I have wired problems with authorisation

I found in the logs interesting string

 kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot find KDC for requested realm 

does anybody know how to fix this?

share|improve this question

Most problems related to Kerberos authentication come down to DNS problems. It looks like your Squid machine isn't able to resolve the name of the KDC. Can you verify that you're able to resolve the name of the Active Directory domain controllers via their SRV records? (You can specify the KDC(s) in the /etc/krb5.conf file, but you really should be letting DNS do its job.)

Assuming DNS is working right, double-check the spelling of your Active Directoy domain name in your winbind configuration. The domain's name should be capitalized.

share|improve this answer
thanks,I'll do this Could this be caused by missing Kerberos ticket ? klist shows error (and nothing) – user48990 Aug 4 '10 at 19:52
It's missing the ticket due to the error in the configuration. fix the error, and rerun kinit, and all should be well with the world – Steve Butler Jul 1 '12 at 8:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.