help using setspn and ktpass

Question

I'm trying to set up the SPNs and create a keytab file for tomcat kerberos spnego Single sign on.

the server running tomcat7 is ubuntu-ad1.wad.eng.hytrst.com the KDC is kerberos.wad.eng.hytrust.com the domain is WAD.ENG.HYTRUST.COM im using my ad user name of aulfeldt@WAD.ENG.HYTRUST.COM the machiene's AD account is ubuntu-ad1@WAD.ENG.HYTRUST.COM

first i create the spn to associate with a user name ( would love an explanation on why I need to do this?):

setspn HTTP/ubuntu-ad.wad.eng.hytrust.com aulfeldt@WAD.ENG.HYTRUST.COM

Then I create a keytab to copy to the web server:

ktpass /out tomcat.keytab /mapuser aulfeldt@WAD.ENG.HYTRUST.COM /crypto ALL /pass * /ptype KRB5_NT_PRINCIPAL 

then i copy it to the web server and use ktutil to merge it with /etc/krb5.keytab.

when I try to test this with kinit i can't make it successfully read from the key table:

hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab http/ubuntu-ad1.wad.eng.hytrust.com@WAD.ENG.HYTRUST.COM
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab HTTP/ubuntu-ad1.wad.eng.hytrust.com@WAD.ENG.HYTRUST.COM
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab ubuntu-ad1.wad.eng.hytrust.com@WAD.ENG.HYTRUST.COM
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab ubuntu-ad1.wad.eng.hytrust.com
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab aulfeldt@WAD.ENG.HYTRUST.COM
kinit: Key table entry not found while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit -k -t /home/hytrust/tomcat.keytab ubuntu-ad1@WAD.ENG.HYTRUST.COM
kinit: Client not found in Kerberos database while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit  ubuntu-ad1@WAD.ENG.HYTRUST.COMPassword for ubuntu-ad1@WAD.ENG.HYTRUST.COM: 
kinit: Preauthentication failed while getting initial credentials
hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$ sudo  kinit  aulfeldt@WAD.ENG.HYTRUST.COM

Password for aulfeldt@WAD.ENG.HYTRUST.COM: hytrust@ubuntu-ad1:/usr/share/tomcat7/conf$

how does "Client not found in Kerberos database" differ from "Client not found in Kerberos database"? what do these errors really mean?

Answer 1

Try using "setspn -Q " in Windows to see whether the SPN has been created properly:

C:\Windows\System32>setspn -Q HTTP/util01.example.com
CN=util01,OU=Servers,DC=example,DC=com
        HTTP/util01.example.com

Existing SPN found!

Then, check the keytab file to see if it matches:

[apache@util01 ~]$ klist -e -k /etc/httpd/conf/auth_httpd.keytab 
Keytab name: FILE:/etc/httpd/conf/auth_httpd.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 HTTP/util01.example.com@EXAMPLE.COM (DES cbc mode with RSA-MD5) 

If they don't match (aside from the @EXAMPLE.COM realm bit), fix it so they do by re-exporting the keytab with ktpass.

If they do match, you should be able to get a ticket for exactly the SPN specified in the keytab (do not include the realm):

$ sudo kinit -k keytab.file HTTP/util01.example.com