Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a strange problem regarding Kerberos authentication with Apache mod_auth_kerb. We use a very simple krb5.conf, where only a single (main) AD server is configured. There are many domains in the forest, and it seems that SSO is working for most of them, except one.

I don't know what is special about that domain, the error message that I see in the Apache logs is "Server not found in Kerberos database":

[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(1025): [client] Using HTTP/my-server.corp.intl@DE-DOMAIN-ONE.CORP.INTL as server principal for password verification
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(714): [client] Trying to get TGT for user MYUSER@DE-DOMAIN-TWO.CORP.INTL
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(625): [client] Trying to verify authenticity of KDC using principal HTTP/my-server.corp.intl@DE-DOMAIN-ONE.INTL
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(640): [client] krb5_get_credentials() failed when verifying KDC
[Wed Aug 31 14:56:02 2011] [error] [client] failed to verify krb5 credentials: Server not found in Kerberos database
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(1110): [client] kerb_authenticate_user_krb5pwd ret=401 user=(NULL) authtype=(NULL)

When I try to kinit that user on the machine on which Apache is running, it works. I also checked that DNS lookups work, including reverse lookup.

Who can tell me whats going?

share|improve this question

migrated from Sep 1 '11 at 13:58

This question came from our site for professional and enthusiast programmers.

Could be the domain isn't in your AD forrest but just associated with NTML Trust? You would need Win2k3 Forrest Functional level to enable forrest trust than. (External Trust is only NTLM).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.