Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a strange problem regarding Kerberos authentication with Apache mod_auth_kerb. We use a very simple krb5.conf, where only a single (main) AD server is configured. There are many domains in the forest, and it seems that SSO is working for most of them, except one.

I don't know what is special about that domain, the error message that I see in the Apache logs is "Server not found in Kerberos database":

[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(1025): [client xx.xxx.xxx.xxx] Using HTTP/my-server.corp.intl@DE-DOMAIN-ONE.CORP.INTL as server principal for password verification
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(714): [client xx.xxx.xxx.xxx] Trying to get TGT for user MYUSER@DE-DOMAIN-TWO.CORP.INTL
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(625): [client xx.xxx.xxx.xxx] Trying to verify authenticity of KDC using principal HTTP/my-server.corp.intl@DE-DOMAIN-ONE.INTL
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(640): [client xx.xxx.xxx.xxx] krb5_get_credentials() failed when verifying KDC
[Wed Aug 31 14:56:02 2011] [error] [client xx.xxx.xxx.xxx] failed to verify krb5 credentials: Server not found in Kerberos database
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(1110): [client xx.xxx.xxx.xxx] kerb_authenticate_user_krb5pwd ret=401 user=(NULL) authtype=(NULL)

When I try to kinit that user on the machine on which Apache is running, it works. I also checked that DNS lookups work, including reverse lookup.

Who can tell me whats going?

share|improve this question

migrated from stackoverflow.com Sep 1 '11 at 13:58

This question came from our site for professional and enthusiast programmers.

1 Answer 1

Could be the domain isn't in your AD forrest but just associated with NTML Trust? You would need Win2k3 Forrest Functional level to enable forrest trust than. (External Trust is only NTLM).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.