Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've followed this guide to get Apache Single-Sign-On to work, but so far all I get is strange kerberos errors.

This is my current configuration

[root@server httpd]# uname -a
Linux server 2.6.18-274.3.1.el5xen #1 SMP Tue Sep 6 20:57:11 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

[root@server httpd]# httpd -v
Server version: Apache/2.2.3
Server built:   Oct 20 2011 17:00:12

[root@server httpd]# ls -al http.ktb
-rw------- 1 apache apache 144 Dec  6 08:56 http.ktb

[root@server httpd]# /opt/likewise/bin/klist -k http.ktb

Keytab name: WRFILE:http.ktb
KVNO Principal


5 HTTP/server@company.local

And these are the errors I keep getting, and I haven't found a proper list explaining the error messages either so I'm in the dark here.

[Tue Dec 06 08:58:07 2011] [error] [client] failed to verify krb5 credentials: Unknown code krb5 147

Anyone have a clue? I've reread the guide multiple times.

Best Regards Lars

share|improve this question
I just tried with Internet Explorer and somehow that works, but I do need to enter the credentials but then I get logged on, very strange. – Lars Dec 6 '11 at 9:37

I managed to sort this out with help from Beyond Trust's help, here's how:

share|improve this answer
We don't like answers which are simply links off-site. If you copied the relevant information into your answer and go in to some detail about what you did it would be much more beneficial to future visitors. – Ben Pilbrow Dec 12 '11 at 12:47
up vote 0 down vote accepted

I'm very sorry, I'll fix it. To make things clearer for future visitors, this is what I did:

I recreated the keytabs file with capital letters on the COMPANY.LOCAL part using the same command as stated in the guide before

(ktpass /out keytabfile /princ HTTP/ /pass SkiAlta2008 /mapuser likewisedemo\httpUser /ptype KRB5_NT_PRINCIPAL)

I later changed the KrbAuthRealms statement in /etc/httpd/conf/httpd.conf to also have capital letters and voilá.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.