Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to test a Kerberos-based SSO solution for our Java app. Unfortunately, I don't have a Windows domain at my disposal to do so. I read about the ability to integrate Windows with a standalone, non-Microsoft Kerberos KDC: I set up a Kerberos server on Ubuntu and integrated a Windows XP box with it using the ksetup.exe utility. I'm now able to log into the Kerberos realm on these PCs.

However, when I connect to our web app, IE doesn't offer to send a Kerberos ticket to the server...only NTLM.

I've configured the site to be in the Intranet zone and performed the other steps outlined here: I've also set the 'delegate' flag on the realm using ksetup /SetRealmFlags <realm> delegate...I'm not sure if this is relevant, but have seen some indication that it might be.

Is it possible to make IE send Kerberos tickets if it's not part of a Windows domain, but merely part of a Kerberos realm?

share|improve this question
It's not clear from your question that the server/app is requesting GSSAPI negotiate auth. Is it? – 84104 Jan 10 '12 at 16:31
Yes, the app is requesting 'Negotiate' auth. It turns out I was wrong about Windows 7: it is offering to use Kerberos, but has NTLM as its preferred provider. I believe XP still isn't offering Kerberos. – Aron Jan 10 '12 at 23:15

Is the name that you are connecting to have an A record in DNS? Using a CNAME will not work unless you implement a registry setting on the client, which would not be a viable solution for most.

share|improve this answer
Hi Greg - I'm setting up a test environment at home with a dinky little home router, so no DNS being used. I'm using IP addresses instead of host names. – Aron Jan 12 '12 at 1:05
I'm not saying that will not work, however in my Windows-only experience with Kerberos, IE and windows services in general are obsessively picky with the name used to connect to. I would at least use a name, and try putting it in the hosts file on the machine where you are running IE. – Greg Askew Jan 12 '12 at 11:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.