I am configuring Kerberos authentication for Alfresco CIFS protocol fully implemented in Java (JLAN project). That is not the first time, I used to set it up right in a single shot.
In the same network, with an ActiveDirectory Windows 2008R2 and the same procedure, I have already done successfully the setup for two environments but the production environment give me troubles.
The production keytab was generated by
ktpass on ActiveDirectory with RC4-HMAC like for other environments. The account
AlfrescoCifsP is dedicated for production and for this only service:
ktpass -princ cifs/myserver.mydomain.com@MYDOMAIN.COM -mapuser MYDOMAIN\AlfrescoCifsP -pass <password> -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL -out c:\temp\prod.keytab
Now I try to use it on RedHat 5.8 with MIT Kerberos libraries and utilities in version 1.6.1-70-el4 and I got the following error:
$ kinit -k -t prod.keytab cifs/myserver.mydomain.com kinit(v5): Key table entry not found while getting initial credentials
Here are what I have checked (many times):
krb5.confis OK with default realm set
- I can open
ktutiland list the slot for
- I can authenticate with password and command
kvno cifs/myserver.mydomain.comreturns the same key number than from the keytab entry
- I also deleted the ActiveDirectory account and does the stuff again. Still the same result.
So everything has been done to succeed. It was successfully for two service accounts and failed for the third one. The only difference may be the SPN length which is a bit longer than for others but far less than the SPN limit of 260 characters.
I have straced the
kinit -k -t prod.keytab cifs/... command and I just saw the read operation on keytab file and just behind the output of the error message to stderr.
Is there any known issue matching my trouble in a similar environment ?
How to diagnose the source cause of this issue ?
What may be the main reasons for such a failure ?
What should I try in the hope to find a way out ?