Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

(Debian Squeeze)

I'm trying to set apache up to use Kerberos authentication to allow AD users to log in. It is working, but prompts the user twice for a username and password, with the first time being ignored (no matter what is put it in.) Only the second prompt includes the AuthName string from the config (i.e.: the first windows is a generic username/password one, the second includes the title "Kerberos Login") I'm not worried about integrated windows authentication working at this stage, I just want users to be able to login with their AD account so we don't need to set up a second repository of user accounts.

How do I fix this to eliminate that first useless prompt?

The directives in the apache2.conf file:

<Directory /var/www/kerberos>
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd On
Krb5KeyTab /etc/krb5.keytab
KrbServiceName HTTP/
require valid-user


    default_realm = ONEVUE.COM.AU.LOCAL
        master_kdc = SYD01PWDC01.ONEVUE.COM.AU.LOCAL
        admin_server = SYD01PWDC01.ONEVUE.COM.AU.LOCAL
        default_domain = ONEVUE.COM.AU.LOCAL
    krb4_convert = true
    krb4_get_tickets = false

The access log when accessing the secured directory (note the two seperate 401's) - - [24/Aug/2012:15:52:01 +1000] "GET /kerberos/ HTTP/1.1" 401 710 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" - - [24/Aug/2012:15:52:06 +1000] "GET /kerberos/ HTTP/1.1" 401 680 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1" - myaccount.lastname@MYDOMAIN.LOCAL [24/Aug/2012:15:52:10 +1000] "GET /kerberos/ HTTP/1.1" 200 375 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1"

And one line in error.log

[Fri Aug 24 15:52:06 2012] [error] [client] gss_accept_sec_context(2) failed: An unsupported mechanism was requested (, Unknown error)
share|improve this question

2 Answers 2

That's because the first time the user enters u/p an ntlm token is sent to the server. The second time it's the correct kerberos token.

Unfortunately there is no way you can eliminate the first prompt.

share|improve this answer

If single sign on is not a requirement you can disable negotiate by setting 'KrbMethodNegotiate off'. This will give you just a single basic login and also avoid the extra GET request for each transaction.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.