Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If a server's keytab file includes SPNs that do not match the server's hostname, these SPNs are not used when clients try to verify their tickets. Is this a Kerberos limitation by design?

Here's what I've done: I have a Linux HTTP server running, with the hostname testbox1. I've joined it to the testAD.com domain via Samba, and things run great when my clients have the ticket for testbox1 (so they have a ticket for HTTP/testbox1.testAD.com@TESTAD.COM).

I've now added a new SPN to testbox1, HTTP/testing.testAD.com. I generated the keytab file, moved it over to the Linux server, and appended the keytab to the existing one.

Clients are able to get the ticket "HTTP/testing.testAD.com@TESTAD.COM", but my Linux server rejects it. Upon looking at Samba's code, I found that the server will only use the SPNs from its keytab file that match a certain regex (composed of its hostname, domain, realm).

I can make the necessary code changes in the Kerberos module of my samba library to allow a new regex which does not include the hostname of the server, but would this essentially 'break' Kerberos?

My initial thought: No, because merely TRYING to decrypt a ticket based on an existing SPN is completely ok. If the ticket is indeed for a different service, the decryption will fail all the same.

Any information would be greatly appreciated.

share|improve this question
    
To my knowledge samba doesn't do http. It is primarily used for smb/cifs. This is really an interaction between your webserver and whichever Kerberos libraries it links to, probably Apache auth_mod_kerb to linked to MIT, but it would be good if we didn't have to guess. Also, the configuration directives from your webserver matter, as does whether the clients are getting the tickets via HTTP SPNEGO, or if you're issuing something like kvno. –  84104 Oct 19 '13 at 2:17
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.