Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server.

In order for Kerberos to work correctly, I've created a service account in Active Directory called dummy.

I've generated a keytab for the Linux web server using ktpass.exe on the Windows AD server using this command:

ktpass /out C:\krb5.keytab /princ HTTP/ /mapuser dummy@REALM.EXAMPLE.COM /crypto RC4-HMAC-NT /ptype KRB5_NT_PRINCIPAL /pass xxxxxxxxx

I can successfully get a ticket from the Linux web server using this command:

kinit -k -t /path/to/keytab HTTP/

... and view the ticket with klist.

I have also configured my web server with these Kerberos properties:

<Directory />
    AuthType                Kerberos
    AuthName                " Kerberos domain"
    KrbMethodK5Passwd       Off
    KrbAuthRealms           EXAMPLE.COM
    KrbServiceName          HTTP/
    Krb5KeyTab              /path/to/keytab
    Require                 valid-user
            Order deny,allow
            Allow from all

However, when I attempt to log in to the website (from another Desktop with username 'Jeff') my Kerberos credentials are not automatically accepted by the web server. It should grant me access immediately after that, but it does not. The only information I get from the mod_auth_kerb logs is:

kerb_authenticate_user entered with user (NULL) and auth_type Kerberos

However, more information is revealed when I change the mod_auth_kerb setting KrbMethodK5Passwd to On:

[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1939): [client] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1031): [client] Using HTTP/ as server principal for password verification
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(735): [client] Trying to get TGT for user jeff@REALM.EXAMPLE.COM
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(645): [client] Trying to verify authenticity of KDC using principal HTTP/
[Fri Oct 18 17:26:44 2013] [debug] src/mod_auth_kerb.c(1110): [client] kerb_authenticate_user_krb5pwd ret=0 user=jeff@REALM.EXAMPLE.COM authtype=Basic

What am I missing? I've studied a lot of online tutorials and cannot find a reason why the Kerberos credentials are not allowing access.

share|improve this question
up vote 2 down vote accepted

After digging through a lot more log information I was able to discover that the client machine was not responding properly to the server's ticket. The way you can tell something is wrong on the client machine is that you will see the Apache server's error message "failed to verify krb5 credentials: Server not found in Kerberos database". In the /etc/krb5.conf file on the client machine you have to make sure the web domain name maps to the proper Kerberos realm:


Without this the client will reject the server because Kerberos tickets may only come from explicitly permitted realms.

I hope this information helps others out there!

share|improve this answer
[domain_realm] mapping can/should also be done via dns e.g. IN TXT "EXAMPLE.COM". – 84104 Aug 14 '14 at 21:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.