I'm trying to set up a keytab for a Java server to support Kerberos authentication on a Windows network. I'm struggling to get it working even at the level of the command line tools, haven't even got as far as the server setup yet! My plan just now is to try and get it working on my development PC as I have development work and debugging to do. So my goal is to have the Java server running on my PC, and the client running on the same machine connecting to it.
Here's what I've done so far, I'm really blundering my way through so I could be doing all kinds of wrong stuff!
Created a service principal name
I got one of our domain administrators to run this command:
setspn -A TEST/pc-name.mydomain.com my-user-name
This appeared to complete successfully and I can list this SPN successfully with
setspn -L my-user-name
Created a keytab file
I created a keytab with this command:
ktpass /princ TEST/pc-name.mydomain.com@MYDOMAIN.COM /pass <my-password> /ptype KRB5_NT_SRV_HST /out <keytab-filename>
This appears to create a keytab successfully, although it does warn that ptype and account type do not match (but whatever I choose for ptype, I get the same warning). If I run this command:
klist -k file:/<keytab-filename>
Then it lists the SPN I'd expect, namely TEST/pc-name.mydomain.com@MYDOMAIN.COM
Now I want to check that the keytab works for this SPN, so I'm running
kinit -t <keytab-filename> TEST/pc-name.mydomain.com@MYDOMAIN.COM
I then get an error "krb_error 6 Client not found in Kerberos database".
What am I doing wrong?