I've set up an SPN on my Windows Server 2008 SP1 active directory. When I attempt to kinit using that SPN, I get a "not found in Kerberos database" error:
kinit service/host@DOMAIN.COM
Password for service/host@DOMAIN.COM:
Exception: krb_error 6 Client not found in Kerberos database (6) Client not found in Kerberos database
KrbException: Client not found in Kerberos database (6)
at sun.security.krb5.KrbAsRep.<init>(Unknown Source)
at sun.security.krb5.KrbAsReq.getReply(Unknown Source)
at sun.security.krb5.KrbAsReq.getReply(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.sendASRequest(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.<init>(Unknown Source)
at sun.security.krb5.internal.tools.Kinit.main(Unknown Source)
Caused by: KrbException: Identifier doesn't match expected value (906)
at sun.security.krb5.internal.KDCRep.init(Unknown Source)
at sun.security.krb5.internal.ASRep.init(Unknown Source)
at sun.security.krb5.internal.ASRep.<init>(Unknown Source)
... 6 more
I have attempted to set the SPN using both the setspn and ktpass commands. I've verified that the SPN is in fact set and not duplicated using setspn. I've tried mapping the SPN to both user and computer accounts with the same results. Example below:
setspn -l DOMAIN.COM\computer$
Registered ServicePrincipalNames for CN=computer,CN=Computers,DC=domain,DC=com:
service/host
setspn -q imap/netce.com
CN=computer,CN=Computers,DC=domain,DC=com
service/host
Existing SPN found!
setspn -x
Processing entry 0
found 0 group of duplicate SPNs.
I've also verified that the Kerberos client is working at all by running kinit with a known user account, which does work. I get similar results attempting to kinit from a Linux client.
I've heard rumors that Server 2008 SP1 doesn't work correctly with regard to Kerberos and SPNs and that there is a hotfix, but haven't found any confirming details.
What could be wrong here?
