0
votes
2answers
50 views

Can't add my Red Hat 7 machine to our company's Active Directory

I'm trying to join my RHEL 7 VM machine to our company's AD. I can validate my login credentials just fine with kinit (No return if I enter the correct password, error if I enter the wrong one), ...
4
votes
1answer
32 views

Does Active Directory's Kerberos implementation support per-user ticket lifetime settings?

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) ...
0
votes
0answers
73 views

squid authentication error kerberos - windows active directory

I use squid on RHEL6 and I want that authentication is via AD windows 2008, I already joined the server to the windows domain and all users is already seen by wbinfo -u wbinfo -g but wbmin -t show ...
1
vote
1answer
65 views

Why don't Active Directory user accounts automatically support Kerberos AES authentication?

I'm playing around with a test domain on Windows Server 2012 R2. I'm operating at the highest possible functional level and have no backwards-compatibility issues in my small test environment. ...
0
votes
0answers
46 views

Kerberos and SSH login

I've just configured a RHEL 7 for windows authentication (idmap_ad). Every check works but if i try to ssh with a domain user i get the error: Connection closed by ::1 Here follows the ssh log in ...
1
vote
1answer
33 views

Is the Kerberos SPN FQDN significant to the server, or is the keytab enough?

I spend most of my time as a developer, so I'm not familiar with all the details... I have a service running on a linux host. I want to use Kerberos to transmit identity information to the service. ...
2
votes
1answer
127 views

MSSQLSvc Service Principal Names, Kerberos, and NTLM

Was recently helping a DBA with an issue that appeared to be related to an invalid SPN. Discovered that a good number of SQL service accounts simply don't have an SPN set, resulting in NTLM ...
3
votes
2answers
253 views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. ...
2
votes
1answer
227 views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
4
votes
1answer
874 views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
4
votes
1answer
243 views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
1
vote
1answer
51 views

Have Kerberos use AD groups instead of netgroups

Currently we are able to have kerberos authenticate users who are in active directory (AD) and added to ldap created netgroups. We also set their unix attributes and add them to the netgroup. IT ...
0
votes
1answer
72 views

LAMP server kerberos config to authenticate against a read only Windows KDC in a dmz

Background: We have a number of AD networks (domains) that are connected through VPNs and have established AD trust relationships. We have an externally hosted web server and have configured ...
0
votes
1answer
145 views

cannot login to domain - kerberos issue?

We cannot login as domain admin on one server but can on others. When I looked at Active Directory, I can see that the computer object doesn't exist for the server we can't login to. There is, however ...
1
vote
0answers
83 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
1
vote
0answers
374 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
2
votes
2answers
82 views

Integrated Windows Authentication not working on PC bound to AD network

Background: Web server running LAMP stack Web server has VPN tunnel to AD network at HQ Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network Kerberos ...
9
votes
2answers
500 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
1
vote
1answer
90 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
0
votes
2answers
2k views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
1
vote
0answers
60 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
3
votes
2answers
2k views

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still ...
0
votes
0answers
74 views

browse samba shares and login with ssh at the same time[Active Directory]

hello, i have a problem with krb5 and samba. when samba is running(i can browse shares with domain account) i can not login with ssh. And when samba is NOT running i can login with ssh with domain ...
0
votes
1answer
437 views

Problems mounting Kerberos authenticated NFS share on CentOS 6.4

I'm trying to mount a Kerberos authenticated NFS share on a CentOS 6.4 machine. I have tried exporting the protected share from both another CentOS 6.4 machine and from our NetApp with the same ...
0
votes
1answer
46 views

To identify which application uses kerberos authentication

i need to identify which application / process requesting kerberos authentication. Eg I have an PC for login i am using windows AD account. In that pc there are several applicationslike outlook, ...
1
vote
2answers
5k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
1
vote
2answers
204 views

How does Cron interact with Kerberos for authentication?

I have a CentOS 6.4 machine which is set up with pam_ldap and pam_krb5. It is configured to use our Active Directory servers for authentication. I can SSH into the machine using AD accounts. I have ...
0
votes
1answer
155 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
2
votes
2answers
63 views

Adding new SPNs to existing service ids

We have a tomcat server using spring-security kerberos to authenticate users to the webpage against active directory. There are around 25 domain controllers. The site has two CNAME based DNS ...
2
votes
2answers
1k views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
0
votes
1answer
242 views

Kerberos & signle-sign-on for website

I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server. In order for Kerberos to ...
0
votes
0answers
278 views

HTTP proxy authentication Kerberos fallback on Windows

We run a Samba4 domain with Linux and Windows clients joined to it. Both the Windows and Linux machines use a Squid proxy that uses both Kerberos and Basic authentication, and for the most part it ...
3
votes
3answers
447 views

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new ...
0
votes
1answer
100 views

Unable to disable Kerberos Single Sign On (SSO)

I've been exploring Kerberos Single Sign On (SSO) to replace NTLM for a Web Application hosted internally within a Windows Domain. After creating Service Principal Names (SPN) for a test service ...
7
votes
3answers
423 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
3
votes
1answer
3k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
1
vote
0answers
186 views

Problems with kvno + Consultation with kerberos authentication settings

I have clearly identified a problem that I can not solve. I suspect I'm missing something when setting the service running on Centos 6 on Windows Server 2003. First I tell the environment that I'm ...
0
votes
0answers
134 views

Splitting labs into subdomains without breaking Kerberos and Active Directory

So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux ...
0
votes
2answers
629 views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
2
votes
1answer
129 views

Duplicate SPNs causing NTLM fallback

I have duplicate SPNs which are threatening to downgrade the authentication from Kerberos to NTLM showing in the event viewer. How can I safely remove the duplicate SPN's for a SQL account? I have ...
1
vote
0answers
532 views

Server not found in Kerberos database while getting credentials for imap

When running kvno imap/prueba-mail.ejemplo.org@EJEMPLO.ORG get the following error: kvno: Server not found in Kerberos database while getting credentials for imap/prueba-mail.ejemplo.org@EJEMPLO.ORG ...
2
votes
1answer
101 views

replace Lock screen with Switch Account screen

User successfully logs in as user@EXAMPLE.COM . User is then mapped to user@ad.example.com via altSecurityIdentities: Kerberos:user@EXAMPLE.COM When the user locks the screen, the lock screen is ...
0
votes
1answer
405 views

House roaming profiles on realm trusted samba server?

Raison D'être I am attempting, so far unsuccessfully, to house roaming profiles for an Active Directory domain on a realm trusted Ubuntu 12.04LTS ZFS-on-Linux file server. The end goal is to have an ...
1
vote
1answer
84 views

Conditional authentication based on group membership in AD

I need to authenticate AD users logging into their workstations only if they belong to the security group AT THE MOMENT OF AUTHENTICATION. They're being added to this privileged group right before ...
3
votes
1answer
119 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
1
vote
1answer
733 views

Active Directory Kerberos issue KDC_ERR_S_PRINCIPAL_UNKNOWN

We are implementing a system where our clients are Windows XP and our server is Windows Server 2008 R2. Ours clients use DCOM to connect COM+ components in our Windows 2008 Server. It works fine when ...
2
votes
1answer
763 views

Active Directory: Thunderbird LDAP autocompletion not working with Kerberos auth

The Problem: I'm trying to configure an LDAP mail autocompletion - a built-in functionality of Mozilla Thunderbird 17.0.5 @ Windows 7 x64 in 2008R2 domain environment. The OS is a fresh, ...
2
votes
3answers
439 views

Unified Authentication between Windows AD and Linux LDAP Server

Does anyone know of a solution that would allow me to do user account synchronization between Windows Active Directory and an LDAP Server hosted on a Linux Server? I'm currently looking at FreeIPA ...
1
vote
0answers
105 views

Winbind info shows local users that do not exist

I am setting up Samba on a Linux machine running CentOS 6 (called localhost, and the AD computer I am connecting to is dc.companyname.com), and I have done everything successfully, except when I type ...
0
votes
3answers
429 views

Kerberos Authentication for workstations not on domain

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...