Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
1answer
83 views

Apache not finding the kerberos principal in keytab file

Virtual host has been configured with these options; AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate On KrbMethodK5Passwd Off KrbAuthRealms EXAMPLE.COM KrbAuthoritative On ...
0
votes
0answers
66 views

SSO, Kerberos, multiple domains, multiple Linux servers

I have successfully implemented SSO for one production application running on Centos 6 + apache 2.2. connecting to Windows 2008 AD server. Users are coming from 2 different domains: a.com and b.net, ...
0
votes
1answer
25 views

NFSv4 with Kerberos - idmap stops working after ~35 minutes

All machines are running CentOS 6.5. We have about 85 client machines doing a Kerberized NFSv4 mount (sec=krb5p) to a server. This weekend, the server was changed (serverA changed to serverB). ...
2
votes
0answers
161 views

Forward Kerberos Authentication on Ansible

I have an ansible control machine (host-A) that need to talk with host-C, an Windows machine that doesn't have local users (It's an Active Directory). host-A doesn't have network access to host-C, ...
3
votes
0answers
43 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
0
votes
0answers
25 views

Why do i need freeradius's keytab?

I'm trying to set up 802.1x for the wifi. I'm working with freeradius an windows server 2012. I need SSO ... help :) Currently I'm not able to set up freeradius krb. 'radtest' doesn't make it trough. ...
1
vote
0answers
68 views

Does FTP service (IIS 7.5) on Windows 2008 R2 support kerberos authentication?

I have configured http service on IIS 7.5 for kerberos authentication. And it works fine. I have checked from linux box # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: alex@EXAMPLE.NET ...
1
vote
1answer
26 views

Having a Kerberos issue, and can't trace the traffic in NetMon

I'm trying to get Kerberos to work for a new Sharepoint server I'm installing. It works fine for the server name, but not the FQDN. I've done setspn for both, and I've added the domain to trusted ...
0
votes
0answers
150 views

kinit pre-authentication fails

I have a centos 6.4 that someone setup a while back. The admin is not sure how he installed it, but it works very well with Kerberos. I used authconfig to set the domain and the Kerberos settings. I ...
1
vote
3answers
541 views

CentOS7 Kerberos Auth: Improper format of Kerberos configuration file;

I'm working on setting up a Squid 4.0 explicit proxy for group based AD authentication against a Active Directory domain (Server 2012 R2) with SSL bumping on a minimal CentOS 7 (64b) install. The ...
2
votes
1answer
148 views

Integrating squid with active directory

I am trying to integrate squid as a web proxy for my users in active directory. I have followed the tutorial in the squid site in here. When i run the command : msktutil -c -b "CN=Administrator" -s ...
0
votes
0answers
107 views

Cross Domain NTLM / Kerberos Auth with Chrome on Mac OS X / Linux

I'm trying to configure Chrome on my MacBook Pro to use kerberos to authenticate to web sites so I don't get prompted to enter my username and password constantly. I've added the AuthServerWhitelist ...
4
votes
2answers
216 views

Do Linux servers using AD/Kerberos for authentication/authorization need computer accounts?

I am confused about whether Linux servers using Active Directory (AD) and Kerberos need computer accounts created? Does the Linux server as a machine need to join and AD domain and in doing so have a ...
0
votes
1answer
46 views

Error trying to enable LDAP with kerberos authentication with GPFS

I have 3 RHEL7 nodes with GPFS / Spectrum Scale 4.2.0.0 installed. The 3 nodes have been setup with GPFS as a cluster with a GPFS filesystem created. I am trying enable LDAP based authentication ...
0
votes
1answer
68 views

gssapi/kerberos/active directory/ubuntu - Wrong principal in request

I'm trying to setup a Clientserver with a Webservice to which Users of an Active Directory should be able to login with SSO. I'm using SPNEGO with Kerberos on a Ubuntu 14.04 Server and nginx proxy to ...
0
votes
0answers
29 views

SSO for hybrid browser and API authentication

My organization is testing a SAML2 environment made up of a Shibboleth Service Provider and a SimpleSamlPHP Identity Provider. The idP obtains auth information from a custom REST API (no LDAP or AD). ...
0
votes
1answer
161 views

Kerberos 5 won't install on Debian 8.2 or 8.3

I've been running some VMs in VirtualBox and cannot get Kerberos5 installed. I keep receiving the error: Reading package lists... Done Building dependency tree Reading state information... Done Some ...
0
votes
0answers
33 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
1
vote
0answers
47 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
1
vote
0answers
34 views

Apache External access

I am wondering if anyone can help me. I am trying to setup SSO. I have it working inside a domain, where the kerberos ticket is passed and they sign on works and the user is able to login correctly. ...
1
vote
1answer
167 views

Clients can't update dNSHostName attribute after DNS suffix change

We have a bunch of Windows 7 and Windows Vista clients that belong to domain contoso.com. The clients are registered in DNS to client.contoso.com. We have changed the DNS suffix via GPO from client....
0
votes
0answers
25 views

What is GNOME doing at login that the console doesn't?

I have a series of lab machines running CentOS 7.2, authenticating via Kerberos and getting user data from NIS, then with home directories on NFS. When logging in, very often, the user puts in their ...
0
votes
1answer
41 views

Multi-factor auth with Kerberos and RADIUS

I am looking for a solution in order to allow a multi-factor authentication for a Kerberos-based logon service. By reading some articles, I found some good references about RADIUS, that provides a set ...
-1
votes
1answer
24 views

keytab file between Windows 2003 server Windows 2008 R2 [closed]

My organization currently is migrating Windows 2003 server domain controllers to Windows 2008. The process may finish in next half year or so. Meanwhile we also want our Oracle database (on AIX 7.1) ...
1
vote
1answer
60 views

Determine usage of UPN for logon inside MS AD forest / domain

maybe somebody can give me a hint on this. I am evaluating the prerequisites for changing all (human) user's UPN in a large Microsoft AD environment to the recommended MS format (aligned with the ...
0
votes
0answers
38 views

kerberos authentication to linux from windows

We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos ...
0
votes
1answer
280 views

sudo and Kerberos on AWS Linux issues

We have an issue on some of our AWS machines, running Amazon's hacked Fedora/RHEL linux where newer-in-AD users can login with password but cannot autheticate for sudo. Users that were created in AD ...
2
votes
0answers
233 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
1answer
116 views

Is LDAP used by Active Directory for anything if I only use Kerberos for authentication?

In my windows only domain, Kerberos is used for all authentication. The domain controllers I understand replicate & authenticate using RPC. Is LDAP used for anything else? Should I close the ...
6
votes
1answer
174 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
210 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
2
votes
2answers
663 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...
2
votes
1answer
86 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
0
votes
0answers
48 views

Kerberos encryption unsupported type 23

I have to set up a automated file transfer from an application server to Hadoop fs using curl and Kerberos, I created the Kerberos keytab in the server hosting Hadoop successfully and the encryption ...
1
vote
0answers
45 views

Alot of Events “Kerberos authentication Ticket (TGT) was rejected”

Currently we are seeing a lot of Events "Kerberos authentication Ticket (TGT) was rejected" even for the accounts that are blocked. Also from the event logs, I see a username being used which does ...
0
votes
2answers
376 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
0
votes
1answer
35 views

Grant Kerberos Ticket on successfull authentication against third party password store

I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do ...
1
vote
1answer
252 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
0
votes
1answer
124 views

psql: duplicate GSS authentication request

What does it mean by saying 'duplicate' ? How to troubleshoot this? guest@www:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user/admin@SOHONET Valid starting Expires ...
1
vote
2answers
85 views

Issue authenticating to AD-joined Centos 7 server

Using this link, I have set up a server that is properly joined to an Active Directory server, but for some reason I can not authenticate to that server with a kerberos ticket on several test-users ...
0
votes
1answer
156 views

Single Sign On with multiple Identity Providers from PHP web app

I'm building a SAAS web app in PHP that needs to integrate SSO. We'll have multiple client organizations, each that have their own Identity Provider (Active Directory). While researching possibilities,...
1
vote
0answers
103 views

Websphere Application Server and Kerberos Keytab Renewal

I am currently running into an issue with Kerberos ticket expiration from a keytab on WAS 8.5.5.5. The same process works correctly on Tomcat 8, and I believe the primary difference is the JDK / JAAS ...
1
vote
2answers
1k views

kinit succeeded but ads_sasl_spnego_krb5_bind failed: SASL bind in progress

I'm trying to use fedora and samba as a file server. Using kerberos i'm trying to make sure no passwords are transmitted over my network. I'm able to use samba for its file server capabilities, ...
3
votes
3answers
205 views

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
3
votes
1answer
83 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem though,...
0
votes
1answer
44 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
1
vote
0answers
28 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
1
vote
3answers
1k views

Unable to join domain using samba tool net or realm/sssd

On a rhel7 server I am trying to join the server to a domain, but I am getting the following failure: net ads join -S domain.example.org -U name Enter name's password: Failed to join domain: failed ...
0
votes
0answers
31 views

Standalone VM on CentOS KDC Kerberos 5 Server autentication error

After installed and configured the kerberos 5 server on a CentOS 6.7 virtual machine. I tried to authenticate my principal admin and got this error below, I don't understand why the error as it looks ...
0
votes
1answer
183 views

Switch to Kerberos Authentication with Apache2 on Ubuntu (LDAP or AD)

I'm considering to switch my intranet apps to Kerberos authentication.(currently NTLM but modules required are not maintained anymore and will in not work anymore once the web server is updated to ...