Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

4
votes
2answers
216 views

Do Linux servers using AD/Kerberos for authentication/authorization need computer accounts?

I am confused about whether Linux servers using Active Directory (AD) and Kerberos need computer accounts created? Does the Linux server as a machine need to join and AD domain and in doing so have a ...
0
votes
0answers
29 views

SSO for hybrid browser and API authentication

My organization is testing a SAML2 environment made up of a Shibboleth Service Provider and a SimpleSamlPHP Identity Provider. The idP obtains auth information from a custom REST API (no LDAP or AD). ...
0
votes
1answer
161 views

Kerberos 5 won't install on Debian 8.2 or 8.3

I've been running some VMs in VirtualBox and cannot get Kerberos5 installed. I keep receiving the error: Reading package lists... Done Building dependency tree Reading state information... Done Some ...
0
votes
3answers
1k views

apache using mod_auth_kerb always asks for the password twice

(Debian Squeeze) I'm trying to set apache up to use Kerberos authentication to allow AD users to log in. It is working, but prompts the user twice for a username and password, with the first time ...
1
vote
0answers
47 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
0
votes
0answers
33 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
1
vote
1answer
167 views

Clients can't update dNSHostName attribute after DNS suffix change

We have a bunch of Windows 7 and Windows Vista clients that belong to domain contoso.com. The clients are registered in DNS to client.contoso.com. We have changed the DNS suffix via GPO from client....
3
votes
1answer
5k views

Troubles with sssd and Active Directory Integration

I have Debian Squeeze and sssd installed. When I try to login to server by user 'alexwinner' by ssh I see in the log: (Fri May 11 18:56:03 2012) [[sssd[krb5_child[26281]]]] [get_and_save_tgt] (1): ...
1
vote
0answers
34 views

Apache External access

I am wondering if anyone can help me. I am trying to setup SSO. I have it working inside a domain, where the kerberos ticket is passed and they sign on works and the user is able to login correctly. ...
0
votes
0answers
34 views

Apache Kerberos auth prompts user for password

I am trying to setup single-sign on against our Active Directory server for my Apache using the mod_auth_kerb module. I have the following configuration in Apache: AuthType Kerberos AuthName ...
2
votes
4answers
3k views

Kerberos Authentication for workstations not on domain

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
1
vote
2answers
6k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
0
votes
1answer
280 views

sudo and Kerberos on AWS Linux issues

We have an issue on some of our AWS machines, running Amazon's hacked Fedora/RHEL linux where newer-in-AD users can login with password but cannot autheticate for sudo. Users that were created in AD ...
0
votes
0answers
25 views

What is GNOME doing at login that the console doesn't?

I have a series of lab machines running CentOS 7.2, authenticating via Kerberos and getting user data from NIS, then with home directories on NFS. When logging in, very often, the user puts in their ...
1
vote
1answer
60 views

Determine usage of UPN for logon inside MS AD forest / domain

maybe somebody can give me a hint on this. I am evaluating the prerequisites for changing all (human) user's UPN in a large Microsoft AD environment to the recommended MS format (aligned with the ...
21
votes
2answers
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
2
votes
3answers
6k views

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
0
votes
1answer
124 views

psql: duplicate GSS authentication request

What does it mean by saying 'duplicate' ? How to troubleshoot this? guest@www:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user/admin@SOHONET Valid starting Expires ...
-1
votes
1answer
24 views

keytab file between Windows 2003 server Windows 2008 R2 [closed]

My organization currently is migrating Windows 2003 server domain controllers to Windows 2008. The process may finish in next half year or so. Meanwhile we also want our Oracle database (on AIX 7.1) ...
0
votes
0answers
38 views

kerberos authentication to linux from windows

We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos ...
0
votes
2answers
243 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
2
votes
0answers
233 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
3answers
9k views

Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation

I'm attempting to join a Ubuntu 12.04 server to Active Directory. I installed samba, and kb5-user, created a machine account in AD, and did: > net ads testjoin Join is OK So far so good. Then I ...
1
vote
2answers
1k views

kinit succeeded but ads_sasl_spnego_krb5_bind failed: SASL bind in progress

I'm trying to use fedora and samba as a file server. Using kerberos i'm trying to make sure no passwords are transmitted over my network. I'm able to use samba for its file server capabilities, ...
0
votes
1answer
752 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
3
votes
3answers
205 views

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
1
vote
1answer
116 views

Is LDAP used by Active Directory for anything if I only use Kerberos for authentication?

In my windows only domain, Kerberos is used for all authentication. The domain controllers I understand replicate & authenticate using RPC. Is LDAP used for anything else? Should I close the ...
6
votes
1answer
174 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
1
vote
1answer
2k views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
2
votes
1answer
86 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
0
votes
0answers
48 views

Kerberos encryption unsupported type 23

I have to set up a automated file transfer from an application server to Hadoop fs using curl and Kerberos, I created the Kerberos keytab in the server hosting Hadoop successfully and the encryption ...
2
votes
2answers
2k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
0
votes
2answers
376 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
0
votes
1answer
35 views

Grant Kerberos Ticket on successfull authentication against third party password store

I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do ...
1
vote
0answers
45 views

Alot of Events “Kerberos authentication Ticket (TGT) was rejected”

Currently we are seeing a lot of Events "Kerberos authentication Ticket (TGT) was rejected" even for the accounts that are blocked. Also from the event logs, I see a username being used which does ...
1
vote
2answers
85 views

Issue authenticating to AD-joined Centos 7 server

Using this link, I have set up a server that is properly joined to an Active Directory server, but for some reason I can not authenticate to that server with a kerberos ticket on several test-users ...
0
votes
2answers
456 views

Get Kerberos ticket with SSH

I'd like to get a Kerberos 5 ticket when ssh-ing to get to a fully-automated login solution. Typically, you use kinit first and then ssh: > kinit user@DOMAIN user@DOMAIN's Password: (enter ...
1
vote
1answer
252 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
4
votes
5answers
11k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
0
votes
1answer
156 views

Single Sign On with multiple Identity Providers from PHP web app

I'm building a SAAS web app in PHP that needs to integrate SSO. We'll have multiple client organizations, each that have their own Identity Provider (Active Directory). While researching possibilities,...
1
vote
0answers
103 views

Websphere Application Server and Kerberos Keytab Renewal

I am currently running into an issue with Kerberos ticket expiration from a keytab on WAS 8.5.5.5. The same process works correctly on Tomcat 8, and I believe the primary difference is the JDK / JAAS ...
3
votes
1answer
83 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem though,...
0
votes
1answer
44 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
5
votes
2answers
4k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
1
vote
0answers
28 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
0
votes
0answers
31 views

Standalone VM on CentOS KDC Kerberos 5 Server autentication error

After installed and configured the kerberos 5 server on a CentOS 6.7 virtual machine. I tried to authenticate my principal admin and got this error below, I don't understand why the error as it looks ...
0
votes
1answer
183 views

Switch to Kerberos Authentication with Apache2 on Ubuntu (LDAP or AD)

I'm considering to switch my intranet apps to Kerberos authentication.(currently NTLM but modules required are not maintained anymore and will in not work anymore once the web server is updated to ...
0
votes
3answers
78 views

Squid kerberos authentication no popup

I configured squid to use kerberos authentication but when I'm trying to use proxy with browser i don't get popup in browser with ask for user and password - just access denied cos of no ...
0
votes
1answer
46 views

Windows AD single DC (degraded) - cannot modify Administrator limit exceeded

I had 2 DC's in my domain. one of them died, and the last one has all roles, dcdiag netdiag show all checked as "good" - but i actually can't modify my "Administrator" account. according to alot, ...
0
votes
1answer
418 views

Clustered instance - kerberos double hop woes

We've recently migrated our virtualised SQL databases to a bare metal solution in an active/active cluster. Everything is working great except SQL Reports. Ok, so a rundown of our setup here as it ...