Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

1
vote
0answers
106 views

Setting up SPN for SSRS in a CRM load balance environment

I'm getting this exception randomly in a CRM load balance LIVE environment when running Reports from CRM. System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner ...
2
votes
0answers
79 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
66 views

How to support Kerberos authentication on internal websites through Citrix Access Gateway

When I remote in through a citrix access gateway (using netscaler) I am unable to use kerberos tickets for authentication with apache. The browser only sends an NTLMSSP negotiate header and gives up. ...
1
vote
1answer
56 views

Can I use user-based kerberos authenication with NFSv4?

Is it possible to set NFSv4 + Kerberos to do user-based authentication? As far as I understand you are required to create a principal for a client machine(i.e. it is still Host-based?) on Kerberos ...
4
votes
2answers
477 views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
1
vote
0answers
36 views

pwauth kerberos authentication specifying default and secondary servers

I am currently using Kerberos authentication for Basic Authentication on Apache using pwauth and mod_auth_external. I would like to add multiple servers to authenticate from, however they would have ...
0
votes
1answer
360 views

MacOS X 10.9 Mavericks Kerberos login w/ FreeIPA

Has anyone successfully set up authentication and authorization between MacOS X and FreeIPA? An old revision of the FreeIPA documentation explains how to get it working in 10.4 and nothing in their ...
1
vote
1answer
2k views

Apache kerberos authentication to Active Directory not happening. (Is KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN related?)

My goal is to have Apache authenticate authenticate against AD, without prompting for a username and password, using Kerberos. It currently always shows "401 Unauthorized", and appears to be not ...
1
vote
2answers
4k views

Unable to setup Kerberos on Ubuntu 14.04 - krb5kdc: No such file or directory - while initializing database for realm myrealm

I'm attempting to follow the guide on the Ubuntu wiki for installing and setting up Kerberos. I am running Ubuntu 14.04 (LTS) 64-bit. I have setup avahi-daemon in order to provide .local DNS names. I ...
1
vote
2answers
2k views

How do I use ldapsearch with a cross-realm ticket?

kinit user@DOMAIN.TLD klist -afe Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user@DOMAIN.TLD Valid starting Expires Service principal 08/04/11 13:14:53 08/05/11 ...
1
vote
0answers
111 views

GSSAPITrustDns option missing from OpenSSH-6.7

I need to use the GSSAPITrustDns option to connect to a round robin service using Kerberos authentication. This works correctly using OpenSSH 5.3 and 6.6.1p1 on a selection of machines. I have an Arch ...
0
votes
1answer
367 views

libnss-ldap getent passwd - AD replies correctly but output shows local /etc/passwd

I am trying to configure libnss-ldap to provide AD authentication to my Linux Debian servers. This is working fine if user exists locally, I want to make it work for Domain users. Here is my ...
22
votes
5answers
17k views

Why use Kerberos instead of NTLM in IIS?

This is something that I've never really been able to answer as well as I like: What is the real advantage of using Kerberos authentication in IIS instead of NTLM? I've seen a lot of people really ...
0
votes
0answers
31 views

How can I utilise resource based delegation

Windows 2012 comes with an extension to the existing Kerberos Constrained Delegation, called resource based delegation (RBCD). There are a number of great articles that explain how it works for ...
1
vote
1answer
7k views

keytab auth against samba 4 DC: Client not found in Kerberos database while getting initial credentials

I set up a samba 4 active directory on ubuntu 14.04 following Samba AD DC HOWTO. In principle everything works well but I'm stuck in getting kerberos authentication running using SPNs for web ...
1
vote
0answers
37 views

Apache auth_kerb_module on Windows

I need to install the Kerberos module in Apache on Windows. I have copied the file auth_kerb_mod.so to apache/modules/ and I have modified the conf/httpd.conf with LoadModule auth_kerb_module ...
1
vote
0answers
182 views

Postfix + Saslauthd + Kerberos 5 + CentOS 7 not working

I've almost got saslauthd checking against Kerberos but seeing some last issues on CentOS 7. When postfix talks to saslauthd, it sends a lowercased domain and it's not corrected. I tried to fix things ...
4
votes
2answers
167 views

Joining a NetApp to a domain on a Read Only Domain Controller

I have an isolated network, into which I've built a vfiler. The point of this network is that it's a non routed 'test' network. However, there's a need for LDAP/Kerberos and CIFS access to the ...
0
votes
0answers
38 views

Do kerberos constrained delegation with protocol transition on IIS to another IIS need my own application for very simple redirect

Please excuse me if its a very basic question but i'm totally lost on this as Im new to IIS and kerberos delegation but have understanding of auth protocols. Need you peoples help please as i have ...
0
votes
0answers
108 views

Samba4 Workgroup showing in My computer Properties

I suppose my question is stupid but want to clear it. Installed Samba4, joined machine but in My Computer properties the WORKGROUP is shown in lowercase letters. Whats is the reason to don't show in ...
10
votes
2answers
4k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
4
votes
3answers
5k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
0
votes
1answer
1k views

AD + Postfix + Dovecot problems with query_filter

I set up a mail server AD + Postfix + Dovecot + Kerberos This works fine for only one domain In the attribute mail=test@test.com, in otherMailbox=vasya@otherdoamin.com,petya@another.net Config ...
3
votes
2answers
2k views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. ...
1
vote
4answers
2k views

How to ensure machine is “Kerberos Domain” joined?

i've been having issues where calls to the LogonUser Windows API function is falling back to NTLM authentication, rather than using the preferred, default, Kerberos authentication. Researching the ...
0
votes
2answers
1k views

IIS / kerberos not prompting for credentials from Mac clients

I have an IIS server (Server 2008R2/IIS 7.5) configured for kerberos authentication. The kerberos authentication works from clients on Windows (IE and Opera both tested), but when I access the site ...
0
votes
0answers
30 views

Windows Interoperable Kerberos V5 Realm tcp KDC

I have a Windows 7 client that cannot reach a mit-krb5 KDC due to a firewall beyond my control. More specifically the client can reach the KDC, but the KDC's udp response does not make it back to the ...
2
votes
1answer
241 views

Kerberos-PAM authentication failure: pam or pre-authentication

kinit -p 'username' works -- no problem with the setup of the Kerberos realm. I can't get the login from the GUI to work, however. Client auth.log: pam_krb5(gdm3:auth): user <username> ...
0
votes
0answers
48 views

SSH from Windows to Linux with certificates generated by a central PKI stored in AD

I would like to have a central PKI where certificates are issued for all sorts of services and devices as well as users. I would like to push these certificates to one or more active directories. (so ...
0
votes
0answers
87 views

Apache+subversion Kerberos Authorization Active Directory

I have configured Apache+Subversion with Kerberos. Here's my config: SSLRequireSSL DAV svn SVNPATH /var/www/svn/testrepo AuthType Kerberos Krb5KeyTab /etc/krb5.keytab KrbAuthRelams ...
-1
votes
1answer
108 views

Lightweight webserver with SSPI authentification [closed]

I'm looking for a fast, lightweight web server (for example nginx or lighttpd) which supports authentication to a Microsoft Kerberos authentication server (SSPI). This webserver must run under Windows ...
0
votes
0answers
114 views

How can I use LDAP and Kerberos for web auth only, not server auth

I have read this question on proper kerberos integration and this question on enterprise authentication, neither are helpful to me at this point in time though they did provide some good background. ...
0
votes
0answers
18 views

Enabling constrained delegation on DC computer account

Is it necessary to have constrained delegation enabled on Microsoft AD domain controller computer account? If yes then why and what are consequences of disabling it? I'm mainly interested in current ...
1
vote
0answers
473 views

Kerberos Configuration Manager for SQL Server error “unable to access user principal information from the system”

When I launch the Kerberos Configuration Manager for SQL Server and try to connect to the local machine it's on, I am getting the error "Kerberos Configuration Manager for SQL Server error "unable to ...
0
votes
1answer
72 views

389 Directory Server - Multiple Domains

I have multiple business that i would like to authenticate to a single server for SSO. I am using 389 directory server and have already split each domain into it's own respective OU. I would like to ...
1
vote
0answers
434 views

IIS7, Kerberos, sometimes no response from browser to 401

SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
0
votes
0answers
36 views

IIS 6.0 reverting to NTLM authorization

This is related to my other question here. We have a .net 2.0 app hosted in IIS 6 on two different servers (the second server was setup to troubleshoot this issue) these servers are on two different ...
2
votes
1answer
246 views

Kerberos token size error

I am having issues with a .net 2.0 web app hosted on a windows 2003 server authenticating with a java app (on linux I think). The java server is expecting Kerberos authentication and currently fails ...
1
vote
0answers
44 views

kerberos apache 401 error for domain admins using office addin

I use SSO for access to a Linux based system from our windows 7 PC's. This works for IE using the logon credentials to access the system. However, when the developed office plugin is used by any ...
3
votes
0answers
170 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
0
votes
0answers
61 views

Avoid client keytab with Kerberized NFSv4

I would like to setup a Kerberized NFSv4 server such that clients do not need a keytab to mount a volume (but such that users get their privileges according to their Kerberos ticket as usual). Is it ...
1
vote
1answer
250 views

Apache - Replace Apache::AuthenNTLM with Kerberos (mod_auth_kerb)

Within an intranet system on Solaris we currently use perls Apache2::AuthenNTLM module to authenticate with a Win 2k3 doman server, so we can access the user ID of the person browsing the site. ...
0
votes
1answer
41 views

Kerberos in production on virtual machines

At the moment I am investigating the possibility to use Kerberos as the primary authentication protocol for our cloud structure. We'll probably follow through with this idea and for the sake of HA the ...
0
votes
2answers
898 views

Can't add my Red Hat 7 machine to our company's Active Directory

I'm trying to join my RHEL 7 VM machine to our company's AD. I can validate my login credentials just fine with kinit (No return if I enter the correct password, error if I enter the wrong one), ...
0
votes
1answer
172 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
1
vote
2answers
498 views

Kerberos ktutil, what kinds of encryption are available?

I am attempting to make a keytab using ktutil. I get to choose the encryption type, but the ktutil man page does not offer a list of possible choices. I also don't know which encryption method is the ...
4
votes
1answer
124 views

Does Active Directory's Kerberos implementation support per-user ticket lifetime settings?

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) ...
0
votes
2answers
394 views

How to clear kerberos config

I am setting my machine as a kerberos client. I have a question on how the kerberos config file actually take effect and how to clear its effect. My experiment is as follow. Step 1, without editing ...
0
votes
0answers
140 views

Browser (SPNEGO) kerberos authentication on Windows Phone 8 IE

Is there a way to make Internet Explorer on Windows Phone 8 authenticate to a site using Windows Integrated Security Authentication with Kerberos through the Negotiate (SPNEGO) protocol? It seems to ...
1
vote
1answer
161 views

BCP/xp_cmdshell access denied - but only when running procedure from outside the server

I've been attempting to run some of my team's database deployment code to a SQL 2014 server on a Windows 7 test box. Part of this code is a procedure that pulls in data from a file using BCP from a ...