Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

2
votes
1answer
1k views

Why is MS SQL Server Using NTLM Authentication?

Windows Server 2008 R2. SQL Server 2008 R2 installed. MSSQL Service runs as Local System. Server FQDN is SQL01.domain.com. SQL01 is joined to an Active Directory domain named domain.com. The ...
6
votes
3answers
459 views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ...
2
votes
0answers
386 views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
0
votes
1answer
136 views

LAMP server kerberos config to authenticate against a read only Windows KDC in a dmz

Background: We have a number of AD networks (domains) that are connected through VPNs and have established AD trust relationships. We have an externally hosted web server and have configured ...
0
votes
2answers
1k views

Completely uninstall Kerberos on Ubuntu Server

I am experimenting with Kerberos and messed up the installation. I've tried editing the config files but have had no joy in resolving my problems which currently consist of not being able to ...
0
votes
1answer
544 views

cannot login to domain - kerberos issue?

We cannot login as domain admin on one server but can on others. When I looked at Active Directory, I can see that the computer object doesn't exist for the server we can't login to. There is, however ...
1
vote
0answers
146 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
1
vote
0answers
84 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
7
votes
1answer
128 views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
2
votes
0answers
34 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
1
vote
1answer
498 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
0
votes
0answers
95 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
1
vote
0answers
969 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
2
votes
2answers
104 views

Integrated Windows Authentication not working on PC bound to AD network

Background: Web server running LAMP stack Web server has VPN tunnel to AD network at HQ Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network Kerberos ...
0
votes
0answers
17 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
2answers
2k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
2answers
1k views

IIS / kerberos not prompting for credentials from Mac clients

I have an IIS server (Server 2008R2/IIS 7.5) configured for kerberos authentication. The kerberos authentication works from clients on Windows (IE and Opera both tested), but when I access the site ...
0
votes
1answer
244 views

IIS Credential Delegation for AppPool in Integrated Pipeline mode

I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution. Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel ...
9
votes
2answers
739 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
0
votes
2answers
58 views

Configure MSSQL 2008 to use kerberos authentication

I would like to set my current mssql db (2008 and 2012) to authenticate using a linux kerberos server that I have in my environment . The windows station is in a workgroup and I would like to avoid ...
0
votes
0answers
359 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
1
vote
1answer
91 views

Does Kerberos provide Encryption of Application Session data?

I understand kerberos provides authentication using encryption. I see it exchanges session keys. Are those session keys used for applications send their data over that network encryption after ...
1
vote
1answer
163 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
0
votes
0answers
193 views

Cannot authenticate as diradmin - OS X Server 10.6 Workgroup Manager

As far as I can tell, not an uncommon problem: when I try to authenticate as 'diradmin' in Workgroup Manager for /LDAPv3/127.0.0.1 it fails with a login problem: "The login information is not valid ...
1
vote
1answer
246 views

What does squid proxy do when negating acl proxy_auth_regex in rule?

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the ...
2
votes
2answers
224 views

Apache 2.2.14 / mod_auth_kerb 5.4 : Custom krb5.conf for Apache Instance

Objective: Use Apache/mod_auth_kerb using a custom krb5.conf file, not system standard /etc/krb5.conf. Issue: I've got a strongly regimented environment where we application owners are able to ...
0
votes
1answer
1k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
0answers
498 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
0
votes
2answers
6k views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
2
votes
1answer
63 views

How does a Kerberos Client determine the Service Name portion of an SPN?

If I deploy a server call FOO/host.example.com@myrealm how does a client become aware that the service name is FOO? ENV: Unix / MIT kerberos 1.4 or 1.10 I see windows has some sort of mapping: How ...
0
votes
1answer
302 views

Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb

I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module? The relevant sections of my ...
4
votes
1answer
701 views

How can I force sudo to accept a user's AD password on RHEL6

In our environment we do not join Linux boxes to the Microsoft Domain. We do however setup Kerberos. This allows us to log into the boxes using our AD credentials as long as there is a local account ...
1
vote
0answers
98 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
2
votes
0answers
959 views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
2
votes
1answer
94 views

OpenLDAP+Kerberos authentication – id (NSS) works, but authentication says user is unknown

I have a central authentication server with OpenLDAP set up and populated, and Kerberos 5, also populated. On an Ubuntu LTS machine, I set up nslcd and kerberos client stuff. This way, issuing the ...
0
votes
1answer
311 views

setting kerberos ktpass ktab all that JAAS

I have a couple of questions on Kerberos on Windows. I want to find out what the purpose of mapping a user to a service using ktpass is. For example I am on windows and I run ktpass like this: ...
4
votes
2answers
4k views

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still ...
1
vote
2answers
2k views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
1
vote
1answer
42 views

Is it possible to set up cross realm Kerberos

We have a setup with an IIS and a SQL server and have implemented Kerberos to use SQL Sercurity directly. We have a AD forest: Internal.local and the setup works fine there. Now the customer wants ...
1
vote
0answers
209 views

Integrating Kerberos authentication on Apache with a Git server

First time asking a question here so I hope I'm in the right place to do so. I've also searched for similar problems on here, but couldn't find anything quite as similar. Here's my problem. We ...
0
votes
0answers
701 views

Mysterious kinit-failure on Debian Jessie

I have a machine with the Samba 4 AD and the second as a client. After two days of good operation, suddenly the kinit stopped working on the client-side. The reason is quite mysterious. It cannot ...
0
votes
2answers
336 views

kadmin interface not working - immediately closes connection

So far I've been doing most of the administration for kerberos with kadmin.local, however, I'm trying to migrate over to using the remote kadmin as it would be better practice and all. What I'm ...
0
votes
1answer
61 views

Mail client with support for gssapi

I have configured Postfix and Cyrus Imap to enable SSO using Kerberos and GSSAPI. I use Thunderbird as a mail client which supports GSSAPI but I wanted to try some other client also. I tried ...
2
votes
0answers
287 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
1
vote
1answer
654 views

Kerberos on IIS 7.5, unknown error - how to troubleshoot

I have a asp.net site installed on a server owned by a client. The client now, due to using MobileIron for single-sign-on capabilites on mobile devices, requires my site to work with Kerberos ...
-1
votes
1answer
42 views

Setup kerberos on windows 7

I am developping a java web application application for a client which use kerberos spnego to authenticate its user. Kerberos itself is "plugged" to a LDAP They send me a documentation with what to ...
0
votes
1answer
50 views

AFS client error message “tokens have expired”

I see the following syslog entries about once or twice a day on one of my servers. This server backs up files to AFS space using a Kerberos service principal: Dec 6 04:01:06 myserver kernel: ...
1
vote
1answer
110 views

Connecting to Mac OS X VNC with Kerberos authentication [closed]

I'm running Mac OS X Server with remote administration. Apple uses VNC with (I believe) Kerberos authentication. I do NOT use a VNC password, just the user-based authentication. I need to find a VNC ...
2
votes
1answer
865 views

Problems mounting Kerberos authenticated NFS share on CentOS 6.4

I'm trying to mount a Kerberos authenticated NFS share on a CentOS 6.4 machine. I have tried exporting the protected share from both another CentOS 6.4 machine and from our NetApp with the same ...
0
votes
1answer
57 views

To identify which application uses kerberos authentication

i need to identify which application / process requesting kerberos authentication. Eg I have an PC for login i am using windows AD account. In that pc there are several applicationslike outlook, ...