Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

2
votes
0answers
109 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
0answers
235 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
2
votes
0answers
421 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
2
votes
0answers
457 views

Autofs always uses uid 0 when mounting

We have some Ubuntu clients here which shall mount kerberos protected NFS homes. The server works nicely with the existing clients, so we can assume that ldap and kerberos are ok. We managed to ...
1
vote
0answers
33 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
1
vote
0answers
18 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
1
vote
0answers
39 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
1
vote
0answers
26 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
1
vote
0answers
135 views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
1
vote
0answers
57 views

Integrating Kerberos authentication on Apache with a Git server

First time asking a question here so I hope I'm in the right place to do so. I've also searched for similar problems on here, but couldn't find anything quite as similar. Here's my problem. We ...
1
vote
0answers
68 views

heimdal error Decrypt integrity check failed for checksum type

when I try to authentication with heimdal-kdc ,I get this error in kdc log : (enctype aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type hmac-sha1-96-aes256, key type ...
1
vote
0answers
1k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
1
vote
0answers
88 views

Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation. Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum. Upon ...
1
vote
0answers
127 views

Problems with kvno + Consultation with kerberos authentication settings

I have clearly identified a problem that I can not solve. I suspect I'm missing something when setting the service running on Centos 6 on Windows Server 2003. First I tell the environment that I'm ...
1
vote
0answers
139 views

Server not found in Kerberos database while getting credentials for imap

When running kvno imap/prueba-mail.ejemplo.org@EJEMPLO.ORG get the following error: kvno: Server not found in Kerberos database while getting credentials for imap/prueba-mail.ejemplo.org@EJEMPLO.ORG ...
1
vote
0answers
72 views

Kerberos Single Sign On

I am trying to implement Single Sign On using kerberos with ssh. I changed the below files and restarted the ssh daemon. /etc/ssh_config GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ...
1
vote
0answers
65 views

Kerberos with AuthnProviderAlias

I was configuring some AuthnProviderAliases today and I want to add kerberos to it. The problem is that when I added kerberos apache wouldn't restart and I got the following error in my syslog: ...
1
vote
0answers
54 views

Kerberized SSH Failed

I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost. debug3: Wrote 80 bytes for a total of 1125 ...
1
vote
0answers
192 views

IIS7, Kerberos, sometimes no response from browser to 401

SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
1
vote
0answers
332 views

CUPS Negotiate authentication woes

I have been struggling to Kerberize certain services within our domain, one of which is CUPS. The setup is as follows: a central print server connects to each individual printer around the domain and ...
1
vote
0answers
151 views

Mixing Redmine and custom authentication method in a single apache virtualhost for Redmine

I developed on Redmine a plugin to automatically log users using the REMOTE_USER given by Apache when its Kerberos ticket is accepted. This plugin works as long as the user has a corporate login, but ...
1
vote
0answers
95 views

Winbind info shows local users that do not exist

I am setting up Samba on a Linux machine running CentOS 6 (called localhost, and the AD computer I am connecting to is dc.companyname.com), and I have done everything successfully, except when I type ...
1
vote
0answers
116 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
1
vote
0answers
460 views

heimdal kerberos in openldap issue

I think I posted this on the wrong 'sister site', so here it is. I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in ...
1
vote
0answers
411 views

Firefox proxy authentication with Kerberos: one service ticket per connection (Linux)

I am trying to enable proxy authentication via Kerberos for Firefox. The setup is: Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets ...
1
vote
0answers
231 views

LSA Cache Entries - NTLM versus Negotiate Windows Authentication Providers

We have a situation, due to a recent employee name change, where the HttpContext.Current.User.Identity.Name property of an ASP.NET web application resolves to the old username. This has been ...
1
vote
0answers
172 views

Problems mounting kerberos protected NFS share from a client machine

I have a client Linux (Fedora 16) PC that I want to use to access a NFS share. Running the command mount -v -t nfs4 -o sec=krb5 server.company.com:/home/share/username /media/nfs results in ...
1
vote
0answers
200 views

Making a kerberos keytab in Windows

I am writing a pGina plugin to get AFS Tokens and a Kerberos TGT from our kdcs at login, while writing I noticed a 'feature' of kinit being that it wont let you provide any input unless its from the ...
1
vote
0answers
208 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
1
vote
0answers
264 views

Unable to access SQL Server 2008 - Cannot Generate SSPI Context

I've had this problem for a few weeks but haven't had time to focus on it until now. My company has a relatively fresh installation of Windows Server 2011, which is also running Microsoft SQL Server ...
1
vote
0answers
234 views

Setting up single sign-on between Mac client & OS X Server

I'm not "single sign-on" is the right terminology for what I'm trying to accomplish, so please correct me if I'm wrong. We have a Mac OS X Server and Mac clients. Kerberos and Open Directory are ...
1
vote
0answers
379 views

Kerberos high availability failover, Apache Mod_auth_kerb, Using the Kerberos slave is slow

We host our own Redmine rails web application internally with Apache using Mod_auth_kerb and our internal Kerberos for authentication. We have 2 internal Kerberos servers KDC1 and KDC2. KDC1 is ...
1
vote
0answers
277 views

NFSv4 ACLS vs NFSv3 KRB5 - problems - alternatives?

So NFSv4 acls don't ignore the umask as far as I can tell. And nfsv3 with kerberos has its own host of problems (with autofs - race conditions with pam). So if we want to use an nfs like system with ...
1
vote
0answers
178 views

Kerberos Service Principal not found in AD

I've got a strange problem with an Active Directory SPN Account. This does not work: kinit HTTP/my.host.com@MY.REALM However, "setspn -l SA_MyUser" lists "HTTP/my.host.com" as registered service ...
1
vote
0answers
812 views

802.1x authentication against an Active Directory with a trusted Kerberos realm

I am attempting to use Windows Server 2008 NPS to provide 802.1x authentication against our Cisco switches. The set-up works fine for local domain users, I am now attempting to integrate it with an ...
1
vote
0answers
548 views

Kerberos Issue on Aliased SharePoint Web Front Ends

I am having a problem with Kerberos working on SharePoint. Also note that I am a developer not a network guy so if I use the wrong terms I apologize but I hope my intent is clear. We have two web ...
0
votes
0answers
14 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
0
votes
0answers
7 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
0
votes
0answers
12 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
0answers
28 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
0
votes
0answers
19 views

Cannot authenticate as diradmin - OS X Server 10.6 Workgroup Manager

As far as I can tell, not an uncommon problem: when I try to authenticate as 'diradmin' in Workgroup Manager for /LDAPv3/127.0.0.1 it fails with a login problem: "The login information is not valid ...
0
votes
0answers
10 views

How to find a service making schannel / Kerberos requests?

A few of my 2008 R2 servers is attempting to make and failing a Kerberos request once per minute. This corresponds to two events in the security log, both 4625. Logon Process: Schannel ...
0
votes
0answers
64 views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
0
votes
0answers
77 views

Mysterious kinit-failure on Debian Jessie

I have a machine with the Samba 4 AD and the second as a client. After two days of good operation, suddenly the kinit stopped working on the client-side. The reason is quite mysterious. It cannot ...
0
votes
0answers
68 views

GSSAPI Error: Server not found in Kerberos database

I'm unable to make working a simple configuration written in Samba Wiki. NSLCD worked fine, when authentized by name and password. But I have no idea, what can I do wrong when following that simple ...
0
votes
0answers
57 views

browse samba shares and login with ssh at the same time[Active Directory]

hello, i have a problem with krb5 and samba. when samba is running(i can browse shares with domain account) i can not login with ssh. And when samba is NOT running i can login with ssh with domain ...
0
votes
0answers
21 views

AFS client error message “tokens have expired”

I see the following syslog entries about once or twice a day on one of my servers. This server backs up files to AFS space using a Kerberos service principal: Dec 6 04:01:06 myserver kernel: ...
0
votes
0answers
21 views

Get Service_key in the course of kerberos authentication

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client ...
0
votes
0answers
30 views

Import accounts from Kerberos/OpenLDAP to linux

I have a configuration of our own Kerberos server and OpenLDAP server that manages user accounts. I want to get rid of Kerberos and LDAP altogether and import a list of users as well as their shadow ...
0
votes
0answers
31 views

Do servers only uses SPNs that match its hostname from its keytab for Kerberos?

If a server's keytab file includes SPNs that do not match the server's hostname, these SPNs are not used when clients try to verify their tickets. Is this a Kerberos limitation by design? Here's what ...