Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

4
votes
0answers
241 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
4
votes
0answers
275 views

Windows Authentication to a Remote Server within an Intranet Environment

I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote ...
4
votes
0answers
403 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
2
votes
0answers
155 views

Use Kerberos ticket to access WebDAV

Using Apache's mod_dav as the server, Samba 4.1.17 as the server and any version of Windows from 7 upwards as the client how can I mount a WebDAV share using Kerberos for the authentication? ...
2
votes
0answers
179 views

CUPS remote print queues

In my network, there are multiple printers over many locations, all connected to a single CUPS server via whatever protocols they require. Client machines on the network need to print to the printers ...
2
votes
0answers
127 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
2
votes
0answers
938 views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
2
votes
0answers
55 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
2
votes
0answers
429 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
2
votes
0answers
2k views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
2
votes
0answers
491 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
0answers
3k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
2
votes
0answers
496 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
2
votes
0answers
850 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
2
votes
0answers
744 views

Autofs always uses uid 0 when mounting

We have some Ubuntu clients here which shall mount kerberos protected NFS homes. The server works nicely with the existing clients, so we can assume that ldap and kerberos are ok. We managed to ...
2
votes
0answers
365 views

NFSv4 ACLS vs NFSv3 KRB5 - problems - alternatives?

So NFSv4 acls don't ignore the umask as far as I can tell. And nfsv3 with kerberos has its own host of problems (with autofs - race conditions with pam). So if we want to use an nfs like system with ...
1
vote
0answers
13 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
1
vote
0answers
17 views

Apache External access

I am wondering if anyone can help me. I am trying to setup SSO. I have it working inside a domain, where the kerberos ticket is passed and they sign on works and the user is able to login correctly. ...
1
vote
0answers
103 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
0answers
36 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...
1
vote
0answers
21 views

Alot of Events “Kerberos authentication Ticket (TGT) was rejected”

Currently we are seeing a lot of Events "Kerberos authentication Ticket (TGT) was rejected" even for the accounts that are blocked. Also from the event logs, I see a username being used which does ...
1
vote
0answers
50 views

Websphere Application Server and Kerberos Keytab Renewal

I am currently running into an issue with Kerberos ticket expiration from a keytab on WAS 8.5.5.5. The same process works correctly on Tomcat 8, and I believe the primary difference is the JDK / JAAS ...
1
vote
0answers
20 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
1
vote
0answers
77 views

Tomcat 8, Kerberos authentication

I'm configuring kerberos for a tomcat server. Before I call the web application support company I would like to know if I'm doing the correct steps since it's my first time. The domain has 2 zones, ...
1
vote
0answers
21 views

Dante with Kerberos configuration across sites

I have a requirement to host a socks proxy in a central location, using Dante. What I've been asked to do is connect remote clients to it across the internet, they'll pass through a gateway routing ...
1
vote
0answers
49 views

How to get Kerberos tickets in sync with OS X password changes?

I've traced an issue that's been plaguing us down to a "simple" problem: Kerberos tickets are not syncing with OS X Open Directory password changes. Another way to put this: Expired/expiring ticket ...
1
vote
0answers
57 views

How can I make Kerberos flush the credential cache when a user changes their password?

We've got a fun new issue after upgrading to OS X 10.10 client and server with Open Directory (from 10.8). When a user changes their password (using System Preferences or at the Login screen) it ...
1
vote
0answers
185 views

Powerbroker Open : Cannot automount CIFS share, where is the kerberos ticket?

I am using Powerbroker Open (formerly Likewise Open) to join CentOS 7 machines to a Windows 2012 R2 domain. Login etc. works fine. Now I am trying to use the automatic mount of home directories via ...
1
vote
0answers
185 views

Open Directory Password Change Issues on OS X Server 10.10

I'm having a problem with 50+ workstations (10.9 and 10.10) when a user changes their OD password (either at the OS X login screen or the System Preferences). The password change updates on the ...
1
vote
0answers
63 views

Kerberized NFSv4 without creating new service principals

I need to deploy NFSv4 with Kerberos authentication in an existing AD environment, however, it must be done without making any changes on the KDC... So I figured, I would need to reuse host ...
1
vote
0answers
127 views

Obtain Kerberos ticket automatically (on boot) in CentOS 7?

I'm using Ansible to administer a group of Windows servers, with my control machine running CentOS 7.1. I've set up my /etc/krb5.conf file to authenticate to a domain controller so I can use one ...
1
vote
0answers
122 views

JBoss SPNEGO Authentication Renewing Server Kerberos Tickets

We have successfully configured SPNEGO with our webapp on JBoss EAP 6.2, Windows Server 2008, and IE10 using JBoss Negotiation. What is best operational practice for renewing the ticket issued to ...
1
vote
0answers
293 views

IIS 8.5 / Windows Authentication - 401 response on certain clients

We are running a Tomcat application behind a IIS 8.5 Windows Authentication Proxy, the redirect is via the tomcat AJP connector. We now have the problem that on certain clients, the authentication ...
1
vote
0answers
41 views

Kerberized root user on RHEL 5/6

I'm currently involved with getting NFSv4 and Kerberos. We've decided to bite the bullet and try and make the transition. Our environment is: Windows AD LDAP auth on Linux against said AD. ...
1
vote
0answers
34 views

Setting environment variables based on passing Require directive

I finally succeed on configuring Apache as a SPNEGO reverse proxy for my app, and I'm using the AUTHORIZE_SAMACCOUNTNAME, AUTHORIZE_CN and AUTHORIZE_MAIL to figure out some information about the ...
1
vote
0answers
17 views

Kerberized NFSv4 share (deleted) after token expiry

I set up a NFSv4 server with Kerberos authentication and it runs well. However, some users stay logged in for long times such that they have to renew their tickets after some days. If during the time ...
1
vote
0answers
85 views

How can one determine what Kerberos key encryption algorithms are supported on a Cisco IOS device?

When attempting to load an SRVTAB over TFTP, I receive an "Unsupported keytype" error: abc(config)#kerberos srvtab remote 1.2.3.4 abc.srvtab Loading abc.srvtab from 1.2.3.4 (via Vlan123): ! [OK - 121 ...
1
vote
0answers
201 views

Setting up SPN for SSRS in a CRM load balance environment

I'm getting this exception randomly in a CRM load balance LIVE environment when running Reports from CRM. System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner ...
1
vote
0answers
82 views

pwauth kerberos authentication specifying default and secondary servers

I am currently using Kerberos authentication for Basic Authentication on Apache using pwauth and mod_auth_external. I would like to add multiple servers to authenticate from, however they would have ...
1
vote
0answers
331 views

GSSAPITrustDns option missing from OpenSSH-6.7

I need to use the GSSAPITrustDns option to connect to a round robin service using Kerberos authentication. This works correctly using OpenSSH 5.3 and 6.6.1p1 on a selection of machines. I have an Arch ...
1
vote
0answers
76 views

Apache auth_kerb_module on Windows

I need to install the Kerberos module in Apache on Windows. I have copied the file auth_kerb_mod.so to apache/modules/ and I have modified the conf/httpd.conf with LoadModule auth_kerb_module ...
1
vote
0answers
589 views

Postfix + Saslauthd + Kerberos 5 + CentOS 7 not working

I've almost got saslauthd checking against Kerberos but seeing some last issues on CentOS 7. When postfix talks to saslauthd, it sends a lowercased domain and it's not corrected. I tried to fix things ...
1
vote
0answers
1k views

Kerberos Configuration Manager for SQL Server error “unable to access user principal information from the system”

When I launch the Kerberos Configuration Manager for SQL Server and try to connect to the local machine it's on, I am getting the error "Kerberos Configuration Manager for SQL Server error "unable to ...
1
vote
0answers
72 views

kerberos apache 401 error for domain admins using office addin

I use SSO for access to a Linux based system from our windows 7 PC's. This works for IE using the logon credentials to access the system. However, when the developed office plugin is used by any ...
1
vote
0answers
120 views

Avoid client keytab with Kerberized NFSv4

I would like to setup a Kerberized NFSv4 server such that clients do not need a keytab to mount a volume (but such that users get their privileges according to their Kerberos ticket as usual). Is it ...
1
vote
0answers
244 views

kinit error: Realm not local to KDC, DC is in a subdomain

I have a user: oneuser@EXEMPLE.COM as principal and the next krb5.conf: [libdefaults] default_realm = EXEMPLE.COM default_tkt_enctypes = arcfour-hmac-md5 default_tgs_enctypes = ...
1
vote
0answers
73 views

Kerberos credentials cache dates reported differently in Debian Squeeze and Debian Wheezy

I have two Debian servers which use same LDAP/Kerberos server, but dates in output of klist on them shown in different format - mm/dd/yyyy on squeeze vs dd/mm/yy on wheezy. Looks like they just use ...
1
vote
0answers
167 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
1
vote
0answers
2k views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
1
vote
0answers
105 views

Connect an LDAP realm with an AD domain, with the same name?

The situation is a separate group has created an LDAP domain. We'll call it foo.bar. (fyi, none of these are connected in any way to the Internet) They also have a Windows domain and renamed it to ...