Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

4
votes
0answers
131 views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ad.example....
4
votes
0answers
276 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
4
votes
0answers
341 views

Windows Authentication to a Remote Server within an Intranet Environment

I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote ...
4
votes
0answers
503 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
4
votes
0answers
1k views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
3
votes
0answers
41 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
3
votes
0answers
267 views

Use Kerberos ticket to access WebDAV

Using Apache's mod_dav as the server, Samba 4.1.17 as the server and any version of Windows from 7 upwards as the client how can I mount a WebDAV share using Kerberos for the authentication? ...
3
votes
0answers
955 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
2
votes
0answers
135 views

Forward Kerberos Authentication on Ansible

I have an ansible control machine (host-A) that need to talk with host-C, an Windows machine that doesn't have local users (It's an Active Directory). host-A doesn't have network access to host-C, ...
2
votes
0answers
208 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
2
votes
0answers
232 views

CUPS remote print queues

In my network, there are multiple printers over many locations, all connected to a single CUPS server via whatever protocols they require. Client machines on the network need to print to the printers ...
2
votes
0answers
138 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
2
votes
0answers
58 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
2
votes
0answers
1k views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
2
votes
0answers
542 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
2
votes
0answers
2k views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ipa-...
2
votes
0answers
517 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
0answers
3k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
2
votes
0answers
556 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
2
votes
0answers
777 views

Autofs always uses uid 0 when mounting

We have some Ubuntu clients here which shall mount kerberos protected NFS homes. The server works nicely with the existing clients, so we can assume that ldap and kerberos are ok. We managed to ...
2
votes
0answers
385 views

NFSv4 ACLS vs NFSv3 KRB5 - problems - alternatives?

So NFSv4 acls don't ignore the umask as far as I can tell. And nfsv3 with kerberos has its own host of problems (with autofs - race conditions with pam). So if we want to use an nfs like system with ...
1
vote
0answers
19 views

Kerberos Double Hop - SQL2014 HA - MSA's

OK, so i'm at my wits end. We have a system which works perfectly in our UAT environment (not HA) but will not work in live. so the config is: dns A record to iis box binding in iis on :80 to ...
1
vote
0answers
48 views

gssproxy: apache httpd as nfs-client? centos7

When Apache httpd attempts to access a user directory automounted with sec=krb5p, and presumably other sec=krb options, gssproxy issues a failure message and the web server replies with 403 Forbidden. ...
1
vote
0answers
31 views

Unspecified GSS failure. after setting up krb5/ldap authentication

new here, so I recently setup ldap/krb5 authentication on an centos7.2 vm. Krb5/ldap is working correclty as I can login using ldap user account. However, when I check the logs in the client machine /...
1
vote
0answers
46 views

Client to IIS to SQL Server Kerberos authentication

I would like to have a setup where my IIS web server sits on a different virtual server from where my SQL Server is installed, and Windows Authentication should be used for all connections. I am ...
1
vote
0answers
59 views

Does FTP service (IIS 7.5) on Windows 2008 R2 support kerberos authentication?

I have configured http service on IIS 7.5 for kerberos authentication. And it works fine. I have checked from linux box # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: alex@EXAMPLE.NET ...
1
vote
0answers
40 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
1
vote
0answers
32 views

Apache External access

I am wondering if anyone can help me. I am trying to setup SSO. I have it working inside a domain, where the kerberos ticket is passed and they sign on works and the user is able to login correctly. ...
1
vote
0answers
44 views

Alot of Events “Kerberos authentication Ticket (TGT) was rejected”

Currently we are seeing a lot of Events "Kerberos authentication Ticket (TGT) was rejected" even for the accounts that are blocked. Also from the event logs, I see a username being used which does ...
1
vote
0answers
95 views

Websphere Application Server and Kerberos Keytab Renewal

I am currently running into an issue with Kerberos ticket expiration from a keytab on WAS 8.5.5.5. The same process works correctly on Tomcat 8, and I believe the primary difference is the JDK / JAAS ...
1
vote
0answers
27 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
1
vote
0answers
165 views

Tomcat 8, Kerberos authentication

I'm configuring kerberos for a tomcat server. Before I call the web application support company I would like to know if I'm doing the correct steps since it's my first time. The domain has 2 zones, ...
1
vote
0answers
47 views

Dante with Kerberos configuration across sites

I have a requirement to host a socks proxy in a central location, using Dante. What I've been asked to do is connect remote clients to it across the internet, they'll pass through a gateway routing ...
1
vote
0answers
60 views

How to get Kerberos tickets in sync with OS X password changes?

I've traced an issue that's been plaguing us down to a "simple" problem: Kerberos tickets are not syncing with OS X Open Directory password changes. Another way to put this: Expired/expiring ticket ...
1
vote
0answers
90 views

How can I make Kerberos flush the credential cache when a user changes their password?

We've got a fun new issue after upgrading to OS X 10.10 client and server with Open Directory (from 10.8). When a user changes their password (using System Preferences or at the Login screen) it ...
1
vote
0answers
350 views

Powerbroker Open : Cannot automount CIFS share, where is the kerberos ticket?

I am using Powerbroker Open (formerly Likewise Open) to join CentOS 7 machines to a Windows 2012 R2 domain. Login etc. works fine. Now I am trying to use the automatic mount of home directories via ...
1
vote
0answers
284 views

Open Directory Password Change Issues on OS X Server 10.10

I'm having a problem with 50+ workstations (10.9 and 10.10) when a user changes their OD password (either at the OS X login screen or the System Preferences). The password change updates on the ...
1
vote
0answers
128 views

Kerberized NFSv4 without creating new service principals

I need to deploy NFSv4 with Kerberos authentication in an existing AD environment, however, it must be done without making any changes on the KDC... So I figured, I would need to reuse host ...
1
vote
0answers
233 views

Obtain Kerberos ticket automatically (on boot) in CentOS 7?

I'm using Ansible to administer a group of Windows servers, with my control machine running CentOS 7.1. I've set up my /etc/krb5.conf file to authenticate to a domain controller so I can use one ...
1
vote
0answers
140 views

JBoss SPNEGO Authentication Renewing Server Kerberos Tickets

We have successfully configured SPNEGO with our webapp on JBoss EAP 6.2, Windows Server 2008, and IE10 using JBoss Negotiation. What is best operational practice for renewing the ticket issued to ...
1
vote
0answers
327 views

IIS 8.5 / Windows Authentication - 401 response on certain clients

We are running a Tomcat application behind a IIS 8.5 Windows Authentication Proxy, the redirect is via the tomcat AJP connector. We now have the problem that on certain clients, the authentication ...
1
vote
0answers
49 views

Kerberized root user on RHEL 5/6

I'm currently involved with getting NFSv4 and Kerberos. We've decided to bite the bullet and try and make the transition. Our environment is: Windows AD LDAP auth on Linux against said AD. RHEL5/...
1
vote
0answers
38 views

Setting environment variables based on passing Require directive

I finally succeed on configuring Apache as a SPNEGO reverse proxy for my app, and I'm using the AUTHORIZE_SAMACCOUNTNAME, AUTHORIZE_CN and AUTHORIZE_MAIL to figure out some information about the ...
1
vote
0answers
19 views

Kerberized NFSv4 share (deleted) after token expiry

I set up a NFSv4 server with Kerberos authentication and it runs well. However, some users stay logged in for long times such that they have to renew their tickets after some days. If during the time ...
1
vote
0answers
89 views

How can one determine what Kerberos key encryption algorithms are supported on a Cisco IOS device?

When attempting to load an SRVTAB over TFTP, I receive an "Unsupported keytype" error: abc(config)#kerberos srvtab remote 1.2.3.4 abc.srvtab Loading abc.srvtab from 1.2.3.4 (via Vlan123): ! [OK - 121 ...
1
vote
0answers
242 views

Setting up SPN for SSRS in a CRM load balance environment

I'm getting this exception randomly in a CRM load balance LIVE environment when running Reports from CRM. System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner ...
1
vote
0answers
105 views

pwauth kerberos authentication specifying default and secondary servers

I am currently using Kerberos authentication for Basic Authentication on Apache using pwauth and mod_auth_external. I would like to add multiple servers to authenticate from, however they would have ...
1
vote
0answers
432 views

GSSAPITrustDns option missing from OpenSSH-6.7

I need to use the GSSAPITrustDns option to connect to a round robin service using Kerberos authentication. This works correctly using OpenSSH 5.3 and 6.6.1p1 on a selection of machines. I have an Arch ...
1
vote
0answers
86 views

Apache auth_kerb_module on Windows

I need to install the Kerberos module in Apache on Windows. I have copied the file auth_kerb_mod.so to apache/modules/ and I have modified the conf/httpd.conf with LoadModule auth_kerb_module modules/...
1
vote
0answers
773 views

Postfix + Saslauthd + Kerberos 5 + CentOS 7 not working

I've almost got saslauthd checking against Kerberos but seeing some last issues on CentOS 7. When postfix talks to saslauthd, it sends a lowercased domain and it's not corrected. I tried to fix things ...