Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

2
votes
0answers
29 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
2
votes
0answers
17 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
2
votes
0answers
189 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
0answers
280 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
2
votes
0answers
492 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
2
votes
0answers
507 views

Autofs always uses uid 0 when mounting

We have some Ubuntu clients here which shall mount kerberos protected NFS homes. The server works nicely with the existing clients, so we can assume that ldap and kerberos are ok. We managed to ...
1
vote
0answers
18 views

kinit error: Realm not local to KDC, DC is in a subdomain

I have a user: oneuser@EXEMPLE.COM as principal and the next krb5.conf: [libdefaults] default_realm = EXEMPLE.COM default_tkt_enctypes = arcfour-hmac-md5 default_tgs_enctypes = ...
1
vote
0answers
16 views

Kerberos credentials cache dates reported differently in Debian Squeeze and Debian Wheezy

I have two Debian servers which use same LDAP/Kerberos server, but dates in output of klist on them shown in different format - mm/dd/yyyy on squeeze vs dd/mm/yy on wheezy. Looks like they just use ...
1
vote
0answers
71 views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
1
vote
0answers
64 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
1
vote
0answers
38 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
1
vote
0answers
231 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
1
vote
0answers
232 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
1
vote
0answers
49 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
1
vote
0answers
463 views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
1
vote
0answers
89 views

Integrating Kerberos authentication on Apache with a Git server

First time asking a question here so I hope I'm in the right place to do so. I've also searched for similar problems on here, but couldn't find anything quite as similar. Here's my problem. We ...
1
vote
0answers
124 views

heimdal error Decrypt integrity check failed for checksum type

when I try to authentication with heimdal-kdc ,I get this error in kdc log : (enctype aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type hmac-sha1-96-aes256, key type ...
1
vote
0answers
2k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
1
vote
0answers
121 views

Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation. Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum. Upon ...
1
vote
0answers
170 views

Problems with kvno + Consultation with kerberos authentication settings

I have clearly identified a problem that I can not solve. I suspect I'm missing something when setting the service running on Centos 6 on Windows Server 2003. First I tell the environment that I'm ...
1
vote
0answers
340 views

Server not found in Kerberos database while getting credentials for imap

When running kvno imap/prueba-mail.ejemplo.org@EJEMPLO.ORG get the following error: kvno: Server not found in Kerberos database while getting credentials for imap/prueba-mail.ejemplo.org@EJEMPLO.ORG ...
1
vote
0answers
73 views

Kerberos Single Sign On

I am trying to implement Single Sign On using kerberos with ssh. I changed the below files and restarted the ssh daemon. /etc/ssh_config GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ...
1
vote
0answers
81 views

Kerberos with AuthnProviderAlias

I was configuring some AuthnProviderAliases today and I want to add kerberos to it. The problem is that when I added kerberos apache wouldn't restart and I got the following error in my syslog: ...
1
vote
0answers
73 views

Kerberized SSH Failed

I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost. debug3: Wrote 80 bytes for a total of 1125 ...
1
vote
0answers
231 views

IIS7, Kerberos, sometimes no response from browser to 401

SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
1
vote
0answers
465 views

CUPS Negotiate authentication woes

I have been struggling to Kerberize certain services within our domain, one of which is CUPS. The setup is as follows: a central print server connects to each individual printer around the domain and ...
1
vote
0answers
181 views

Mixing Redmine and custom authentication method in a single apache virtualhost for Redmine

I developed on Redmine a plugin to automatically log users using the REMOTE_USER given by Apache when its Kerberos ticket is accepted. This plugin works as long as the user has a corporate login, but ...
1
vote
0answers
103 views

Winbind info shows local users that do not exist

I am setting up Samba on a Linux machine running CentOS 6 (called localhost, and the AD computer I am connecting to is dc.companyname.com), and I have done everything successfully, except when I type ...
1
vote
0answers
122 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
1
vote
0answers
549 views

heimdal kerberos in openldap issue

I think I posted this on the wrong 'sister site', so here it is. I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in ...
1
vote
0answers
479 views

Firefox proxy authentication with Kerberos: one service ticket per connection (Linux)

I am trying to enable proxy authentication via Kerberos for Firefox. The setup is: Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets ...
1
vote
0answers
268 views

LSA Cache Entries - NTLM versus Negotiate Windows Authentication Providers

We have a situation, due to a recent employee name change, where the HttpContext.Current.User.Identity.Name property of an ASP.NET web application resolves to the old username. This has been ...
1
vote
0answers
181 views

Problems mounting kerberos protected NFS share from a client machine

I have a client Linux (Fedora 16) PC that I want to use to access a NFS share. Running the command mount -v -t nfs4 -o sec=krb5 server.company.com:/home/share/username /media/nfs results in ...
1
vote
0answers
225 views

Making a kerberos keytab in Windows

I am writing a pGina plugin to get AFS Tokens and a Kerberos TGT from our kdcs at login, while writing I noticed a 'feature' of kinit being that it wont let you provide any input unless its from the ...
1
vote
0answers
234 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
1
vote
0answers
299 views

Unable to access SQL Server 2008 - Cannot Generate SSPI Context

I've had this problem for a few weeks but haven't had time to focus on it until now. My company has a relatively fresh installation of Windows Server 2011, which is also running Microsoft SQL Server ...
1
vote
0answers
244 views

Setting up single sign-on between Mac client & OS X Server

I'm not "single sign-on" is the right terminology for what I'm trying to accomplish, so please correct me if I'm wrong. We have a Mac OS X Server and Mac clients. Kerberos and Open Directory are ...
1
vote
0answers
411 views

Kerberos high availability failover, Apache Mod_auth_kerb, Using the Kerberos slave is slow

We host our own Redmine rails web application internally with Apache using Mod_auth_kerb and our internal Kerberos for authentication. We have 2 internal Kerberos servers KDC1 and KDC2. KDC1 is ...
1
vote
0answers
294 views

NFSv4 ACLS vs NFSv3 KRB5 - problems - alternatives?

So NFSv4 acls don't ignore the umask as far as I can tell. And nfsv3 with kerberos has its own host of problems (with autofs - race conditions with pam). So if we want to use an nfs like system with ...
1
vote
0answers
197 views

Kerberos Service Principal not found in AD

I've got a strange problem with an Active Directory SPN Account. This does not work: kinit HTTP/my.host.com@MY.REALM However, "setspn -l SA_MyUser" lists "HTTP/my.host.com" as registered service ...
1
vote
0answers
855 views

802.1x authentication against an Active Directory with a trusted Kerberos realm

I am attempting to use Windows Server 2008 NPS to provide 802.1x authentication against our Cisco switches. The set-up works fine for local domain users, I am now attempting to integrate it with an ...
1
vote
0answers
584 views

Kerberos Issue on Aliased SharePoint Web Front Ends

I am having a problem with Kerberos working on SharePoint. Also note that I am a developer not a network guy so if I use the wrong terms I apologize but I hope my intent is clear. We have two web ...
0
votes
0answers
18 views

Kerberos and SSH login

I've just configured a RHEL 7 for windows authentication (idmap_ad). Every check works but if i try to ssh with a domain user i get the error: Connection closed by ::1 Here follows the ssh log in ...
0
votes
0answers
14 views

User under windows server AD access Linux server using kerberos

I installed AD on windows 2008 r2 sp1 server . And had configured all things follow the issue http://msdn.microsoft.com/en-us/library/ms995329.aspx ...
0
votes
0answers
39 views

bugzilla authenticate with kerberos + ldap + SSO

I want to set up bugzilla with SSO, i cannot find any good documentation on how to do this. I have managed to set up ldap login which works fine. now I have set up kerberos on apache which works fine, ...
0
votes
0answers
39 views

NFS4 and NFS3 mount proble with sec=krb5

I am having a problem when mounting the NFS server share using sec=krb5 The error is WARNING: Failed to create krb5 context for user with uid 0 for server YYY WARNING: Failed to create machine krb5 ...
0
votes
0answers
33 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
0
votes
0answers
14 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
0answers
147 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
0
votes
0answers
62 views

Cannot authenticate as diradmin - OS X Server 10.6 Workgroup Manager

As far as I can tell, not an uncommon problem: when I try to authenticate as 'diradmin' in Workgroup Manager for /LDAPv3/127.0.0.1 it fails with a login problem: "The login information is not valid ...