New answers tagged

1

Your question is confused. Kerberos is used for authentication, not authorization. So the answer is no, kind of. You can use Kerberos to authenticate to an account with is authorized, but a Keberos principal alone doesn't qualify as an account. The most common way to hold accounts in systems that use Kerberos of authentication is LDAP. DQL and /etc/passwd ...


0

I found the answer in the nslcd.conf. By adding the option ssl_canonocalize no this will stop it doing a dns reverse lookup and use the hostname


0

We had a similar issue with a new NetApp. All W10/2012 clients were not able to access the CNAME share, but W7/2008R2 clients were able to do so. We didn't have to create the CNAME SPN. What we did is remove all SPNs for the CNAME that showed up with setspn -l cname. NOTE: We had the CNAME as AD computer account as well and it stayed there after.


0

not out of the box. You can install the MIT kerberos client for Windows and you can run kinit against the KDC and you can probably map the local workstation user to the kerberos principal on the apache-ds database, but it is in not AD (which is what the Windows native kerberos client expects). If you want to use kerberos with Windows clients you really need ...


1

Although this is a 2 years old question, I am putting an answer for it, for I had similart problem. LX-141(root)# root/greg>net ads join -S W12R2-C17.jamie_ad1.net -U Administrator%pwd kerberos_kinit_password Administrator@JAMIE_AD1.NET failed: Cannot contact any KDC for requested realm Failed to join domain: failed to connect to AD: Cannot contact any ...


0

This is Max token size. The token will only consume that much memory if necessary. It doesn't mean that ALL Kerberos tokens will always be 48000 bytes. This problem is usually only found in large enterprises with many security groups, that have been accumulating for years. In Windows2012, there is a new hard limit for the number of groups a user account ...


0

Direct from the docs regarding Cross-realm Authentication In order for a KDC in one realm to authenticate Kerberos users in a different realm, it must share a key with the KDC in the other realm. In both databases, there must be krbtgt service principals for realms. These principals should all have the same passwords, key version numbers, and encryption ...


0

Check if /etc/apache2/portal.keytab is owned by the webserver user (www-data on debian systems) and only readable by this user (-r--------). Check if you configured your browser for both the domain test.com and subdomains about:config network negotiate-auth.trusted-urls test.com, .test.com


0

It seems to me that your kadmin tool cannot find its admin server. The DNS-message you get is most likely because kadmin trys to find its admin server via dns service record, which is not used at the moment _kerberos-adm._tcp This should list port 749 on your master KDC. Support for it is not complete at this time, but it will eventually be used by the ...


2

Running your messages through audit2allow we find #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; This tells us that samba isn't allowed to write or open files with a context tmp_t 1. You could put SELinux in Permissive mode and let the system run for a ...



Top 50 recent answers are included