I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012.
I generated keytabs files on WS2012 with
kpass command for each encryption type available on WS2012.
When I try to open a session with a user
kinit, it works.
When I try to open a session with my
HTTP/web.domain.com@DOMAIN.COM, I get the message:
kvno HTTP/web.domain.com@DOMAIN.COM kvno: KDC has no support for encryption type while getting credentials for HTTP/web.domain.com@DOMAIN.COM
Also, when I check encryption used for
test@DOMAIN.COM, I have:
root@SERVER:~# klist -e Ticket cache: FILE:/tmp/krb5cc_0 Default principal: test@DOMAIN.COM Valid starting Expires Service principal 03/04/2015 12:48:21 03/04/2015 22:48:17 krbtgt/DOMAIN.COM@DOMAIN.COM renew until 04/04/2015 12:48:21, Etype (skey, tkt): arcfour-hmac, arcfour-hmac
I tried to customize my
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
And by using the keytab file encrypted with
arcfour-hmac without success.
I don't understand how to change encryption type used to communicate, why it always wants arcfour-hmac and why when I give it arcfour-hmac encryption, nothing change...
How to be sure that /etc/krb5.conf changes are effective and how to make the Kerberos ticket generation work too?