0

I'm trying to setup a Clientserver with a Webservice to which Users of an Active Directory should be able to login with SSO.

I'm using SPNEGO with Kerberos on a Ubuntu 14.04 Server and nginx proxy to Naviserver for the Webservice to do that and get the Error Code: majorStatus: 851968 , minorStatus: 2529639056 (Wrong principal in request)

/etc/krb5.conf

    [libdefaults]
        default_realm = TEST.LOCAL
        default_keytab_name = /etc/staging.keytab
        rdns = false
        ignore_acceptor_hostname = true
        dns_lookup_realm = false
        dns_lookup_kdc = false
        default_tkt_enctypes = des-cbc-md5 des-cbc-crc arcfour-hmac-md5 rc4-hmac
        default_tgs_enctypes = des-cbc-md5 des-cbc-crc arcfour-hmac-md5 rc4-hmac
        permitted_enctypes = des-cbc-md5 des-cbc-crc arcfour-hmac-md5 rc4-hmac
        allow_weak_crypto = true
        kdc_timesync = 1
        clockskew = 100
        ccache_type = 4
        forwardable = true
        proxiable = true
        ticket_lifetime = 25h
        renew_lifetime = 7d
        kdc_req_checksum_type = 4
[realms]
        TEST.LOCAL = {
                kdc = something.test.local
                admin_server = something.test.local
                default_domain = TEST.LOCAL
        }
[domain_realm]
        live.test.smth = TEST.LOCAL
        .live.test.smth = TEST.LOCAL
        staging.smth.else = TEST.LOCAL
        .staging.smth.else = TEST.LOCAL

in /etc/hosts is no 127.0.0.1

ActiveDirIP    test.local
myIP    staging.smth.else

I have a keytab File generated from the Active Directory Admins with

ktpass /princ HTTP/staging.smth.else@TEST.LOCAL /mapuser user-staging@test.local /pass *** /out staging.keytab /crypto DES-CBC-CRC /kvno 0 /ptype KRB5_NT_PRINCIPAL

And it works when I call kinit:

~$ kinit -S http/staging.smth.else@TEST.LOCAL staging@TEST.LOCAL
~$ klist
Ticket cache: FILE:/tmp/krb5cc_1002
Default principal: staging@TEST.LOCAL

Valid starting       Expires              Service principal
2016-02-12 13:31:44  2016-02-12 23:31:44  http/staging.smth.else@TEST.LOCAL
    renew until 2016-02-13 13:31:41

~$ kinit http/staging.smth.else@TEST.LOCAL
~$ klist
Ticket cache: FILE:/tmp/krb5cc_1002
Default principal: http/staging.smth.else@TEST.LOCAL

Valid starting       Expires              Service principal
2016-02-12 13:30:58  2016-02-12 23:30:58  krbtgt/TEST.LOCAL@TEST.LOCAL
    renew until 2016-02-13 13:30:49

~$ kinit staging@TEST.LOCAL
~$ klist
Ticket cache: FILE:/tmp/krb5cc_1002
Default principal: staging@TEST.LOCAL

Valid starting       Expires              Service principal
2016-02-12 13:32:13  2016-02-12 23:32:13  krbtgt/TEST.LOCAL@TEST.LOCAL
    renew until 2016-02-13 13:32:09

kvno is 3 but the Admin told me that kvno in Windows is irrelevant.

kvno staging@TEST.LOCAL
staging@TEST.LOCAL kvno = 3

In NaviServer Config is defined:

ns_section ns/server/${server}/module/knspnego
ns_param Krb5KeyTabFile "/etc/staging.keytab"
ns_param Krb5ServiceName "HTTP@staging.smth.else"
ns_param AuthType "SPNEGO"

hostname

hostname -f
staging.smth.else

Do you have any ideas where the problem is?

0

I found the solution. In the keytab files was the wrong /crypto for our setting. It's working with /crypto ALL

0

I had a similar problem. Replaced the encryption type rc4-hmac with these:

arcfour-hmac
aes128-cts
aes256-cts
des-cbc-crc
des-cbc-md5

Then restarted my services, that fixed it

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.