0

Virtual host has been configured with these options;

AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbAuthRealms EXAMPLE.COM
KrbAuthoritative On
KrbServiceName HTTP/something.example.com@EXAMPLE.COM
Krb5KeyTab /path/to/krb/site.keytab
require valid-user

The site.keytab is readable by apache and contains a valid principal;

root@pa2# klist -k /path/to/krb/site.keytab
Keytab name: FILE:/path/to/krb/site.keytab
KVNO Principal
---- --------------------------------------------------------------------------
  13 HTTP/something.example.com@EXAMPLE.COM (des-cbc-crc)
  13 HTTP/something.example.com@EXAMPLE.COM (des-cbc-md5)
  13 HTTP/something.example.com@EXAMPLE.COM (arcfour-hmac)
  13 HTTP/something.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
  13 HTTP/something.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96)
root@pa2# kvno -k /path/to/krb/site.keytab HTTP/something.example.com@EXAMPLE.COM
HTTP/something.example.com@EXAMPLE.COM: kvno = 13, keytab entry valid

But when I try to access the site, I get this error in the apache error log;

[Mon Mar 21 10:30:37.846616 2016] [auth_kerb:error] [pid 11217] [client ...:60195]
gss_accept_sec_context() failed: Unspecified GSS failure.
Minor code may provide more information
(, Cannot find key for HTTP/something.example.com@EXAMPLE.COM kvno 5 in keytab)

The current kvno is indeed not 5.

  • It turns out I had the wrong IP for the vhost, but I still get an error, updating question with new log message. – Morten Nilsen Mar 21 '16 at 9:32
  • If I create a new keytab with just a arcfour-hmac or a aes128-cts-hmac-sha1-96, I get "no key table entry found for HTTP/...@EXAMPLE.COM", but if I create one with ALL, I get the kvno 5 in the log above. – Morten Nilsen Mar 21 '16 at 9:58
  • The user principal in AD does not have a msDS-KeyVersionNumber attribute. – Morten Nilsen Mar 21 '16 at 9:59
1

Issuing klist purge on the client windows computer resolved the kvno issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.