I set up a KDC Server and created a Realm EXAMPLE.COM. Here is my krb5.conf file:

  renew_lifetime = 7d
  forwardable = true
  default_realm = EXAMPLE.COM
  ticket_lifetime = 24h
  dns_lookup_realm = false
  dns_lookup_kdc = false
  default_ccache_name = /tmp/krb5cc_%{uid}
  #default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
  #default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5

  default = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
  kdc = FILE:/var/log/krb5kdc.log

    admin_server = my.linux-server.de
    kdc = my.linux-server.de

I also added a user testuser with password abc via kadmin.local:

kadmin.local:  addprinc testuser@EXAMPLE.COM

I can successfully log in on my Ubuntu VM:

[root@ubuntu-vm ~]# kinit testuser
Password for testuser@EXAMPLE.COM:

Then klist shows:

[root@ubuntu-vm ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: testuser@EXAMPLE.COM

Valid starting       Expires              Service principal
01.12.2016 14:58:40  02.12.2016 14:58:40  krbtgt/EXAMPLE.COM@EXAMPLE.COM

and I can open my Kererized Hadoop UI.


Problem makes my Windows client. I set it up by copying the krb5.conf file from the KDC machine to the Windows client and renamed it to kdc5.ini.

I also set the computer's domain:

C:> Ksetup /setdomain EXAMPLE.COM

After a restart I tried to connect to my KDC Realm via

C:> kinit testuser@EXAMPLE.COM
Password for testuser@EXAMPLE.COM:
<empty row>

Everything looked fine so far, but when I call klist I get only the following result:

Aktuelle Anmelde-ID ist 0:0x7eca34

Zwischengespeicherte Tickets: (0)

In English something like ... cached tickets: (0)

I'm also unable to open my website on the Windows client, so I guess that there's an interoperability issue as I didn't have any problems connection via my Ubuntu client.

My browser (Firefox) should be correctly configured on both machines (Ubuntu & Windows), I set the network.negotiate-auth.trusted-uris property to http://my.linux-server.de (since I did this, the Ubuntu client can open the site). Curl also works for Ubuntu, but don't for Windows.

UPDATE: Also tried a second Windows client without any success...

  • I assume this is a workgroup machine, have you tried MIT Kerberos client? Dec 1, 2016 at 14:36
  • Yes, I also tried the MIT Kerberos Client. I clicked "Get Ticket" and entered Principal name and password. In the list below I can see the principal and the "valid until" entry for the ticket.
    – D. Müller
    Dec 1, 2016 at 14:44
  • @JacobEvans Do I have to configure more than the krb5.ini (copied from the server) and the "ksetup /setrealm EXMAPLE.COM" command?
    – D. Müller
    Dec 1, 2016 at 14:46
  • Can you get a network trace, taken from the client, filtered for Kerberos traffic...
    – Ryan Ries
    Dec 1, 2016 at 14:54
  • honestly not sure, still trying to figure this out for a krb5 realm trust between 2012R2 and ipa Dec 1, 2016 at 14:59

1 Answer 1


Finally I got it working! I made the following steps on a Windows 7 (64-bit) machine, should also work on Windows 10:

  1. Install the MIT Kerberos from here. I took the actual Windows Version which is MIT Kerberos for Windows 4.1 and installed it with default settings.
  2. Open the file C:\ProgramData\MIT\Kerberos\krb5.ini and insert following settings:

New content of the file:

  default_realm = EXAMPLE.COM

    admin_server = your.admin.server.de
    kdc = your.kdc.server.de
  1. Download and install actual Firefox Browser
  2. Type about:config in the address bar of the Firefox browser and set the following parameters:

Parameter = Value pairs:

network.negotiate-auth.delegation-uris = http://your.kdc.server.de

network.negotiate-auth.trusted-uris = http://your.kdc.server.de

network.auth.use-sspi = false
  1. Restart your PC
  2. Use the MIT Kerberos Ticket Manager to obtain a new ticket for your user: enter image description here

  3. You should see your ticket in the manager: enter image description here

    8 . Now you should be able to open the web-page that needs authentication: enter image description here

  • More help here: computing.help.inf.ed.ac.uk/kerberos-windows They use some other tools for 64-bit Windows machines, but it also should work with MIT Kerberos as explained above. For 32-bit Windows, MIT Kerberos is recommended anyway.
    – D. Müller
    Jan 10, 2017 at 11:20
  • In another words, you say that replacing default Windows Kerberos implementation by the downloaded MIT implementation fixes the problem, even for Windows 10? And why does Windows 10 ignore the krb5.ini file no matter where one places it (at least it seems so on my machine)? Dec 9, 2019 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.