Questions tagged [gssapi]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
156 views

RHEL8 and GSSAPI Kerberos authenticate through Apache issue

I'm trying to run an apache virtualhost, on a machine currently running Red Hat Enterprise Linux release 8.5 (Ootpa), with Kerberos authentication using the new GSSAPI module (replacement of ...
user avatar
  • 11
0 votes
1 answer
1k views

Getting javax.naming.CommunicationException: Connection reset and AD "event ID 1216" while trying to perform LDAP search using JNDI and GSSAPI

I am trying to analyze the reason for exceptions/ failures during the Ldap search. I am performing operations using JNDI on Active directory domain controller. Here is the background for the things ...
user avatar
1 vote
0 answers
1k views

curl not sending credentials during negotiation

We have a Jenkins server that uses Kerberos-SSO, with a fallback to Basic if SSO is not configured on the browser or using curl. When I use curl with the --negotiate argument, however, it doesn't send ...
user avatar
  • 514
0 votes
2 answers
311 views

Can't determine the principal used to LDAP syncrepl GSSAPI

I've configured two openldap fully functional in HA (syncrepl mode provider - slave). After testing that simple bind syncrepl works flawlessly, I'm trying to deploy from scratch using only GSSAPI to ...
user avatar
  • 25
0 votes
1 answer
160 views

Azure ADDS and GSSAPI

How can I configure Azure AD Domain Services to support GSS negotiation? I see that in the on-premises AD it can be configured to "Require signature" to negotiate the authentication ...
user avatar
  • 11
1 vote
1 answer
2k views

Authenticating Apache HTTPServer 2.4.x with mod_auth_gssapi using Microsoft Active directory

I'm looking for below configurations for GSSAPI authentication with Apache 2.4 for Active directory: 1. How to configure Apache HTTPServer 2.4.x with mod_auth_gssapi using Microsoft Active directory? ...
user avatar
0 votes
1 answer
2k views

Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI

Authentication against Kerberos and authorization against an LDAP directory is working for me. Now I'm looking for the client setup on Debian Buster using sssd. I started with LDAP authentication ...
user avatar
  • 396
0 votes
1 answer
674 views

NSS query against OpenLDAP server using GSSAPI with proxy authorization

SASL/GSSAPI needs Kerberos authentication against the LDAP server with proxy authorization if using LDAP authentication with nss-pam-ldapd on a Debian Buster operating system. I try to configure this ...
user avatar
  • 396
0 votes
1 answer
878 views

How to setup SASL Proxy Authorization with an OpenLDAP server on Debian

For Kerberos Authentication together with SASL/GSSAPI Authorization on client devices I need Proxy Authorization on an OpenLDAP server running on Raspberry Pi with Debian/Raspbian Buster. I tried to ...
user avatar
  • 396
0 votes
1 answer
736 views

nginx - prevent caching authorization info

I am using nginx as reverse proxy for my asp.net core web application. I am using spnego module for nginx for supporting of windows integrated authentication. It is works, but if user enters incorrect ...
user avatar
1 vote
0 answers
134 views

GSSAPI errors when running remctl

While migrating my Kerberos servers from CentOS 6 to CentOS 7 I seem to have broken something on the current KDC and, despite several hours of trial-and-error and searching documentation, I cannot ...
user avatar
1 vote
2 answers
1k views

Dovecot IMAP authenticating proxy using Kerberos/GSSAPI

I'm trying to set up Dovecot as authenticating reverse proxy, in front of an already running IMAP server to accomplish the following: Have Dovecot authenticate users using Kerberos/GSSAPI (to allow ...
user avatar
  • 3,332
1 vote
1 answer
1k views

CentOS 7:Reoccurring failure in accessing AD member samba shares

I have a Samba 4.6.2 samba ActiveDirectory member server. Every month or so, all clients lose the ability to connect to all the shares. I can work around the issue by leaving the domain, deleting the ...
user avatar
  • 209
1 vote
1 answer
4k views

What does GSSAPI "Message stream modified" error mean?

I'm having trouble completing a bind to our LDAP servers on Centos 7.1 servers. Manual bind works, but ldapsearch fails with an error: sssd_be: GSSAPI Error: Unspecified GSS failure. Minor code may ...
user avatar
0 votes
1 answer
5k views

Bind LDAP simple authentication

I have a customer with LDAP that I can only log in with GSS-API enabled. He doesn't know how to enable simple authentication. How can I enable this in MS ActiveDirectory?
user avatar
  • 101
9 votes
3 answers
8k views

Add GSSAPI to OpenLdap in supportedSASLMechanisms

I'm looking how to add the GSSAPI support into my OpenLDAP ? Current setup MIT Kerberos V + OpenLDAP Kerberos bind to openldap Able to issue kerberos tickets to my users (with kinit exampluser) Able ...
user avatar
  • 1,103
2 votes
1 answer
1k views

Intermittent Kerberos failures: GSSAPI authentication initialization failed

When using MIT Kerberos Ticket Manager with PuTTY 0.65 and WinSCP 5.9.3, I am sometimes unable to get a connnection to the server I am logging into. PuTTY will respond with either No supported ...
user avatar
0 votes
1 answer
1k views

unable to authenticate with kerberos to ipa client from windows 10 machine

I have a domain joined windows 10 computer trying to authenticate via kerberos to an ipa (4.4.0) client (centos 7.2), I can authenticate with user/pass and then kinit but I cannot seem to authenticate ...
user avatar
  • 7,596
1 vote
1 answer
383 views

How to ensure encrypted OpenLDAP sessions using SASL/GSSAPI

I am running OpenLDAP 2.4 on a Debian jessie system. Clients typically connect to this LDAP server over port 389 using SASL/GSSAPI with our Kerberos infrastructure. When a client connects using SASL/...
user avatar
  • 2,591
0 votes
0 answers
600 views

Why is my sshd looking for a wrong kvno in keytab?

My FreeBSD box is using Heimdal Kerberos-implementation. It is registered with the corporate AD, its msDS-KeyVersionNumber-attribute is set to 2, and its keytab has the following entries: FILE:/etc/...
user avatar
  • 2,262
3 votes
1 answer
2k views

gssproxy: apache httpd as nfs-client? centos7

When Apache httpd attempts to access a user directory automounted with sec=krb5p, and presumably other sec=krb options, gssproxy issues a failure message and the web server replies with 403 Forbidden. ...
user avatar
  • 12.6k
0 votes
2 answers
709 views

gssapi/kerberos/active directory/ubuntu - Wrong principal in request

I'm trying to setup a Clientserver with a Webservice to which Users of an Active Directory should be able to login with SSO. I'm using SPNEGO with Kerberos on a Ubuntu 14.04 Server and nginx proxy to ...
user avatar
  • 11
0 votes
0 answers
592 views

kerberos authentication to linux from windows

We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos ...
user avatar
  • 351
0 votes
1 answer
765 views

psql: duplicate GSS authentication request

What does it mean by saying 'duplicate' ? How to troubleshoot this? guest@www:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user/admin@SOHONET Valid starting Expires ...
user avatar
1 vote
1 answer
1k views

GSSAPI on Linux when reverse DNS lookup doesn't match AD DNS suffix

I have CentOS 6 server that has been joined to Active Directory using Samba and net ads join -k. It thus has a keytab like this: Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------...
user avatar
3 votes
1 answer
2k views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
user avatar
  • 437
0 votes
1 answer
782 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
user avatar
0 votes
1 answer
347 views

Does "Kerberised" NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
user avatar
1 vote
1 answer
1k views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter authenticationMechanisms=...
user avatar
  • 141
4 votes
1 answer
3k views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
user avatar
  • 601
11 votes
3 answers
41k views

Putty Kerberos/GSSAPI authentication

I configured a few Linux servers to authenticate with Active Directory Kerberos using sssd on RHEL6. I also enabled GSSAPI authentication in hopes of passwordless logins. But I can't seem to get ...
user avatar
  • 481
4 votes
0 answers
1k views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
user avatar
3 votes
1 answer
11k views

problems creating a keytab file on win server

I am trying to create a keytab file. i see a warning WARNING: pType and account type do not match. This might cause problems. The command i use is ktpass -princ HTTP/bloodhound.domain.com@...
user avatar
0 votes
1 answer
264 views

Mail client with support for gssapi

I have configured Postfix and Cyrus Imap to enable SSO using Kerberos and GSSAPI. I use Thunderbird as a mail client which supports GSSAPI but I wanted to try some other client also. I tried ...
user avatar
4 votes
2 answers
2k views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
user avatar
  • 668
0 votes
0 answers
570 views

Use gssapi with Microsoft office outlook.

Currently in windows computer I have installed Kerberos for Windows. This allowed me to use sso with Thunderbird against a Cyrus IMAP. Thunderbird has the option of using GSSAPI. Is possible to ...
user avatar
2 votes
2 answers
11k views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
user avatar
  • 242
0 votes
1 answer
1k views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
user avatar
  • 2,109
5 votes
1 answer
12k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
user avatar
  • 151
3 votes
1 answer
1k views

SSH - slow authentication

This is more of a curiosity question then a problem at this point. I have resolved my problem which i'll post the solution that worked for me. problem I was getting rather slow authentication times ...
user avatar
  • 347
1 vote
1 answer
719 views

Can one config LDAP to accept auth from ssh-agent instead of from Kerberos?

[This question is not about getting your LDAP password to authenticate you for SSH logins. We have that working just fine, thank you :-) ] Let's suppose you're on a Linux network (Ubuntu 11.10, slapd ...
user avatar
0 votes
1 answer
166 views

Cyrus-IMAP, GSSAPI and auxprop

I'm setting up a mail system using Postfix (OpenLDAP backend) and Cyrus-IMAP on Debian. Goal: I'd love to go ahead with GSSAPI authentication. I've tested the whole setup on virtual machines on my ...
user avatar
  • 898
3 votes
1 answer
4k views

Openldap/Sasl/GSSAPI on Debian: Key table entry not found

The goal: to make an OpenLDAP server to authenticate using Kerberos V via GSSAPI Setup: several virtual machines running on freshly installed/updated Debian Squeeze A master KDC server kdc.example....
user avatar
  • 898
2 votes
3 answers
11k views

Wrong principal in request (SSH/ GSSAPI/Kerberos/Debian)

I've set up two VMs on an "internal" (in VirtualBox meaning) network, one being a DNS server (dns1.example.com) and the other - a KDC and Kerberos admin server (kdc.example.com). The default and the ...
user avatar
  • 898
2 votes
1 answer
11k views

OpenSSH + Kerberos SSO: No key table entry found for host/localhost.localdomain

SSO not working with OpenSSH - I have not been able to get GSSAPIAuthentication to work with Kerberos. Everytime I attempted to login, I kept getting prompted for the password. During the ...
user avatar
  • 5,048
0 votes
1 answer
187 views

Error on trying to ssh to a prgmr box when using PuTTY like utility KiTTY

I recently got a box on prgmr. Excited, I tried to login using my username password in KiTTY (which is basically an improved PuTTY) and got the following error, shown in the screenshot. Now, I can ...
user avatar
  • 103
1 vote
2 answers
4k views

How do I use ldapsearch with a cross-realm ticket?

kinit user@DOMAIN.TLD klist -afe Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user@DOMAIN.TLD Valid starting Expires Service principal 08/04/11 13:14:53 08/05/11 01:...
user avatar
  • 12.6k