10
votes
Accepted
Putty Kerberos/GSSAPI authentication
On Windows machines that are part of an Active Directory domain, users receive their Kerberos ticket-granting ticket when they log into Windows, and PuTTY is able to use that for authentication if ...
- 931
3
votes
Accepted
What does GSSAPI "Message stream modified" error mean?
In this case it meant that the Kerberos key you obtained was rejected by the LDAP server because of an IP mismatch. Check your hosts file, your DNS and your conf files (sssd, samba, krb5, ldap etc.) ...
- 821
2
votes
Accepted
Intermittent Kerberos failures: GSSAPI authentication initialization failed
Check your DNS settings when the problem is reproduced runing ipconfig /all. Among DNS servers should not be anyone who does not know about the domain to which your server.
You can check this by ...
- 3,295
2
votes
Accepted
Add GSSAPI to OpenLdap in supportedSASLMechanisms
SOLVED
I was missing SASL_MECH GSSAPI and SASL_REAM in /etc/ldap/ldap.conf
[Tue Feb 28 13:48 root:ldap] [~] # cat /etc/ldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file ...
- 1,183
2
votes
Dovecot IMAP authenticating proxy using Kerberos/GSSAPI
Set the passdb attrs to include pass=master password. Dovecot needs a password to try against the proxy. With GSSAPI it obviously doesn't have one, so provide your master password (or with kopano you ...
- 21
2
votes
Accepted
Getting javax.naming.CommunicationException: Connection reset and AD "event ID 1216" while trying to perform LDAP search using JNDI and GSSAPI
My observations might help someone to analyze their issue. First of all Event ID:1216 is generated on the Active Directory when the client (as in my question, I have mentioned JNDI, in this case the ...
2
votes
Authenticating Apache HTTPServer 2.4.x with mod_auth_gssapi using Microsoft Active directory
I managed to make GSSAPI work using the following tutorial:
http://www.jfcarter.net/~jimc/documents/bugfix/41-auth-kerb.html
What I did (I'm on Debian)
Join the domain
Install packages:
apt-get ...
- 76
1
vote
Accepted
Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI
Abstract
After some tries and error I found that I need one package for gssapi and four packages for sssd. I want to have general configuration centralized so I use a local private dns server for name-...
- 406
1
vote
Accepted
Dovecot IMAP authenticating proxy using Kerberos/GSSAPI
Got it to work in the end with the hints by Alex in the other answer and some final help on the Dovecot mailing list where Timo - the Dovecot original author - responded.
Full example of a dovecot....
- 3,484
1
vote
Bind LDAP simple authentication
To enable Simple auth for particular user do this:
https://technet.microsoft.com/en-us/library/cc961961.aspx
"To disable preauthentication, right-click the User object in Active Directory Users and ...
- 11
1
vote
Add GSSAPI to OpenLdap in supportedSASLMechanisms
You'll want to change your sasl configuration for slapd, usually /etc/sasl2/slapd.conf, to include gssapi.
For example:
mech_list: external gssapi plain
pwcheck_method: saslauthd
You'll need to ...
- 12.8k
1
vote
gssapi/kerberos/active directory/ubuntu - Wrong principal in request
I found the solution.
In the keytab files was the wrong /crypto for our setting. It's working with /crypto ALL
- 11
1
vote
Accepted
Wrong user mapping in kerberized NFSv4 automounted homedirs
After a session with Synology support, I finally understood that this cannot work at the moment, due to a limitation on DSM 5.2.
The problem is that DSM assumes the LDAP server to use the UMich ...
- 437
1
vote
Accepted
kdm and ssh detecting different fully qualified domain name when using kerberos authentication
I believe I've worked out what was going on here. It looks like extra information being kept in the keytab file after the host was joined with/without . on the end of the domain and that was ...
1
vote
Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported
In their document:
MongoDB Enterprise supports authentication using a Kerberos
service.
Apparently their normal version doesn't support GSSAPI authentication mechanism,
so downloading the ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible