[29477] in Kerberos
KRB5 error code 52 while getting initial credentials
daemon@ATHENA.MIT.EDU (sunilcnair)
Wed Mar 12 13:25:14 2008
Message-ID: <15998090.post@talk.nabble.com>
Date: Tue, 11 Mar 2008 22:15:53 -0700 (PDT)
From: sunilcnair <sunilcnair@hotmail.com>
To: kerberos@mit.edu
MIME-Version: 1.0
X-Nabble-From: sunilcnair@hotmail.com
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello all,
i am Sunil C. i have a domain named xx.com which has a KDC.i also have a domain co.yy where my server is. there is no KDC in it.
users are in xx.com domain.
but my servers are in (co.yy) domain.
i had set up a test scenario with a user and a server in domain (xx.com)since KDc was setup i got ticket and was able to authenticate well usingkerberos.
my issue is that all my production servers are in domain (co.yy) whichdoesnt have a KDC. i want to authenticate and use the server services inthat domain.setting up KDC is not feasible in both domains for me.
now i have done some configuration in krb5.conf file on my server(test.co.yy)
[domain_realm]xx.com = XX.COM.xx.com = XX.COMco.yy = XX.COM.co.yy = XX.COM
this shows that my domain co.yy which doesnnot have a KDC , i have mapped itto the realm XX.COM .
now i have some issues.
1) i tried to get a keytab from the KDC of XX.COM ( my server in co.yy)
> ktpass -princ HTTP/test.co.yy@XX.COM
2) i somehow managed to get a keytab .i copied into Apache folder and executed the command.
kinit -t /usr/local/apache/test03keytab HTTP/test.co.yy@XX.COMpassword: xxxx
error : kinit(v5) : KRB5 error code 52 while getting initial credentials
Please help me understand what is this erro.. is it some issue with domainmapping configuration in krb5.conf file? i am using kerberos 1.2.7 version.
Thanks
Sunil C
----------------------------
In article ,sunilcnair wrote:
> This is Sunil here, i am working on the cross domain authentication using> kerberos, i have> two domains(xx.com) and(co.yy), and i am in a dilemma as to install 2KDC> in> both the domains or is it sufficient for the kdc to be installed in only> one> single domain, and register the other domain as just the user of the> domain> in which the kdc is installed.Also I窶囘 like to avoid cross realms> scenario,because we should set up another KDC.(thats bit difficult)is> there> any other possibilities of using two domain for kerberos without having> KDC> on both the domains please do clear my doubt. Looking for an answer
Kerberos is basically indifferent to DNS domains, andone Kerberos "realm" can certainly serve many DNS domains.Application software may rely on DNS for realm information,though - configuration files may specify realm/domain maps,and Kerberos realm information can be published in specialDNS SRV and TXT records. If you have tried this and werenot able to make it work, check that the [domain_realm]section of your configuration file includes the new domain.
Donn Cave, donn@u.washington.edu
________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
-- View this message in context: http://www.nabble.com/KRB5-error-code-52-while-getting-initial-credentials-tp15998090p15998090.htmlSent from the Kerberos - General mailing list archive at Nabble.com.________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
