[22242] in Kerberos
Re: Integrated Windows Login: No principal in keytab matches desired
daemon@ATHENA.MIT.EDU (Markus Moeller)
Thu Aug 19 16:57:44 2004
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Wed, 18 Aug 2004 20:36:22 +0100
Message-ID: <4123afba$0$2568$ed2619ec@ptn-nntp-reader03.plus.net>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Timo,
the Apache server will never talk to ADS. The keytab contains all the
information to verify the tickets. Snoop the IE traffic as Jeffrey
suggested.
Regards
Markus
"Timo Fuchs" <fuechsle@cs.tu-berlin.de> wrote in message
news:cfvbl4$2a5$1@news.cs.tu-berlin.de...
>
> Hi Markus,
>
> Markus Moeller <huaraz@moeller.plus.com> wrote:
> > you might need to change the password after setting the account to
DES-ONLY
> > ( a ktpass option) and extract the keytab again.Microsoft usually uses
> > RC4-hmac keys and the des key will be only created after changing once
the
> > password (I think).
>
> I have double-checked the password mode and it was already set to
DES-ONLY.
> However, I have changed the user's password, extracted the keytab again
> and retried, unsuccessfully.
>
> Using ethereal I have found out that the Apache server does not even ask
> the ADS server when receiving a request and reading the error message
> ("No principle in keytab matches desired name") again I conclude that
> the service principle name the Internet Explorer acquired differs from
> the one I have set up
(HTTP/grmpf.adstest.mydomain.de@ADSTEST.MYDOMAIN.DE).
>
> Ethereal also shows that the NTLMSSP data contains "Calling workstation
> domain: ADSTEST", which is in fact the NT4 domain name, but not the
> ADS domain name (adstest.mydomain.de).
>
> How can I find out which service principle name is acquired by the
> Internet Explorer?
>
> I assume that the above error message is thrown by the kerberos lib,
> is there any chance to get more information for that error message?
>
> Cheers,
> Timo
>
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
