[22270] in Kerberos
Error using GSS-API on Solaris 9 Platform
daemon@ATHENA.MIT.EDU (Ahluwalia, Ish)
Wed Aug 25 16:16:00 2004
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Wed, 25 Aug 2004 14:38:05 -0400
Message-ID: <A3863F3136CBC546A40A61BA9CBA9D93A34A6C@sonusmail03.sonusnet.com>
From: "Ahluwalia, Ish" <iahluwalia@sonusnet.com>
To: <kerberos@mit.edu>
Content-Transfer-Encoding: 8bit
Errors-To: kerberos-bounces@mit.edu
Hi Wyllys:
Thanks very much for the response. Below please find my response. Thanks in advance for the help.
>>>>>>>>>>>>>>>>>>>You wrote<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
It sounds like your server process does not have access to its credentials.
Is the server running with permissions to read the keytab file that
contains its keys?
If you are using a standard service like "host/foo.bar.com", then its
probably in the
system keytab (/etc/krb5/krb5.keytab) and your process will need root
privilege to read
that file.
If your service principal keys are not in a keytab, they should be added
using kadmin.
kadmin > ktadd host/foo.bar.com
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Yes, I'm planning to be a service(running on application server different from KDC) with "service/<FQDN>@REALM" name. It is our own service, nothing like telnet or ftp. Notheless, clients have to authenticate with KDC and then they communicate with my service which handles all the AP-REQ and AP-REP.
I thinnk, you are right that I don't have a keytab entry. Infact, I searched the whole system and didn't even find a file called "krb5.keytab". Is it supposed to be there by default or does it gets created as part of "ktadd" command?
Also, there is a bit of an issue - I'm not using SUN Solaris distribution KDC. It is some other company which does not have interface for KADMIN command, which I'm assuming communicates with KADMIND process running on KDC and creates the service entries. Assuming if I figure out how to add a service on the KDC with a shared key (which needs be the same key at application server), is there a way to create a key tab entry on my service host without using kadmin? KADMIN fails for me since the there is no KADMIND running anywhere on my KDC(it doesn't support it). Is there a way to create a keytab file and other stuff that I may need to have a successful generation of TGS's with my service's master key which is also on the KDC.
I greatly appreciate your help.
Thanks.
Ish....
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
