[23235] in Kerberos
Re: Kerberos and Apache Virtual Hosted Websites
daemon@ATHENA.MIT.EDU (Donn Cave)
Fri Jan 21 12:46:37 2005
From: Donn Cave <donn@u.washington.edu>
Date: Fri, 21 Jan 2005 09:39:31 -0800
Message-ID: <donn-B9A7DD.09393121012005@gnus01.u.washington.edu>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
In article <1105723992.473938.247700@z14g2000cwz.googlegroups.com>,
"Scott Moseman" <scmoseman@gmail.com> wrote:
...
> When I attempt to access the website, vhost.domain.com,
> I get this error message in the Apache error logs:
>
> gss_acquire_cred() failed: Miscellaneous failure
> (No principal in keytab matches desired name)
>
> How can I further trouble shoot this Kerberos problem?
> When I use kerbtray on my PC, it shows the correct name
> for the Kerberos ticket (vhost.domain.com). Any help?
The way it looks to me, you have a fairly good case
from your troubleshooting so far. Someone now needs
to look at the code. This gss_acquire_cred() gets the
service principal name from its caller, so you can
start there, where the module calls gss_acquire_cred
with the wrong principal name, and see how that happened.
I don't know anything about it, but I would guess there
may be two ways to get it right. Either propagate this
information from whatever configuration option initially
determines the virtual host, or dig it up via getsockname()
on the service port socket. Instead they probably did
the easiest thing and used gethostname().
Donn Cave, donn@u.washington.edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
