[23721] in Kerberos
Re: SSPI/GSS-API : mech_dh: Invalid or unknown error
daemon@ATHENA.MIT.EDU (Wyllys Ingersoll)
Thu Apr 14 10:44:25 2005
Message-ID: <425E7E3A.50809@sun.com>
Date: Thu, 14 Apr 2005 10:29:14 -0400
From: Wyllys Ingersoll <wyllys.ingersoll@sun.com>
MIME-Version: 1.0
To: Jacques Lebastard <jacques.lebastard@evidian.com>
In-Reply-To: <425c0d44$0$1970$626a14ce@news.free.fr>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Jacques Lebastard wrote:
> The Kerberos OID is specified when invoking gss_acquire_cred
> within=20 GSS-API server.
OK, but is the gss server able to actually acquire these creds? Usually,
the server gets its credentials from a keytab file (/etc/krb5/krb5.keytab
on Solaris 9).
>
> > To make the system default to using the Kerberos mech, adjust the
> > lines in /etc/gss/mech file so that kerberos_v5 mechanism appears
> > before the mech_dh mechanisms.
>
>
> Changing the entries in the mech file and restarting the GSS-API
> server=20 did not solve the problem. Would a server reboot make any
> difference ?
No, rebooting Solaris will probably not help.
What is the gssapi client requesting in it's initial token?
You might try analyzing the token that the gss-server is receiving
to make sure it is getting an initial token that requests the Kerberos
OID.
-Wyllys
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
