[24506] in Kerberos
RC4-HMAC-MD5 with Apache2/mod_auth_kerb and ActiveDirectory -
daemon@ATHENA.MIT.EDU (Jellbauer Jakob)
Thu Aug 25 07:45:41 2005
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Thu, 25 Aug 2005 13:43:53 +0200
Message-ID: <67303F7C52F03642A25DF2F8C43177C4011D86E1@DEMUC-CLU2-EX1.interhyp-intern.de>
From: "Jellbauer Jakob" <jakob.jellbauer@interhyp.de>
To: <kerberos@mit.edu>
Content-Transfer-Encoding: 8bit
Errors-To: kerberos-bounces@mit.edu
hello list,
i´ve problems getting this combination , RC4-HMAC-MD5 with Apache2/mod_auth_kerb and ActiveDirectory, to work.
my way:
- i´ve created a new user on a 2003 Domaincontroller
- used the (2003) ktpass tool to create the usermapping
- merged it with the existing keytab file with only "DES cbc mode with RSA-MD5" Principals
now i can get a ticket trough:
>kinit -S HTTP/myserver.mydomain-websrvdmz.de
>klist -e
Ticket cache: FILE:/tmp/krb5cc_6024
Default principal: HTTP/myserver.mydomain-websrvdmz.de@INTERHYP.DE
Valid starting Expires Service principal
08/25/05 13:13:46 08/25/05 23:13:50 krbtgt/INTERHYP.DE@INTERHYP.DE
renew until 08/26/05 13:13:46, Etype (skey, tkt): ArcFour with HMAC/md5, ArcFour with HMAC/md5
but when i try to make a SSO via Internet Explorer i get this in the apache errorlog:
... gss_accept_sec_context() failed: Miscellaneous failure (Decrypt integrity check failed) ...
... failed to verify krb5 credentials: Decrypt integrity check failed ...
i have purged my tickets already and i dont have any enctypes specified in my krb5.conf
in general , is it possible to get this combination to work?
greetings and thanks
jakob
-
Jakob Jellbauer
Network & System Engineer
Information Technology
Interhyp AG | Parkstadt Schwabing Marcel-Breuer-Str. 18 80807 München
Telefon: 089-76 77 21 47 | Telefax: 089-76 77 251 47 | Mobil: 0151-16 70 19 16
mailto:jakob.jellbauer@interhyp.de | www.interhyp.de
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
