[29896] in Kerberos
preauth failed KRB5KDC_ERR_CLIENT_NAME_MISMATCH
daemon@ATHENA.MIT.EDU (naveen.bn)
Thu May 29 05:51:43 2008
Message-ID: <483E7D29.4030907@globaledgesoft.com>
Date: Thu, 29 May 2008 09:53:45 +0000
From: "naveen.bn" <naveen.bn@globaledgesoft.com>
MIME-Version: 1.0
To: Kevin Coffman <kwc@umich.edu>, kerberos <Kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi kevin,
Thank you, I took the help of the example file that you had sent me and generated the certificates in pem
formate . Now the AS_REQ is sent with the patype field with PA-DAS (16), I am getting the error
KRB5KDC_ERR_CLIENT_NAME_MISMATCH
this is what i am doing and my config files are shown.
kinit -X X509_user_identity=FILE:/client/other/naveen.pem,/client/other/naveen.key naveen
kinit(v5): Client name mismatch while getting initial credentials
/************** krb5 .conf ************/
[libdefaults]
krb4_config = /usr/kerberos/lib/krb.conf
krb4_realms = /usr/kerberos/lib/krb.realms
default_realm = globaledgesoft.com
[realms]
globaledgesoft.com = {
kdc = 172.16.8.141
admin_server = 172.16.8.141
pkinit_anchors = DIR:/ca/other
pkinit_require_eku = true
pkinit_require_krbtgt_otherName = false
pkinit_require_hostname_match = flase
}
[domain_realm]
.globaledgesoft.com = globaledgesoft.com
globaledgesoft.com = globaledgesoft.com
[logging]
kdc=FILE:/var/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
/********* end of krb5.conf ***************/
/********** kdc.conf ****************/
[kdcdefaults]
default_realm = globaledgesoft.com
kdc_ports = 750,88
[realms]
globaledgesoft.com = {
database_name = /usr/local/var/krb5kdc/principal
admin_keytab = FILE:/usr/local/var/krb5kdc/kadm5.keytab
acl_file = /usr/local/var/krb5kdc/kadm5.acl
key_stash_file = /usr/local/var/krb5kdc/.k5._kerberos._udp.globaledgesoft.com
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
pkinit_anchors = DIR:/ca/other
pkinit_identity = FILE:/kdc/other/server.pem,/kdc/other/server.key
# pkinit_allow_upn = true
# pkinit_eku_checking = none
pkinit_revoke = DIR:/ca/other
}
/********* end of kdc.conf ***************/
Thank you
with regards
naveen
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
