[33477] in Kerberos
Kerberos Issue
daemon@ATHENA.MIT.EDU (Carano, Riccardo (EBV))
Tue Jun 14 09:30:30 2011
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Tue, 14 Jun 2011 15:30:20 +0200
Message-ID: <F6F05AFBEEF92A48A939030BD7460B5C0133C988@EXCHHQ04.msg.avnet.eu>
In-Reply-To: <4c80acfa-7f3f-4c39-b482-750733720be4@dr5g2000vbb.googlegroups.com>
From: "Carano, Riccardo (EBV)" <Riccardo.Carano@ebv.com>
To: <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi,
currently I have Kerberos running (MIT).
When I'm trying this command in the console:
kinit user@server
I become a prompt with my password and this works! But when I'm trying this with my IE 8 (on XP) this error occures:
kerb_authenticate_user entered with user (NULL) and auth_type
I am at my wit's end! I hope you can help me
#######################
My error-log:
------------
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1628): [client xxx.xx.xxx.xx] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1628): [client xxx.xx.xxx.xx] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1240): [client xxx.xx.xxx.xx] Acquiring creds for HTTP@MYSERVER
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1385): [client xxx.xx.xxx.xx] Verifying client data using KRB5 GSS-API
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1401): [client xxx.xx.xxx.xx] Client didn't delegate us their credential
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1429): [client xxx.xx.xxx.xx] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.
[Tue Jun 14 14:52:38 2011] [debug] src/mod_auth_kerb.c(1101): [client xxx.xx.xxx.xx] GSS-API major_status:00090000, minor_status:00000000
[Tue Jun 14 14:52:38 2011] [error] [client xxx.xx.xxx.xx] gss_accept_sec_context() failed: Invalid token was supplied (, No error)
This is my Envirement:
----------------------
- Windows Server 2008 RC2 with the Active Director
- Linux version 2.6.18-92.el5 (brewbuilder@ls20-bc2-13.build.redhat.com) (gcc version 4.1.2 20071124 (Red Hat 4.1.2-41))
Kerberos Versions:
------------------
krb5-devel-1.6.1-25.el5
krb5-libs-1.6.1-25.el5
krb5-workstation-1.6.1-25.el5
pam_krb5-2.2.14-1
krb5-libs-1.6.1-25.el5
pam_krb5-2.2.14-1
krb5-devel-1.6.1-25.el5
My httpd.conf File:
------------------
....
<Directory "/var/www/html/BUSINESS/SSO">
AuthType Kerberos
AuthName "Kerberos Login"
KrbServiceName HTTP
KrbMethodNegotiate on
KrbMethodK5Passwd on
KrbAuthoritative on
KrbAuthRealms MYSERVER
KrbVerifyKDC off
Krb5Keytab /etc/httpd/conf/mykeytab.keytab
KrbSaveCredentials on
require valid-user
</Directory>
...
My krb5.conf File:
------------------
[logging]
default = FILE:/var/www/logs/krb5libs.log
kdc = FILE:/var/www/logs/krb5kdc.log
admin_server = FILE:/var/www/logs/kadmind.log
[libdefaults]
default_realm = MYSERVER
forwardable = true
proxiable = true
default_keytab_name= FILE:/etc/httpd/conf/mykeytab.keytab
[realms]
MYSERVER = {
kdc = test01. MYSERVER
kdc = test02.MYSERVER
master_kdc = MYSERVER
default_domain = MYSERVER
}
[domain_realm]
name = MYSERVER
[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = true
}
Thanks for your help
Best regards
Riccardo
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
