[33764] in Kerberos
Kerberos Authentication with Windows AD
daemon@ATHENA.MIT.EDU (Ranjith Murugan)
Mon Aug 22 10:52:11 2011
From: "Ranjith Murugan" <muruganr@vmware.com>
To: <kerberos@mit.edu>
In-Reply-To: <mailman.0.1314023725.2690.kerberos@mit.edu>
Date: Mon, 22 Aug 2011 07:52:02 -0700 (PDT)
Message-ID: <0d5501cc60db$0d3b0da0$27b128e0$@com>
MIME-Version: 1.0
Content-Language: en-us
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi All,
I am a Newbie in Kerberos authentication, Currently trying to setup an
Kerberos server to Authenticate against a Windows AD.
Environment:
Ubuntu 10.10 (Kerberos Server)
Windows 2003 R2 (Active Directory)
For Explanation: Kerberos Server(s1.int), Windows Ad(s2.int)
The Server seems to be working individually, I have created a trust
relationship between S1.int and S2.int. Also create a user in S2.int and
Mapped the user to a user on S1.int. Now When I trying login to a machine
with the Kerberos User, I get an error "NEEDED_PREAUTH". Could someone let
me know the reason for this error? Note: Checked Click sync. DNS server
working fine.
Error Msg from the Log file:
Aug 22 15:09:32 lhr-qa12 krb5kdc[3482](info): AS_REQ (7 etypes {23 -133
-128 3 1 24 -135}) <IP address>: NEEDED_PREAUTH: admin@S1.INT for
krbtgt/S1.INT@S2.INT, Additional pre-authentication required
Aug 22 15:09:32 lhr-qa12 krb5kdc[3482](info): AS_REQ (2 etypes {3 1})
10.20.221.180: ISSUE: authtime 1314022172, etypes {rep=3 tkt=1 ses=1},
admin@S1.INT for krbtgt/S1.INT@S1.INT
Aug 22 15:09:32 lhr-qa12 krb5kdc[3482](info): TGS_REQ (7 etypes {23 -133
-128 3 1 24 -135}) <IP address>: ISSUE: authtime 1314022172, etypes {rep=1
tkt=1 ses=1}, admin@S1.INT for krbtgt/S2.INT@S1.INT
Aug 22 15:09:32 lhr-qa12 krb5kdc[3482](info): TGS_REQ (7 etypes {23 -133
-128 3 1 24 -135}) <IP address>: ISSUE: authtime 1314022172, etypes {rep=1
tkt=16 ses=1}, admin@S1.INT for host/test.S2.int@S1.INT
I have used the allow_weak_crypto = true in /etc/krb5.conf, If this is
removed from the conf file, I get and error in kinit as well
Error Message:
kinit: KDC has no support for encryption type while getting initial
credential
Regards,
Ranjith.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
