Microsoft Active Directory kerberos returns unknown principal

Question

I m trying to authenticate the host for kbr5p nfs mount where Microsoft active directory is acting as the Kerberos server.

sudo kinit -k -t /etc/krb5.keytab host/ROBODAROBODA@EXAMPLE.COM
kinit: Client 'host/ROBODAROBODA@EXAMPLE.COM' not found in Kerberos database while getting initial credentials

But in Active directory the following commands works

PS C:\Program Files\vmware\VMware OVF Tool> setspn -l ROBODAROBODA
Registered ServicePrincipalNames for CN=ROBODAROBODA,CN=Computers,DC=example,DC=com:
        host/ROBODAROBODA@EXAMPLE.COM
        HOST/robodaroboda.example.com
        HOST/ROBODAROBODA

In the packet trace, unknown principal error is observed. Request:

    Kerberos AS-REQ
        Record Mark: 202 bytes
            0... .... .... .... .... .... .... .... = Reserved: Not set
            .000 0000 0000 0000 0000 0000 1100 1010 = Record Length: 202
        Pvno: 5
        MSG Type: AS-REQ (10)
        padata: Unknown:149
            Type: Unknown (149)
                Value: <MISSING>
        KDC_REQ_BODY
            Padding: 0
            KDCOptions: 00000010 (Renewable OK)
                .0.. .... .... .... .... .... .... .... = Forwardable: Do NOT use forwardable tickets
                ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
                ...0 .... .... .... .... .... .... .... = Proxiable: Do NOT use proxiable tickets
                .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
                .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
                .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
                .... .... 0... .... .... .... .... .... = Renewable: This ticket is NOT renewable
                .... .... ...0 .... .... .... .... .... = Opt HW Auth: False
                .... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
                .... .... .... ...0 .... .... .... .... = Canonicalize: This is NOT a canonicalized ticket request
                .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
                .... .... .... .... .... .... ...1 .... = Renewable OK: We accept RENEWED tickets
                .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt using the skey
                .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
                .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
 Client Name (Principal): host/ROBODAROBODA
            Name-type: Principal (1)
            Name: host
            Name: ROBODAROBODA
            Server Name (Service and Instance): krbtgt/EXAMPLE.COM
                Name-type: Service and Instance (2)
                Name: krbtgt
                Name: EXAMPLE.COM
            till: 2020-04-05 18:37:06 (UTC)
            Nonce: 407713677
            Encryption Types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des-cbc-md5-nt 19 des3-cbc-sha1 rc4-hmac 25 26
                Encryption type: aes256-cts-hmac-sha1-96 (18)
                Encryption type: aes128-cts-hmac-sha1-96 (17)
                Encryption type: des-cbc-md5-nt (20)
                Encryption type: Unknown (19)
                Encryption type: des3-cbc-sha1 (16)
                Encryption type: rc4-hmac (23)
                Encryption type: Unknown (25)
                Encryption type: Unknown (26)

Response:

Kerberos KRB-ERROR
    Record Mark: 112 bytes
        0... .... .... .... .... .... .... .... = Reserved: Not set
        .000 0000 0000 0000 0000 0000 0111 0000 = Record Length: 112
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    stime: 2020-04-04 18:37:06 (UTC)
    susec: 931508
    error_code: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN (6)
    Realm: EXAMPLE.COM
    Server Name (Service and Instance): krbtgt/EXAMPLE.COM
        Name-type: Service and Instance (2)
        Name: krbtgt
        Name: EXAMPLE.COM

Can anyone please help me understand why I am seeing the unknown principal error?

Active Directory doesn't support client authentication using the service principal name. You need to use the UPN or sAMAccountName. — Steve, Apr 06 '20 at 19:53

score 0 · Accepted Answer · answered Apr 07 '20 at 06:40

0

The problem after adding host/ROBODAROBODA@EXAMPLE.COM to UserPrincipalName attribute for the machine account. The kinit is working.

answered Apr 07 '20 at 06:40

suresh

231
1
3
9

2

if you can't mark Steve's comment as answer, shouldn't you at least up vote it? It seems you took a hint from his comment – strongline Apr 07 '20 at 12:50

Microsoft Active Directory kerberos returns unknown principal

1 Answers1