I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012.
I generated keytabs files on WS2012 with kpass
command for each encryption type available on WS2012.
When I try to open a session with a user test@DOMAIN.COM
with kinit
, it works.
When I try to open a session with my HTTP/web.domain.com@DOMAIN.COM
, I get the message:
kvno HTTP/web.domain.com@DOMAIN.COM
kvno: KDC has no support for encryption type while getting credentials for HTTP/web.domain.com@DOMAIN.COM
Also, when I check encryption used for test@DOMAIN.COM
, I have:
root@SERVER:~# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: test@DOMAIN.COM
Valid starting Expires Service principal
03/04/2015 12:48:21 03/04/2015 22:48:17 krbtgt/DOMAIN.COM@DOMAIN.COM
renew until 04/04/2015 12:48:21, Etype (skey, tkt): arcfour-hmac, arcfour-hmac
I tried to customize my /etc/krb5.conf
with:
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
And by using the keytab file encrypted with arcfour-hmac
without success.
I don't understand how to change encryption type used to communicate, why it always wants arcfour-hmac and why when I give it arcfour-hmac encryption, nothing change...
How to be sure that /etc/krb5.conf changes are effective and how to make the Kerberos ticket generation work too?