I'm trying to Kerberize an Apache-server, and allow the created server principal to sign on to the Active Directory. I've followed one of the numerous tutorials available online, and it seems to work fine. I'm on the Linux side of the project, and Corporate IT is on the Windows side.
IT has provided me with a service account and a service principal for it. In this example, I'll refer to it as HTTP/mysite.mycorp.com@MYCORP.COM. They have provided me with a keytab file for said principal, which involves running a tool called ktpass.exe on the AD server.
I've verified that the KVNOs of the AD/KDC and the keytab file match. All is well.
There is a proper DNS A-record for the hostname, and a proper PTR record for the IP. Both servers are in time sync.
I'm able to request a ticket from the AD/KDC for the above mentioned service principal with the issued keytab file, like this:
kinit -k -t http.keytab HTTP/mysite.mycorp.com@MYCORP.COM
This works. I obtain a ticket, and I'm able to use this ticket for things like querying the AD/LDAP directory. The keytab also works great for running a Single Signon Apache site, which is partly the goal of this exercise.
Half an hour passes.
Attempts to log on with the above kinit command now fails with this message:
Client not found in Kerberos database
I'm unable to authenticate as the service principal, much as if the principal was deleted on the AD server.
Now it gets weird, at least for me:
By request, the AD administrator runs the ktpass.exe tool again, building a fresh keytab file for my service. The KVNO (Key Version Number) is incremented on the server, causing our Apache test server to stop validating Kerberos single signon. This is expected with my present configuration. What surprised all of us, was that now the kinit command worked again. We bought ourselves another half hour, and then it stopped working again.
Our IT department is at a loss here, and they're speculating that this is a problem with the AD server itself. I'm thinking it's configuration, but according to them, there are no half hour limits anywhere in their setup.
I've followed http://www.grolmsnet.de/kerbtut/ (see section 7) but the method seems to be the same in all the documentation I've found. I haven't found any reference to time limits on service principals.
EDIT: This seems to be a replication issue. Although no errors are reported in the replication process, the SPN value of the service account is changed (reverted?) from "HTTP/mysite.mycorp.com@MYCORP.COM" to "name-of-service-account@mycorp.com" after 30 minutes.