0

Virtual host has been configured with these options;

AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbAuthRealms EXAMPLE.COM
KrbAuthoritative On
KrbServiceName HTTP/something.example.com@EXAMPLE.COM
Krb5KeyTab /path/to/krb/site.keytab
require valid-user

The site.keytab is readable by apache and contains a valid principal;

root@pa2# klist -k /path/to/krb/site.keytab
Keytab name: FILE:/path/to/krb/site.keytab
KVNO Principal
---- --------------------------------------------------------------------------
  13 HTTP/something.example.com@EXAMPLE.COM (des-cbc-crc)
  13 HTTP/something.example.com@EXAMPLE.COM (des-cbc-md5)
  13 HTTP/something.example.com@EXAMPLE.COM (arcfour-hmac)
  13 HTTP/something.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
  13 HTTP/something.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96)
root@pa2# kvno -k /path/to/krb/site.keytab HTTP/something.example.com@EXAMPLE.COM
HTTP/something.example.com@EXAMPLE.COM: kvno = 13, keytab entry valid

But when I try to access the site, I get this error in the apache error log;

[Mon Mar 21 10:30:37.846616 2016] [auth_kerb:error] [pid 11217] [client ...:60195]
gss_accept_sec_context() failed: Unspecified GSS failure.
Minor code may provide more information
(, Cannot find key for HTTP/something.example.com@EXAMPLE.COM kvno 5 in keytab)

The current kvno is indeed not 5.

Morten Nilsen
  • 278
  • 5
  • 15
  • It turns out I had the wrong IP for the vhost, but I still get an error, updating question with new log message. – Morten Nilsen Mar 21 '16 at 09:32
  • If I create a new keytab with just a arcfour-hmac or a aes128-cts-hmac-sha1-96, I get "no key table entry found for HTTP/...@EXAMPLE.COM", but if I create one with ALL, I get the kvno 5 in the log above. – Morten Nilsen Mar 21 '16 at 09:58
  • The user principal in AD does not have a `msDS-KeyVersionNumber` attribute. – Morten Nilsen Mar 21 '16 at 09:59

1 Answers1

1

Issuing klist purge on the client windows computer resolved the kvno issue.

Morten Nilsen
  • 278
  • 5
  • 15