Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1136 questions
0
votes
1 answer

Strange FreeRadius and Kerberos issue

Currently I am trying to get my FreeRadius server to talk to my FreeIPA server and through some Googling I discovered I need to have FreeRadius talk to Kerberos in order to do user look ups. So I make a Krb5 file located at…
Adam
  • 3
  • 1
0
votes
1 answer

add_principal: DN is out of the realm subtree while creating "principal@REALM.COM"

I'm trying to create a principal linked to an ldap object according to the MIT documentation. This is my ldap structure:LDAP STRUCTURE Once I've created the UID object in the Ldap ou=people,dc=domain,dc=com, (cn=nano,dc=people,dc=domain,dc=com),…
DRI
  • 23
  • 4
0
votes
1 answer

Login limited to a LDAP group using SSD and Kerberos

I'm trying to learn how PAM, SSSD and nsswitch works. I think these services are so useful although all the documentation over there is a little bit outdated and "esoteric". So I'm here asking for some help. This is how I configured my…
DRI
  • 23
  • 4
0
votes
1 answer

Access authorization does not work well after replacing a NAS using Kerberos on a Windows server 2012 R2

Environment: A SOHO network under an Active Directory domain controller on a Windows Server 2012 R2. A NAS with access authorization via Kerberos on the domain controller. The DNS server is on the domain controller. Due to hardware problems, I…
Taiki Bessho
  • 159
  • 1
  • 1
  • 8
0
votes
1 answer

OpenLDAP ACL's in SUSE, Kerberos configuration

I'm implementing Kerberos with OpenLDAP manually and according to the MIT Documentation, I've to set manually this ACL: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read # Provide access to the realm…
DG DM
  • 25
  • 5
0
votes
0 answers

Kerberos issue through RRAS VPN

I set up a Windows VPN infrastructure with RRAS NPS CA roles. A user certificate is deployed on each laptop and are joined to a single domain. VPN use IKEv2. VPN is UP, communications are working to our internals networks, except applications that…
ThomasKel
  • 1
  • 1
0
votes
1 answer

Linux root using domain users kerberos tickets

We’ve just migrated a set of Centos6/7 hosts from pure OpenLDAP based authentication to IPA and Kerberos. What surprised us is that a local root user on an IPA enrolled host can use ‘su’ to become an IPA user. If the chosen IPA user is currently…
Fenster34
  • 173
  • 6
0
votes
2 answers

Kerberos client authentication for a systemd service

I am running a webserver (in this case airflow) on an Ubuntu 18.04 machine which needs to access a SQL Server database which is on the domain/AD. Q: How can I use Kerberos authentication in a systemd service to access a MSSQL database on the…
telemark
  • 3
  • 1
  • 3
0
votes
2 answers

Give linux service user access to Kerberos NFS share

I am running a NFSv4 server and a client on two raspbian buster distributions. I use Kerberos to secure the NFS share. On the NFS client, I run the gitea service with git user, which is started on boot. I would like to store the git repositories on…
ThinkB4
  • 3
  • 1
0
votes
1 answer

Kerberos error after reinstall

After a reinstall of Kerberos we're now having issues authenticating from Windows to this CentOS server. Running kadmin returns the following error; Authenticating as principal '' with password. kadmin: Client 'domain/user@domain.com' not found in…
c4154882
  • 5
  • 2
0
votes
1 answer

nginx - prevent caching authorization info

I am using nginx as reverse proxy for my asp.net core web application. I am using spnego module for nginx for supporting of windows integrated authentication. It is works, but if user enters incorrect credentials, credentials is not prompted again?…
DarkGenius
  • 101
  • 1
0
votes
1 answer

Authenticate with SSSD in multiple domains in Ubuntu 18.04

I was able to successfully follow this document to get sssd to work with my Active Directory domain, but I was sad to learn that sssd does not support authenticating with external trusts. I read that you can actually join multiple domains with the…
tacos_tacos_tacos
  • 3,220
  • 16
  • 58
  • 97
0
votes
1 answer

Kerberos: Wrong principal / realm for ssh-server login on a server in a subdomain

I currently try so setup the kerberos auth on a server living in a sub domain "sub.example.com". The KDC manages EXAMPLE.COM together with a dns server which manages 'example.com'. Due to organizational reasons we have a subdomain 'sub.example.com'…
M.K. aka Grisu
  • 141
  • 1
  • 8
0
votes
1 answer

InitializeSecurityContext failed with SEC_E_DOWNGRADE_DETECTED

I have a question. There's a client and server apps written in Java. Java client connects to server using kerberos authentication, the client need to retrieve a token from the server - it uses Waffle library which uses JNA, which invokes…
wazz
  • 111
  • 1
0
votes
0 answers

SSO for ADFS works on some desktops, but does not on some others

We have a weird issue with SSO through ADFS 3 on Windows Server 2016. While some Windows 10 clients can successfully login in IE, some cannot. All Windows 10 clients are at the same patch level. The issue seems client based and not user based; User…
mokum
  • 23
  • 1
  • 4
1 2 3
…
75 76