From owner-freebsd-questions@freebsd.org Thu Jul 23 17:59:25 2015 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4F93D9A9E60 for ; Thu, 23 Jul 2015 17:59:25 +0000 (UTC) (envelope-from ggroth@gregs-garage.com) Received: from mail.gregs-garage.com (99-158-164-253.uvs.cicril.sbcglobal.net [99.158.164.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 238AD1958 for ; Thu, 23 Jul 2015 17:59:24 +0000 (UTC) (envelope-from ggroth@gregs-garage.com) Received: from mail.gregs-garage.com (localhost [127.0.0.1]) by mail.gregs-garage.com (8.15.2/8.15.1) with ESMTP id t6NHxFli023692 for ; Thu, 23 Jul 2015 12:59:16 -0500 (CDT) (envelope-from ggroth@gregs-garage.com) Received: (from www@localhost) by mail.gregs-garage.com (8.15.2/8.15.1/Submit) id t6NHxFtj023691; Thu, 23 Jul 2015 12:59:15 -0500 (CDT) (envelope-from ggroth@gregs-garage.com) X-Authentication-Warning: mail.gregs-garage.com: www set sender to ggroth@gregs-garage.com using -f To: freebsd-questions@freebsd.org Subject: Re: Kerberos X-PHP-Originating-Script: 0:rcube.php MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 23 Jul 2015 12:59:15 -0500 From: Greg Groth In-Reply-To: <206c1ceb58b14e4ce86fb2a27be3907c@mail.gregs-garage.com> References: <75d664eeb361264e9b4560a89b1a32bf@mail.gregs-garage.com> <1383995814.37100404.1437030764957.JavaMail.zimbra@logitravel.com> <4582000dcfad2dc26ca4076d2024f23f@mail.gregs-garage.com> <1705342318.38348913.1437127498114.JavaMail.zimbra@logitravel.com> <206c1ceb58b14e4ce86fb2a27be3907c@mail.gregs-garage.com> Message-ID: <8377d493cb4b4aafab251589c7ac20bb@mail.gregs-garage.com> X-Sender: ggroth@gregs-garage.com User-Agent: Roundcube Webmail/1.1.2 X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail.gregs-garage.com X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2015 17:59:25 -0000 On 2015-07-21 08:42, Greg Groth wrote: > On 2015-07-17 05:04, Raimund Sacherer wrote: >> Hello Greg, >> >> on a first glance I can't see anything really out of order, if it >> helps, I use(d) this pages to setup kerberos and apache auth: >> http://www.grolmsnet.de/kerbtut/ >> http://blog.scottlowe.org/2006/08/10/kerberos-based-sso-with-apache/ >> >> The account you create for the service principal has to be a user >> account, it does not work with a machine account. >> >> If you authenticate without the key tab, just a user from the ad >> (create a user and test a kinit user@EXAMPLE.COM, later klist). Check >> if a simple user authentication works in the first place. >> >> Hope that this will help you in any way, >> >> Best >> Ray > > Many thanks for replying. > > I have to be doing something wrong with the ktpass command on the DC, > but for the life of me, I'm not sure what the issue is. > > I created a user named aduser, and can obtain a ticket by using kinit > aduser@EXAMPLE.COM from the BSD server, but using kinit -k aduser or > kinit -t /etc/krb5.keytab aduser always returns "kinit: > krb5_get_init_creds: Already tried ENC-TS-info, looping" > > This is what I've been trying on the DC to create a keytab file: > > ktpass /princ HTTP/atbsd.example.com@EXAMPLE.COM /mapuser > aduser@EXAMPLE.COM /pass P@$$word /crypto RC4-HMAC-NT /ptype > RB5_NT_PRINCIPAL /out C:\temp\krb5.keytab > > Once I run the command on the DC, the userPrincipalName for aduser > gets replaced with "HTTP/atbsd.example.com". Does the > servicePrincipalName need to be set to the same as well? I've tried > it with the UPN sert, the SPN set, and both the UPN & SPN set to > "HTTP/atbsd.example.com", but it doesn't seem to make a difference. > > When I run ktutil list --keys on the BSD box, I get: > Vno Type Principal > Key Aliases > 32 arcfour-hmac-md5 HTTP/atbsd.example.com@EXAMPLE.COM > XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX > > I thought I read somewhere that the DC is looking for a match on the > UPN, which appears to be identical. The only other troubleshooting > I've been able to do is to use a packet sniffer, and it appears that > the DC is waiting for a password which is never supplied? > > I have not installed the krb5 port, and have been using whatever > version is installed in the base distro (heimdal?). I noted on the > TechNet page at MS that ktpass is based on the MIT version of > Kerberos. Do I need the krb5 port in place of whatever version is > included in the base distro to get this to work? > > Best regards, > > Greg Groth Making progress. Installed the MIT Kerberos port, which has better error reporting back to stdout (IMHO) that helped me track down the issue. Apparently running "kinit -k" defaults the service in the principal name of the request to "host". I had created my keytab for a service of "HTTP", which was why "kinit -k" was failing, where "kinit -k HTTP/atbsd.example.com" worked like a charm. I then went back and recreated the keytab on the windows box using "/princ host/atbsd.example.com@EXAMPLE.COM" the resultant keytab, once installed, would work with just "kinit -k". I'm sure these differentiations are noted in the documentation that has been provided, but somewhere I must have assumed that kinit was reading the service of the principal name in the keytab file, and creating a request based on the values provided. Many thanks again to all who gave their assistance. Best regards, Greg Groth