Discussing problems related to the Kerberos authentication module for Apache

Steinar Bang | 1 Jul 2004 09:17

Picon

Picon

Re: [modauthkerb] No principal in keytab matches desired name

>>>>> Daniel Kouril <kouril <at> ics.muni.cz>:

> Using the ktutil command for looking at the keytab is certainly more
> convenient and gives more detailed information (e.g. enctypes of the
> keys stored there).

OK.  Thanx!  (Note BTW that the problem has been fixed.  The problem
was a wrong ServerName setting in the httpd.conf file)

>> I've also verified that mod_auth_kerb actually is reading the keytab,
>> by removing it and trying to access the server.

> Actualy, what's removed by the module?

Nothing was removed by the module.  I manually removed the keytab, to
see if it made any difference in the module's behaviour.  

It did, as you can see below:

>> What was written to
>> the apache error_log then, was:
>> 	gss_acquire_cred() failed: Miscellaneous failure (No such file or directory)

> This error indicates that the module tryies to read a non-existing file.

Well, yes...

> Please check the Krb5Keytab directive.

>> Does it look like my keytab doesn't have the right principal in it?

(Continue reading)

Hartmaier Alexander | 1 Jul 2004 19:11

Picon

AW: [modauthkerb] RE: Error: gss_accept_sec_context() failed

Hi again!

Now I created a new service principal file with the real fqdn.
When I access the page a get the following error in the server log:

gss_acquire_cred() failed: Miscellaneous failure (No principal in keytab matches desired name)

The problem seems that the dns name of the virtual host and the real one are different!

kerbtray.exe shows me the ticket so the use of the real fqdn seems the right way.

What can be done to link the real fqdn (which is in the service principal file) and the virtual one???

THX Alex

-----Ursprüngliche Nachricht-----
Von: Jari Ahonen [mailto:jah <at> progress.com] 
Gesendet: Dienstag, 29. Juni 2004 13:36
An: Hartmaier Alexander; Daniel Kouril
Cc: modauthkerb-help <at> lists.sourceforge.net
Betreff: RE: [modauthkerb] RE: Error: gss_accept_sec_context() failed

> I think I know what the problem is:
> The fqdn of my webserver is nac1.mon.dsh.at. The virtualhost 
> is firewall.mon.dsh.at.
> I used firewall.mon.dsh.at for creating the service principal file.
> To avoid the 'matching principal not found' message I edited 
> my /etc/hosts file.
> Should the service principal file always use the real fqdn?

(Continue reading)

Douglas E. Engert | 1 Jul 2004 20:25

Re: AW: [modauthkerb] RE: Error: gss_accept_sec_context() failed


Hartmaier Alexander wrote:
> 
> Hi again!
> 
> Now I created a new service principal file with the real fqdn.
> When I access the page a get the following error in the server log:
> 
> gss_acquire_cred() failed: Miscellaneous failure (No principal in keytab matches desired name)
> 
> The problem seems that the dns name of the virtual host and the real one are different!
> 
> kerbtray.exe shows me the ticket so the use of the real fqdn seems the right way.
> 
> What can be done to link the real fqdn (which is in the service principal file) and the virtual one???

It looks like mod_auth_kerb.c is passing ap_get_server_name(r) as the server name
to gss_acquire_creds. So can you add a principal for the virtual host to the keytab?
The point is the principal name has to match what the client is expecting it to be,
not to match the host name of the real host. 

> 
> THX Alex
> 
> -----Ursprüngliche Nachricht-----
> Von: Jari Ahonen [mailto:jah <at> progress.com]
> Gesendet: Dienstag, 29. Juni 2004 13:36
> An: Hartmaier Alexander; Daniel Kouril
> Cc: modauthkerb-help <at> lists.sourceforge.net
> Betreff: RE: [modauthkerb] RE: Error: gss_accept_sec_context() failed

(Continue reading)

Hartmaier Alexander | 2 Jul 2004 10:06

Picon

AW: [modauthkerb] RE: Error: gss_accept_sec_context() failed

Hi!

As you can see below I used the name of the virtualhost servername before and it didn't work!
The client doesn't get a ticket from the domain controller when using the virtual dns name (but the server
finds the right principal because the name matches as you wrote...).
What should I do now???

THX Alex

-----Ursprüngliche Nachricht-----
Von: Douglas E. Engert [mailto:deengert <at> anl.gov] 
Gesendet: Donnerstag, 1. Juli 2004 20:26
An: Hartmaier Alexander
Cc: Jari Ahonen; Daniel Kouril; modauthkerb-help <at> lists.sourceforge.net
Betreff: Re: AW: [modauthkerb] RE: Error: gss_accept_sec_context() failed

Hartmaier Alexander wrote:
> 
> Hi again!
> 
> Now I created a new service principal file with the real fqdn.
> When I access the page a get the following error in the server log:
> 
> gss_acquire_cred() failed: Miscellaneous failure (No principal in keytab matches desired name)
> 
> The problem seems that the dns name of the virtual host and the real one are different!
> 
> kerbtray.exe shows me the ticket so the use of the real fqdn seems the right way.
> 
> What can be done to link the real fqdn (which is in the service principal file) and the virtual one???

(Continue reading)

Daniel Kouril | 2 Jul 2004 10:30

Picon

Re: [modauthkerb] RE: Error: gss_accept_sec_context() failed

On Fri, Jul 02, 2004 at 10:06:41AM +0200, Hartmaier Alexander wrote:
> As you can see below I used the name of the virtualhost servername before
> and it didn't work!  The client doesn't get a ticket from the domain
> controller when using the virtual dns name (but the server finds the right
> principal because the name matches as you wrote...).

Could you please summarize what tickets does your browser receive when
accessing various virtualhosts and the FQDN (i.e. when these names are in the
URL inserted in the browser)?

Also please try using current CVS code, it contains a better (fixed 
logging of the server name looked for in the keytab.

--
Dan

-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com

Hartmaier Alexander | 2 Jul 2004 11:18

Picon

AW: [modauthkerb] RE: Error: gss_accept_sec_context() failed

Re!

real fqdn: nac1.mon.dsh.at
virtual host dn: firewall.mon.dsh.at

try #1:
- service principal with 'firewall.mon.dsh.at'
- NO ticket listed by kerbtray.exe (WinXP IE6.0 with all patches from windowsupdate...maybe that matters too)
- apache finds the service principal because the url string and the dns name in the service principal match
but client doesn't get a ticket from the dc and apache logs 'gss_accept_sec_context() failed: A token was
invalid (Token header is malformed or corrupt)'

try #2:
- service principal with 'nac1.mon.dsh.at'
- ticket 'HTTP/nac1.mon.dsh.at <at> INT.NEONET.AT is listed by kerbtray.exe
- apache doesn't find the service principal and logs 'gss_acquire_cred() failed: Miscellaneous failure
(No principal in keytab matches desired name)'

Is there a daily cvs snapshot for download available?
If no how do I get the latest cvs version?

Thanks, Alex

-----Ursprüngliche Nachricht-----
Von: Daniel Kouril [mailto:kouril <at> ics.muni.cz] 
Gesendet: Freitag, 2. Juli 2004 10:31
An: Hartmaier Alexander
Cc: Douglas E. Engert; Jari Ahonen; Daniel Kouril; modauthkerb-help <at> lists.sourceforge.net
Betreff: Re: [modauthkerb] RE: Error: gss_accept_sec_context() failed

(Continue reading)

Daniel Kouril | 2 Jul 2004 12:32

Picon

Re: [modauthkerb] RE: Error: gss_accept_sec_context() failed

On Fri, Jul 02, 2004 at 11:18:58AM +0200, Hartmaier Alexander wrote:
> try #1:
> - service principal with 'firewall.mon.dsh.at'
> - NO ticket listed by kerbtray.exe (WinXP IE6.0 with all patches from windowsupdate...maybe that
matters too)
> - apache finds the service principal because the url string and the dns name in the service principal match
but client doesn't get a ticket from the dc and apache logs 'gss_accept_sec_context() failed: A token was
invalid (Token header is malformed or corrupt)'

Seems that the IE isn't able to get a ticket for the service from the AD and
still sends a NTLM authenticator the the apache. Unfortunately I can't say
where the problem can be. Try checking some logs on the KDC and/or sniff
network communication between the workstation and KDC. Someone also advised
this Windows tool for debugging:
http://www.develop.com/kbrown/security/sample_sspibench.htm

> try #2:
> - service principal with 'nac1.mon.dsh.at'
> - ticket 'HTTP/nac1.mon.dsh.at <at> INT.NEONET.AT is listed by kerbtray.exe
> - apache doesn't find the service principal and logs 'gss_acquire_cred() failed: Miscellaneous
failure (No principal in keytab matches desired name)'

Compile the new module, turn on debugging in Apache and look at the log
files for the principal name that the module wants to use. And please let us
know the results.

> 
> Is there a daily cvs snapshot for download available?

no

(Continue reading)

Hartmaier Alexander | 2 Jul 2004 13:24

Picon

AW: [modauthkerb] RE: Error: gss_accept_sec_context() failed

In the tarball and the cvs version is the configure script missing...

MfG Alex

-----Ursprüngliche Nachricht-----
Von: Daniel Kouril [mailto:kouril <at> ics.muni.cz] 
Gesendet: Freitag, 2. Juli 2004 12:33
An: Hartmaier Alexander
Cc: Daniel Kouril; Douglas E. Engert; Jari Ahonen; modauthkerb-help <at> lists.sourceforge.net
Betreff: Re: [modauthkerb] RE: Error: gss_accept_sec_context() failed

On Fri, Jul 02, 2004 at 11:18:58AM +0200, Hartmaier Alexander wrote:
> try #1:
> - service principal with 'firewall.mon.dsh.at'
> - NO ticket listed by kerbtray.exe (WinXP IE6.0 with all patches from windowsupdate...maybe that
matters too)
> - apache finds the service principal because the url string and the dns name in the service principal match
but client doesn't get a ticket from the dc and apache logs 'gss_accept_sec_context() failed: A token was
invalid (Token header is malformed or corrupt)'

Seems that the IE isn't able to get a ticket for the service from the AD and
still sends a NTLM authenticator the the apache. Unfortunately I can't say
where the problem can be. Try checking some logs on the KDC and/or sniff
network communication between the workstation and KDC. Someone also advised
this Windows tool for debugging:
http://www.develop.com/kbrown/security/sample_sspibench.htm

> try #2:
> - service principal with 'nac1.mon.dsh.at'
> - ticket 'HTTP/nac1.mon.dsh.at <at> INT.NEONET.AT is listed by kerbtray.exe

(Continue reading)

Jari Ahonen | 2 Jul 2004 13:29

RE: [modauthkerb] RE: Error: gss_accept_sec_context() failed


> 
> In the tarball and the cvs version is the configure script missing...

That's something I've been meaning to report to Daniel but forgot. The
Makefile
removes the configure script when doing "make distclean". This is
probably not
a good idea for those of us who don't have automake installed so they
could
generate the configure script with it.

You can use the configure script from the RC5 release, it works just
fine with
the CVS code.

- Jari

-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com

Hartmaier Alexander | 2 Jul 2004 13:56

Picon

RE: [modauthkerb] RE: Error: gss_accept_sec_context() failed

Ok that worked...but how to enable debugging in apache for mod_auth_kerb???

THX Alex

-----Ursprüngliche Nachricht-----
Von: Jari Ahonen [mailto:jah <at> progress.com] 
Gesendet: Freitag, 2. Juli 2004 13:30
An: Hartmaier Alexander; Daniel Kouril
Cc: modauthkerb-help <at> lists.sourceforge.net
Betreff: RE: [modauthkerb] RE: Error: gss_accept_sec_context() failed

> 
> In the tarball and the cvs version is the configure script missing...

That's something I've been meaning to report to Daniel but forgot. The
Makefile
removes the configure script when doing "make distclean". This is
probably not
a good idea for those of us who don't have automake installed so they
could
generate the configure script with it.

You can use the configure script from the RC5 release, it works just
fine with
the CVS code.

- Jari

*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
Hinweis: Dieses E-mail kann vertrauliche und geschützte Informationen enthalten.

(Continue reading)

Group

gmane.comp.apache.mod-auth-kerb.general.

Project Web Page

Discussing problems related to the Kerberos authentication module for Apache

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6

Articles in period: 50

July 2004

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Configuration behind Microsoft TMG (15 Apr 2013)
Mod_auth_kerb: Warning: received token seems to be NTLM, possible issu (27 Mar 2013)
gss_acquire_cred() failed - unknown error (28 Nov 2012)
500 error w/ mod_auth_kerb and mod_authnz_ldap (27 Nov 2012)
Compiling error - no Kerberos environment found (22 Oct 2012)
Prevauth and KRB5CCNAME not set (28 Sep 2012)
src/mod_auth_kerb.c(1628):kerb_authenticate_user entered with user (NU (21 Sep 2012)
No SPNEGO available during compilation (17 Sep 2012)
Segmentation Fault on OS X … trying to figure out log_rerror() (12 Sep 2012)
Cannot retrieve KRB5CCNAME if logged in with kerberos ticket (27 Aug 2012)
No login possible with Windows2008r2 (12 Jun 2012)
Lower Case Usernames (2 Jun 2012)
Reverse proxy (18 Apr 2012)
FW: make fails with apache 2.4.1 on Centos5.5 (7 Apr 2012)
*****SPAM***** Re: Windows 2000 Ad Server german (7 Apr 2012)
Windows 2000 Ad Server german (7 Apr 2012)
Windows 2008R2 and MIT kerberos library version (14 Mar 2012)
newsletter: Slow page loads when in failover with mod_auth_kerb (7 Mar 2012)
OpenBSD chroot and hostname? (7 Mar 2012)
Slow page loads when in failover with mod_auth_kerb (6 Mar 2012)
Solaris 10 compile errors - log_rerror (6 Mar 2012)

Archives

1	April 2013
1	March 2013
3	February 2013
2	November 2012
1	October 2012
13	September 2012
6	August 2012
7	June 2012
7	April 2012
29	March 2012
13	February 2012
20	January 2012
4	December 2011
7	November 2011
1	October 2011
4	September 2011
30	August 2011
11	July 2011
23	June 2011
21	May 2011
1	March 2011
19	February 2011
4	November 2010
57	September 2010
34	August 2010
3	July 2010
4	June 2010
4	May 2010
36	April 2010
14	March 2010
3	January 2010
20	December 2009
20	November 2009
2	October 2009
2	August 2009
10	July 2009
11	June 2009
14	May 2009
7	April 2009
19	March 2009
16	February 2009
29	January 2009
24	December 2008
4	November 2008
24	October 2008
4	September 2008
9	August 2008
23	July 2008
18	June 2008
19	May 2008
9	April 2008
9	March 2008
41	February 2008
15	January 2008
36	December 2007
23	November 2007
57	October 2007
41	September 2007
29	August 2007
112	July 2007
5	June 2007
46	May 2007
5	April 2007
15	March 2007
29	February 2007
134	January 2007
30	December 2006
77	November 2006
17	October 2006
22	September 2006
58	August 2006
26	July 2006
57	June 2006
64	May 2006
36	April 2006
50	March 2006
63	February 2006
7	January 2006
5	December 2005
17	November 2005
26	October 2005
14	September 2005
24	August 2005
14	July 2005
1	June 2005
35	May 2005
19	April 2005
51	March 2005
43	February 2005
27	January 2005
41	December 2004
29	November 2004
32	October 2004
28	September 2004
82	August 2004
50	July 2004
189	June 2004
1	January 2003

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template