CANT_FIND_CLIENT_KEY

[Russ Allbery]

Matt Zagrabelny <mzagrabe at d.umn.edu> writes:

> Thanks again, Russ. Still not getting logged in to the switch, but
> things are looking closer. I don't have console access to the switch
> right now, so I do not see the current error, but the logs from the KDC
> look better:

> Mar 30 19:48:07 stout krb5kdc[27785](info): AS_REQ (1 etypes {1})
> 10.25.1.14: ISSUE: authtime 1269996487, etypes {rep=1 tkt=18 ses=1},
> mzagrabe at D.UMN.EDU for krbtgt/D.UMN.EDU at D.UMN.EDU

> Is it normal to have such drastic different types of encryption for the
> various parts?

> rep=1
> tkt=18
> ses=1

Yes, nothing should care about the ticket enctype except the KDC.

> I mean, the switch cannot handle aes256-cts-hmac-sha1-96 (etype 18).
> Does that matter?

It shouldn't.  It would only if the switch's implementation of Kerberos is
completely broken.  (Although that's happened before in very old versions
of Java, IIRC.)

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>