IE using NTLM instead of Kerberos?

[Jason Fenner]

As an update, I ran:
kinit HTTP/rt.vitamix.com

and supplied the requested password.  This was successful.
However, when running:
kvno HTTP/rt.vitamix.com

I got:
HTTP/rt.vitamix.com at VITAMIX.COM: Server not found in Kerberos database 
while getting credentials

klist had this output:
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: HTTP/rt.vitamix.com at VITAMIX.COM

Valid starting     Expires            Service principal
02/20/06 09:33:59  02/20/06 19:33:59  krbtgt/VITAMIX.COM at VITAMIX.COM
        renew until 02/21/06 09:33:59


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached


Jason Fenner wrote:

>Ok,
>
>I ran that command and go the following:
>kvno: No credentials cache found while getting client principal name
>
>I notice that it says "client principal name", does this mean that I 
>also need a key called:
>host/rt.vitamix.com
>
>Or does "client" just refer to the principal name that I queried?
>
>What does this message indicate?
>
>Here is my /etc/krb5.conf file too:
>
>[logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
> clockskew = 300
>
>[libdefaults]
> ticket_lifetime = 24000
> default_realm = DOMAIN.COM
> dns_lookup_realm = false
> dns_lookup_kdc = false
>
>
>[realms]
> VITAMIX.COM = {
>  kdc = dc1.domain.com:88
>  admin_server = dc1.domain.com
>
> }
>
> GOLDENEYE = {
>  kdc = dc1.vitamix.com
>  admin_server = dc1.domain.com
>  default_domain = DOMAIN.COM
>}
>
>[domain_realm]
>   rt.vitamix.com = DOMAIN.COM
>
>#[kdc]
># profile = /var/kerberos/krb5kdc/kdc.conf
>
>[appdefaults]
> pam = {
>   debug = false
>   ticket_lifetime = 36000
>   renew_lifetime = 36000
>   forwardable = true
>   krb4_convert = false
> }
>
>[logging]
>FILE=/var/krb5/kdc.log
>
>
>Achim Grolms wrote:
>
>  
>
>>On Friday 17 February 2006 23:08, Jason Fenner wrote:
>>
>> 
>>
>>    
>>
>>>I have followed these instruction completely:
>>>http://www.grolmsnet.de/kerbtut/
>>>
>>>The research I have done so far shows that IE will try kerberos first,
>>>and then fail over to NTLM.  
>>>   
>>>
>>>      
>>>
>>please run 
>>
>>kvno HTTP/rt.vitamix.com
>>
>>to see if the Kerberos principal exists.
>>
>>The mod_auth_kerb mailinglist is
>>
>>modauthkerb-help at lists.sourceforge.net
>>
>>
>>Achim
>>
>> 
>>
>>    
>>
>
>
>________________________________________________
>Kerberos mailing list           Kerberos at mit.edu
>https://mailman.mit.edu/mailman/listinfo/kerberos
>
>  
>