Server not found in Kerberos database while getting a service url ticket

vpouli vpouli at gmail.com
Mon May 22 13:01:54 EDT 2006


hello,
I have added to my kerberos database the following principal:
"http://localhost:8080/axis/services/test" .
(It' s in a url format instead of  being in the format:
service/host at REALM.)
So, the thing is that I would like to acquire a service ticket for that
principal.
To request a service ticket I am using gss api and follow the next
steps:

class KrbClient{
main(){
....
//I have acquired the credentials from the ticket cache
...
PrincipalName serviceName = new
PrincipalName("http://localhost:8080/axis/services/test");

// create the tgs_req to ask for service tickets
sun.security.krb5.KrbTgsReq tgs_req = new
sun.security.krb5.KrbTgsReq(credentials, serviceName);

tgs_req.send();

// get tgs_rep
KrbTgsRep tgs_rep = tgs_req.getReply();
}
}

and it gets the folllowing error:

KrbException: Server not found in Kerberos database (7)
	at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:67)
	at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:235)
	at KrbClient.requestServiceTicket(KrbClient.java:142)
	at KrbClient.main(KrbClient.java:39)
Caused by: KrbException: Identifier doesn't match expected value (906)
	at sun.security.krb5.internal.KDCRep.init(KDCRep.java:134)
	at sun.security.krb5.internal.TGSRep.init(TGSRep.java:59)
	at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:54)
	at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:50)
	... 3 more

>From the debugging of gss api:
>>>KRBError:
	 sTime is Mon May 22 19:07:26 EEST 2006 1148314046000
	 suSec is 722233
	 error code is 7
	 error Message is Server not found in Kerberos database
	 crealm is GRID.ORG
	 cname is vpouli
	 realm is GRID.ORG
	 sname is http://localhost:8080/axis/services/test

>From the kdc log file:
2006-05-22T19:40:59 TGS-REQ vpouli at GRID.ORG from IPv4:147.102.183.137
for http:/\/localhost:8080/axis/services/test at GRID.ORG
2006-05-22T19:40:59 Server not found in database:
http:/\/localhost:8080/axis/services/test at GRID.ORG: No such entry in
the database
2006-05-22T19:40:59 sending 155 bytes to IPv4:147.102.183.137

What I see, is that when I request a ticket for a service principal
which contains "//" (like in http://localhost....) it puts an escape
character '\' between '//'  and tries to find "http:/\/localhost..."
instead of "http://localhost....".

Is there something I can do about it?




More information about the Kerberos mailing list