pamkrbval: KDC policy rejects request for this entry

[Tom Yu]

"Richard Curtis" <ricurtis at gmail.com> writes:

> Hi,
>   I am trying to get an HPUX 11i box to authenticate against our
> active directory (Windows 2003r2) domain with kerberos but I am
> getting nowhere fast.
>
> As per the docs I have, I have created a user account in active
> directory, then used "ktpass -princ
> host/unix_client.domain.host.com at DOMAIN.HOST.COM -mapuser unix_lient
> -pass <pass> -out c:\krb5.keytab"
> The keytab looks fine when I used ktutil, but I cannot do a kinit... I
> keep getting "KDC policy rejects request for this entry"

It may be that the AD server is forbidding the use of the
"host/unix_client.domain.host.com" principal as a client principal.