msktutil problem with Windows 2008
Markus Moeller
huaraz at moeller.plus.com
Mon Aug 31 16:16:46 EDT 2009
Hi Douglas,
I am not sure if you saw my follow up entries. The msktutil command I
used is
msktutil -c -b "CN=COMPUTERS" -s HTTP/<fqdn> -h <fqdn> -k
/etc/HTTP.keytab --computer-name squid-HTTP --upn HTTP/<fqdn> --server
<domain controller> --verbose --enctypes 28
As far as I recall the upn is required for AS requests (e.g. to use kinit)
and the spn is used for TGS (e.g. when you use kvno)
I used it as you described or 2003 for a long time too, but now facing 2008
I noticed this difference (e.g. If AD has two entries: one for host/fqdn -
with upn and spn - and one for HTTP/fqdn - with upn and spn - and a client
requests a HTTP/fqdn TGS or AS the key for host/fqdn is used)
Regards
Markus
"Douglas E. Engert" <deengert at anl.gov> wrote in message
news:mailman.43.1251730131.12456.kerberos at mit.edu...
>
>
>
>
> Markus Moeller wrote:
>> I use the latest msktutil (0.3.16-7) and can add an entry to Windows
>> 2008, but when I run kinit -kt test.keytab HTTP/fqdn I get
>> KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. Is there a setting in 2008 which need to
>> be changed ?
>
> I think AD will search for the UPN of HTTP/fqdn when a TGT is requested
> by kinit.
>
> Do you have any output from msktutil, or any dump of the
> AD entry? The UPN and SPNs would be helpful.
>
> It could be that the UPN of the account is host/fqdn at realm,
> with SPNs of host/fqdn and HTTP/fqdn. When you ran
> msktutil what options did you use?
>
> Is the UPN HTTP/fqdn at realm?
> Did you use the --upn HTTP/fqdn option?
>
> Since AD will let an account have one UPN, with multiple SPNs
> deriving the keys from the same password, msktutil will assume
> multiple principals in a keytab are for the same account.
>
> We always have one principal per account with separate keytabs,
> and use the --upn service/fqdn option too.
>
>>
>> Thank you
>> Markus ________________________________________________
>> Kerberos mailing list Kerberos at mit.edu
>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>>
>
> --
>
> Douglas E. Engert <DEEngert at anl.gov>
> Argonne National Laboratory
> 9700 South Cass Avenue
> Argonne, Illinois 60439
> (630) 252-5444
More information about the Kerberos
mailing list