msktutil problem with Windows 2008

[Markus Moeller]

Hi Douglas,

   I am not sure if you saw my follow up entries. The msktutil command I 
used is

msktutil -c -b "CN=COMPUTERS" -s HTTP/<fqdn> -h <fqdn> -k 
/etc/HTTP.keytab --computer-name squid-HTTP --upn HTTP/<fqdn> --server 
<domain controller> --verbose --enctypes 28

As far as I recall the upn is required for AS requests (e.g. to use kinit) 
and the spn is used for TGS (e.g. when you use kvno)

I used it as you described or 2003 for a long time too, but now facing 2008 
I noticed this difference (e.g. If AD has two entries: one for host/fqdn - 
with upn and spn - and one for HTTP/fqdn - with upn and spn - and a client 
requests a HTTP/fqdn TGS or AS the key for host/fqdn is used)

Regards
Markus

"Douglas E. Engert" <deengert at anl.gov> wrote in message 
news:mailman.43.1251730131.12456.kerberos at mit.edu...
>
>
>
>
> Markus Moeller wrote:
>> I use the latest msktutil (0.3.16-7) and can add an entry to Windows 
>> 2008, but when I run kinit -kt test.keytab HTTP/fqdn I get 
>> KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. Is there a setting in 2008 which need to 
>> be changed ?
>
> I think AD will search for the UPN of HTTP/fqdn when a TGT is requested
> by kinit.
>
> Do you have any output from msktutil, or any dump of the
> AD entry?  The UPN and SPNs would be helpful.
>
> It could be that the UPN of the account is host/fqdn at realm,
> with SPNs of host/fqdn and HTTP/fqdn. When you ran
> msktutil what options did you use?
>
> Is the UPN HTTP/fqdn at realm?
> Did you use the --upn HTTP/fqdn option?
>
> Since AD will let an account have one UPN, with multiple SPNs
> deriving the keys from the same password, msktutil will assume
> multiple principals in a keytab are for the same account.
>
> We always have one principal per account with separate keytabs,
> and use the --upn service/fqdn option too.
>
>>
>> Thank you
>> Markus ________________________________________________
>> Kerberos mailing list           Kerberos at mit.edu
>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>>
>
> -- 
>
>  Douglas E. Engert  <DEEngert at anl.gov>
>  Argonne National Laboratory
>  9700 South Cass Avenue
>  Argonne, Illinois  60439
>  (630) 252-5444