.kinit: Preauthentication failed while getting initial credentials

Tom Yu tlyu at mit.edu
Thu Oct 27 12:53:05 EDT 2016


Thomas Beaudry <thomas.beaudry at concordia.ca> writes:

> So i got it to work by switch the encryption type.  In case anyone is wondering i used:  addent -password -p ${user} -k 1 -e rc4-hmac

It's possible that the problem is related to password salting.  (The RC4
enctype has no salt, but the AES ones do.)  We've observed that the salt
for an Active Directory principal is related to the account name rather
than the principal name, e.g., HOSTNAME$ for a computer account.  (An AD
account can have multiple Kerberos principal names.)  Without the
correct salt, the client can't produce the correct password-derived key.

-Tom


More information about the Kerberos mailing list