kerberos client on windows not being able to access credentials cache ("Internal credentials cache error")

[Tomas Pospisek]

Hello all,

tldr:

     D:\>C:\OSGeo4W\bin\psql.exe service=the_db
     psql: error: connection to server at "dbserver.example.lan
     (192.168.4.104), port 5432 failed: could not initiate GSSAPI
     security context: No credentials were supplied, or the credentials
     were unavailable or inaccessible: Internal credentials cache error

Goal
====

I want to have my Postgresql clients (in this case psql.exe) on Windows 
to authenticate against Active Directory.

Steps taken so far
==================

Linux client -> Active Directory -> Linux server works
------------------------------------------------------

I was able to get psql on Linux to authenticate against Active Directory 
and with the service ticket that it got from Active Directory to 
authenticate to the Postgresql service and server.

Windows client -> Active Directory does not work
------------------------------------------------

I do know that psql.exe (on Windows) is linked and is using GSS to do 
Kerberos authentication.

A psql.exe that is not linked against GSS will tell me: "gssencmode 
value "require" invalid when GSSAPI support is not compiled in"

A psql.exe that is linked against GSS will not tell me that. I'm 
evidently now using the latter - a psql.exe that is linked against GSS.

-> So I know that the psql.exe that I'm using is linked against GSS.

Also, in the Windows shell I can issue a klist, and I see the Ticket 
Granting Ticket and I see various service tickets (mainly to mount CIFS 
shares).

Also on Windows shell I can issue a

     klist get postgres/dbserver.example.lan at EXAMPLE.LAN

and I see the ticket listed when I issue klist.

-> So I know that getting the service ticket on the Windows client does 
indeed work.

When using psql.exe without setting `gssencmode = require` I am able to 
authenticate with username/password and connect to the Postgresql 
service on the DB server just fine.

-> So I know that there is no problem with psql.exe wrt to connecting to 
the Postgresql server and there is no problem with authentication per se.

I tried to trace psql.exe with the "Process Monitor" tool. I see that 
(for whatever reason), psql.exe will open a TCP connection to the 
Postgresql server. But it will *NOT* open a connection to the Active 
Directory server.

Maybe it *shoud* connect to a local (that is on the local host) 
authentication/active directory service, but I do not know enough 
Windows to know how I would see that in the "Process Monitor" trace.

I can see that psql.exe is accessing the Windows Registry and that it's 
accessing various DLLs, among others the kerberos library, and various 
config files, such as the krb5.conf file, but I can not see it accessing 
a keytab.

Again I do not know *exactly* how Active Directory/Kerberos access works 
on Windows, but I *suspect* that the protocol on a Windows client is 
*not* using keytab file.

I do see that `psql.exe` is trying to access a `ccapiserver.exe` file, 
that is not there.

Question: is a `ccapiserver.exe` executable required in order to be able 
to access tickets from a Kerberos client on a Windows client?

Other question: is the error "Internal credentials cache error" the root 
cause of psql.exe not being able to authenticate against Active 
Directory (I am supposing that the error "Internal credentials cache 
error" refers to the kerberos client not being able to access the 
*existing* tickets. But in "theory" psql.exe could try getting a ticket 
*without* accessing the existing tickets? So it wouldn't have to 
forcibly fail there?).

And another question: is there any way to make GSS more talkative? At 
this moment all that I can get as logs is the above "computer says no". 
I was able to set the kerberos log to a local file, but that just tells 
me that the client now wants to do authentication and that's that.

So that's as far as I got and I'm a bit at the end of my wisdom and a 
would very, very much appreciate:

* help on how to proceed from here
* pointers to how configure krb5.conf-wise a given Windows executable 
that links against GSS so that it can authenticate against active directory
* any help and pointer or debugging help
* has anybody been able to authenticate from Windows against Active 
Directory and how did you do that respectively how did you set it up?

Any help would be very, very much appreciated, thank you.
*t