mod_auth_kerb and kerberos
Phillip Ames
phillip.ames at uconn.edu
Mon Sep 5 20:50:32 EDT 2005
Hi,
I'm using Kerberos version 1.4.1 in tandem with mod_auth_kerb version
5.0 and apache 2.0.54 to authenticate users on a web interface. All of
these configurations happily hummed away using older versions of
kerberos and mod_auth_kerb, but since upgrading, I am not having much
luck. The error message I receive in the apache logs is:
[Mon Sep 05 20:46:09 2005] [error] [client 137.99.133.183] failed to
verify krb5 credentials: Server not found in Kerberos database
My .htaccess file for apache consists of this:
----
AuthName Kerberos
AuthType Kerberos
AuthGroupFile /etc/apache2/conf/group
KrbAuthRealms UCONN.EDU
Require group security misc
ExpiresActive On
ExpiresDefault "access plus 30 minutes"
Options FollowSymLinks Indexes
SSLRequireSSL
----
and in my krb5.conf I have the following:
----
[libdefaults]
ticket_lifetime = 600
default_realm = UCONN.EDU
default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
[realms]
UCONN.EDU = {
kdc = kerberos.uconn.edu:88
admin_server = kerberos.uconn.edu:749
}
[domain_realm]
.uconn.edu = UCONN.EDU
uconn.edu = UCONN.EDU
[kdc]
profile = /etc/krb5kdc/kdc.conf
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
----
I've looked through the kerberos source code but can't figure out why
this error would be appearing. When I try to authenticate, tcpdump
shows communication between the kerberos server and the web server:
---
20:46:09.745827 IP ares.uits.uconn.edu.51376 > 137.99.25.201.kerberos: v5
20:46:09.747189 IP 137.99.25.201.kerberos > ares.uits.uconn.edu.51376: v5
20:46:09.755931 IP ares.uits.uconn.edu.51376 > 137.99.25.201.kerberos:
20:46:09.758294 IP 137.99.25.201.kerberos > ares.uits.uconn.edu.51376:
---
Running a command like 'kinit <user>' works properly:
---
ares ~ # kinit testuser
Password for testuser at UCONN.EDU:
ares ~ # kinit testuser
Password for testuser at UCONN.EDU:
kinit(v5): Password incorrect while getting initial credentials
---
First time with proper password, second time without. I suspect that
something might be wrong with my krb5.conf but I'm not sure what it
would be. Does anyone have any insight as to why this might be
happening? Thanks,
-Phil
More information about the krbdev
mailing list