During the user mapping account creation you must name the login name as HTTP/username.domain.com. I was not using the FQDN since AD adds that at the end. End result is....HTTP/[email protected]. It had my keytab messed up. I can test the keytab successfully now.
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Charles Breite Sent: Tuesday, June 16, 2009 7:19 AM To: Simon Wilkinson Cc: [email protected] Subject: RE: Keytab server principal cuts off at @ Yes is my krb5.conf... [libdefaults] default_realm = DOMAIN.COM clockskew = 300 #dns_lookup_kdc = true #dns_lookup_realm = true # We have to have the realm spec here still for CAS [realms] DOMAIN.COM = { kdc = vmad1.domain.com default_domain = domain.com admin_server = vmad1.domain.com } [logging] kdc = FILE:/var/log/krb5/krb5kdc.log admin_server = FILE:/var/log/krb5/kadmind.log default = SYSLOG:NOTICE:DAEMON [domain_realm] DOMAIN = DOMAIN.COM .DOMAIN = DOMAIN.COM [appdefaults] pam = { ticket_lifetime = 1d renew_lifetime = 1d forwardable = true proxiable = false retain_after_close = false minimum_uid = 1 use_shmem = sshd } -----Original Message----- From: Simon Wilkinson [mailto:[email protected]] Sent: Tuesday, June 16, 2009 2:37 AM To: Charles Breite Cc: [email protected] Subject: Re: Keytab server principal cuts off at @ On 15 Jun 2009, at 19:30, Charles Breite wrote: > I am wondering if anyone has seen this where the principal is > cutoff....I have regenerated the keytab several times and re-checked > the > windows accounts we are using for the auth.... Shouldn't the principal > be HTTP/[email protected] A lack of a realm usually means that Kerberos is attempting to find the realm using referrals. Have you got a default realm set in your krb5.conf? S. ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
