I didn't know I couldn't use kadmin.
It makes sense now.
What I tried is to start with Heimal config from the start.
I did:
cp /usr/local/samba/share/setup/krb5.conf /etc/krb5.conf
to get the generated krb5.conf
Restarted Samba and checked kinit, which worked correctly.
I cleared the tickets cache with kdestroy.
I then changed /etc/krb5.conf to:
[libdefaults]
default_realm = SERVER.CENTOSDOMAIN
dns_lookup_realm = false
dns_lookup_kdc = true
[appdefaults]
pkinit_anchors = FILE:/home/virusakos/Downloads/SuperCA.pem
[realms]
SERVER.CENTOSDOMAIN = {
pkinit_require_eku = true
pkinit_require_krbtgt_otherName = true
pkinit_win2k = yes
pkinit_win2k_require_binding = no
}
[kdc]
enable_pkinit = yes
pkinit_identify =
FILE:/home/virusakos/Downloads/server.centosdomain.pem
pkinit_anchors = FILE:/home/virusakos/Downloads/SuperCA.pem
pkinit_win2k_require_binding = yes
pkinit_principal_in_certificate = yes
I created /usr/local/samba/var/heimdal/pki-mapping with contents:
[email protected]:C=GR,O=Byte
Computers,CN=virusakos,UID=virusakos
[email protected]:CN=virusakos,UID=virusakos
Restarted Samba and checked kinit without any options, which worked
correctly.
I cleared the tickets cache with kdestroy and then tried the following:
/opt/samba-master/bin/samba4kinit --request-pac --renewable
--pk-user=FILE:/home/virusakos/Downloads/virus.pem
[email protected]
There is no virus.pem so obviously I got
samba4kinit: krb5_get_init_creds_opt_set_pkinit: Failed to init cert
certs: Failed to open PEM file "/home/virusakos/Downloads/virus.pem": No
such file or directory
Trying again with the correct certificate file:
/opt/samba-master/bin/samba4kinit --request-pac --renewable
--pk-user=FILE:/home/virusakos/Downloads/virusakos.pem
[email protected]
Now, the error is different:
samba4kinit: krb5_get_init_creds: Already tried pkinit, looping
Any hints for the new error?
Does it sound like a configuration error or a certificate error?
Kind Regards,
Charalampos
On 7/4/12 2:39 AM, Andrew Bartlett wrote:
On Tue, 2012-07-03 at 17:50 +0300, Charalampos Anargyrou wrote:
I still have no clue what's going on.
In my attempt to find out what's happening, I found out I haven't done
neither 4.23.1 nor 4.23.2 in the Heimdal guide (
http://www.h5l.org/manual/HEAD/info/heimdal/Setting-up-PK_002dINIT.html )
So I tried 4.23.2 i.e.:
kadmin modify --pkinit-acl="CN=myuser,O=mycompany,C=GR"
[email protected]
and I received this error:
kadmin: invalid option -- '-'
I then tried to do:
kadmin
to get into interactive mode so I can issue the modify command but I
receive this error:
Authenticating as principal Administrator/[email protected] with
password.
kadmin: Client not found in Kerberos database while initializing kadmin
interface
I was puzzled with the Administrator/admin so next I tried:
kadmin -p [email protected]
with yet another error:
Authenticating as principal [email protected] with password.
kadmin: Database error! Required KADM5 principal missing while
initializing kadmin interface
I also tried enabling debugging by using the instructions in
http://www.h5l.org/manual/HEAD/info/heimdal/Debugging-Kerberos-problems.html
but I don't see any error messages
1) How can I enable debugging? I'm on CentOS 6.2
2) According to the above, does it look like my installation is broken?
Or is there something I am missing?
You can not use kadmin against Samba4 (we just don't expose the
interfaces needed, sorry), and the configuration we test in our selftest
doesn't need it. This can all be done with just config file entries.
Andrew Bartlett
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
