Geoff Posted January 4, 2017 Posted January 4, 2017 (edited) I've had a VM running Request Tracker on Ubuntu for ages. It uses mod_auth_kerberos for authentication. I also had dokuwiki in a sub directory on the webserver. To tidy things up I decided to move dokuwiki to it's own vhost on the same server. However after I've done this kerberos SSO fails. initally it was complaining about the SPN not matching [Wed Jan 04 09:34:20.156753 2017] [authz_core:debug] [pid 32419] mod_authz_core.c(802): [client 172.31.250.47:55634] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) [Wed Jan 04 09:34:20.156911 2017] [authz_core:debug] [pid 32419] mod_authz_core.c(802): [client 172.31.250.47:55634] AH01626: authorization result of : denied (no authenticated user yet) [Wed Jan 04 09:34:20.156989 2017] [auth_kerb:debug] [pid 32419] src/mod_auth_kerb.c(1652): [client 172.31.250.47:55634] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Jan 04 09:34:20.157068 2017] [auth_kerb:debug] [pid 32419] src/mod_auth_kerb.c(1260): [client 172.31.250.47:55634] Acquiring creds for [email protected] [Wed Jan 04 09:34:20.166005 2017] [auth_kerb:debug] [pid 32419] src/mod_auth_kerb.c(1406): [client 172.31.250.47:55634] Verifying client data using KRB5 GSS-API with our SPNEGO lib [Wed Jan 04 09:34:20.166356 2017] [auth_kerb:debug] [pid 32419] src/mod_auth_kerb.c(1422): [client 172.31.250.47:55634] Client didn't delegate us their credential [Wed Jan 04 09:34:20.166437 2017] [auth_kerb:debug] [pid 32419] src/mod_auth_kerb.c(1441): [client 172.31.250.47:55634] GSS-API token of length 9 bytes will be sent back [Wed Jan 04 09:34:20.166543 2017] [auth_kerb:debug] [pid 32419] src/mod_auth_kerb.c(1121): [client 172.31.250.47:55634] GSS-API major_status:000d0000, minor_status:96c73a90 [Wed Jan 04 09:34:20.166669 2017] [auth_kerb:error] [pid 32419] [client 172.31.250.47:55634] gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information (, Wrong principal in request) I've regenereted the keytab and added in the extra SPN for the new vhost. ktutil: read_kt /etc/krb5.keytab ktutil: l slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 9 HTTP/[email protected] 2 10 HTTP/[email protected] Now I get a different error blaming IE for trying to use NTLM authentication (when it isn't). [Wed Jan 04 10:23:37.613722 2017] [authz_core:debug] [pid 558] mod_authz_core.c(802): [client 172.31.250.47:58755] AH01626: authorization result of : denied (no authenticated user yet) [Wed Jan 04 10:23:37.613737 2017] [auth_kerb:debug] [pid 558] src/mod_auth_kerb.c(1652): [client 172.31.250.47:58755] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Jan 04 10:23:37.613797 2017] [auth_kerb:debug] [pid 558] src/mod_auth_kerb.c(1260): [client 172.31.250.47:58755] Acquiring creds for [email protected] [Wed Jan 04 10:23:37.624509 2017] [auth_kerb:debug] [pid 558] src/mod_auth_kerb.c(1406): [client 172.31.250.47:58755] Verifying client data using KRB5 GSS-API [Wed Jan 04 10:23:37.624540 2017] [auth_kerb:debug] [pid 558] src/mod_auth_kerb.c(1422): [client 172.31.250.47:58755] Client didn't delegate us their credential [Wed Jan 04 10:23:37.624547 2017] [auth_kerb:debug] [pid 558] src/mod_auth_kerb.c(1450): [client 172.31.250.47:58755] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration. [Wed Jan 04 10:23:37.624553 2017] [auth_kerb:debug] [pid 558] src/mod_auth_kerb.c(1121): [client 172.31.250.47:58755] GSS-API major_status:00010000, minor_status:00000000 [Wed Jan 04 10:23:37.624568 2017] [auth_kerb:error] [pid 558] [client 172.31.250.47:58755] gss_accept_sec_context() failed: An unsupported mechanism was requested (, Unknown error) Edited January 4, 2017 by Geoff pasted wrong logs
jinnantonnixx Posted January 4, 2017 Posted January 4, 2017 Do you have duplicate SPNs? This has caught me out MANY times. On the (presumably) windows authenticaion box, run setspn -X This will show duplicate SPNs. 1
jinnantonnixx Posted January 4, 2017 Posted January 4, 2017 Have you tested the keytab with something like kinit [email protected] -k -t your_keytabfile If the keytab file is working, this should successfully init without needing to type a password. 1
Geoff Posted January 4, 2017 Author Posted January 4, 2017 I had duplicate SPNs which I've removed. I've also followed the guidance in this stack overflow answer and created a second user account for the vhost and its Kerberos SPN: centos - Apache kerberos authentication to Active Directory not happening. (Is KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN related?) - Server Fault However I now get this error in my logs: [Wed Jan 04 14:57:04.367867 2017] [authz_core:debug] [pid 2023] mod_authz_core.c(802): [client 172.31.1.25:57795] AH01626: authorization result of Require valid-user : denied (no authenticated user yet) [Wed Jan 04 14:57:04.367919 2017] [authz_core:debug] [pid 2023] mod_authz_core.c(802): [client 172.31.1.25:57795] AH01626: authorization result of : denied (no authenticated user yet) [Wed Jan 04 14:57:04.367945 2017] [auth_kerb:debug] [pid 2023] src/mod_auth_kerb.c(1652): [client 172.31.1.25:57795] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Wed Jan 04 14:57:04.368001 2017] [auth_kerb:debug] [pid 2023] src/mod_auth_kerb.c(1260): [client 172.31.1.25:57795] Acquiring creds for [email protected] [Wed Jan 04 14:57:04.379675 2017] [auth_kerb:debug] [pid 2023] src/mod_auth_kerb.c(1121): [client 172.31.1.25:57795] GSS-API major_status:000d0000, minor_status:025ea101 [Wed Jan 04 14:57:04.379876 2017] [auth_kerb:error] [pid 2023] [client 172.31.1.25:57795] gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information (, No key table entry found matching HTTP/fshelpdesk.uk.forbessolicitors.co.uk@) I tried the login suggestion @jinnantonnixx and I get this: root@fshelpdesk:/etc# kinit ~dokuwiki-kerberos -k -t /etc/dokuwiki.uk.forbessolicitors.co.uk.keytab kinit: Keytab contains no suitable keys for [email protected] while getting initial credentials This serverfault page points to rDNS being an issue. Wrong principal in request (SSH/ GSSAPI/Kerberos/Debian) - Server Fault As I am using vhosts my rdns does not resolve to my forward dns for this host. I am wondering if that is the issue.
jinnantonnixx Posted January 4, 2017 Posted January 4, 2017 Try this on the Linux machine. Use ktutil interactively. ktutil addent -password -p [email protected] -k 1 -e RC4-HMAC wkt youruser-kerberos.keytab q This will produce a keytab file - try the login again with this new keytab. - - - Updated - - - Also check that your /etc/krb5.conf file has correct realm/domain mapping information. 1
Geoff Posted January 4, 2017 Author Posted January 4, 2017 The underlying kerberos setup is fine (and has been running ok for years). I managed to create a keytab with my domain admin account with your instructions: root@fshelpdesk:/etc# klist -k geoffk-da.keytab Keytab name: FILE:geoffk-da.keytab KVNO Principal ---- -------------------------------------------------------------------------- 1 [email protected] and login: root@fshelpdesk:/etc# kinit Geoffk-da -k -t geoffk-da.keytab root@fshelpdesk:/etc# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 04/01/17 15:38:29 05/01/17 01:38:29 krbtgt/[email protected] renew until 05/01/17 01:38:29
jinnantonnixx Posted January 4, 2017 Posted January 4, 2017 (edited) That's showing you have a valid kbrtgt/ (ticket granting ticket) but you haven't got a valid HTTP/ service ticket yet. You should get this when the service makes a request for web services and is granted a service ticket by the kerberos controller. Edited January 4, 2017 by jinnantonnixx
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now