Hi Markus, I created the service principal with kadmin on the apple server. The actual command was kadmin.local -q "add_principal HTTP/proxyserver.paragould.psd". I used kadmin also to export the keytab. Here's exactly what I did:
xserve:~ root# kadmin.local Authenticating as principal root/[email protected] with password. kadmin.local: xst -k proxyserver.keytab HTTP/[email protected] Entry for principal HTTP/[email protected] with kvno 5, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:proxyserver.keytab. Entry for principal HTTP/[email protected] with kvno 5, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:proxyserver.keytab. Entry for principal HTTP/[email protected] with kvno 5, encryption type AES-128 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:proxyserver.keytab. Entry for principal HTTP/[email protected] with kvno 5, encryption type AES-256 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:proxyserver.keytab. kadmin.local: q xserve:~ root# klist -k proxyserver.keytab Keytab name: WRFILE:proxyserver.keytab KVNO Principal ---- -------------------------------------------------------------------------- 5 HTTP/[email protected] 5 HTTP/[email protected] 5 HTTP/[email protected] 5 HTTP/[email protected] xserve:~ root# kadmin.local -q "list_principals" | grep -i http HTTP/[email protected] HTTP/[email protected] http/[email protected] That last command to list the http principals confused me and I'm not familiar with kerberos at all really. Is it showing there are http service principals for both proxyserver.paragould.psd and xserve.paragould.psd or does the KDC automatically add a http service principal for itself too? In this case, xserve.paragould.psd is the KDC server running on OS X Server 10.6.2 and proxserver.paragould.psd is the squid server running on CentOS 5.5. I copied the exported proxyserver.keytab to /etc/squid/ on the host proxyserver.paragould.psd and made sure the squid user had read access to it. Running kinit squidserver and giving it's password works I think. klist after that shows: [r...@proxyserver squid]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 12/08/10 15:38:42 12/09/10 01:38:42 krbtgt/[email protected] renew until 12/09/10 15:38:42 Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached I'm sure I've missed something or messed something up but I'm at a loss as what it is or where to even start looking. Thanks for any help! Regards, Rob ---------------- Rob Asher Network Systems Technician Paragould School District 870-236-7744 x169 >>> "Markus Moeller" <[email protected]> 12/08/10 2:39 PM >>> Hi Rob, It looks like your kdc does not know about the service principal HTTP/[email protected] How did you create the entry and keytab ? Markus >"Rob Asher" <[email protected]> wrote in message >news:[email protected]... >I've looked through some of the mailing list archives and can't find >anything specific on kerberos authentic ation to a MIT KDC for windows >clients. Everything I've found mentions AD. What I'd like, if possible, >is t o have single sign on capabilities to between OS X server's Open >Directory, squid 2.7stable9 on CentOS 5.5, a nd Windows XP clients. >With pGina and kerberos for windows installed on the XP clients, I >successfully get a ticket from the OD server. What I'm having >problems with is getting firefox or IE to use the ticket for neg >otiation with the squid server. I'm guessing that I've missed setting up a >principal correctly, copied keyta b, or possibly a DNS issue but I'm >not familiar enough with kerberos to know what's wrong. Packet captures f >or kerberos return KRB-ERROR like this after the TGS_REQ when opening a >browser session with FF: > >Kerberos KRB-ERROR > Pvno: 5 > MSG Type: KRB-ERROR (30) > ctime: 2010-12-03 21:05:34 (UTC) > stime: 2010-12-03 21:05:26 (UTC) > susec: 714271 > error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7) > Client Realm: XSERVE.PARAGOULD.PSD > Client Name (Principal): HTTP/proxyserver.paragould.psd > Name-type: Principal (1) > Name: HTTP > Name: proxyserver.paragould.psd > Realm: XSERVE.PARAGOULD.PSD > Server Name (Unknown): krbtgt/xserve.paragould.psd > Name-type: Unknown (0) > Name: krbtgt > Name: xserve.paragould.psd > e-text: UNKNOWN_SERVER > >If anyone has any ideas or what to look for, I'd appreciate any help. If >this isn't enough information from the capture to make an educated >guess as to where I need to look further, I have the entire sequence I >could post as well. > >Thanks, >Rob > > > >---------------- >Rob Asher >Network Systems Technician >Paragould School District >870-236-7744 x169 > > > >---------- > >This message has been scanned for viruses and >dangerous content by the Paragould School District >MailScanner, and is believed to be clean. > > ---------- This message has been scanned for viruses and dangerous content by the Paragould School District MailScanner, and is believed to be clean. ---------- This message has been scanned for viruses and dangerous content by the Paragould School District MailScanner, and is believed to be clean.
