Re: SASL + Kerberos + OpenLDAP issue

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

I tried to delete, recreate and export my service principals but it did not solve my problem. I have already the same error.

More details on my configuration:
 - My server is running ubuntu with heimdal kdc.
 - My client is a mac running leopard 10.5.6 with mit kerberos (if I'm right)

I created the service principals on my kdc then export to the keytab on my server, then I copied to keytab to my client.
Below the result of 'ktutil list' command:

on my server:
  root@passrlsrv:~# ktutil list
FILE:/etc/krb5.keytab:

Vno  Type                     Principal
  1  des-cbc-md5              ldap/passrlsrv.passrl@PASSRL
  1  des-cbc-md4              ldap/passrlsrv.passrl@PASSRL
  1  des-cbc-crc              ldap/passrlsrv.passrl@PASSRL
  1  aes256-cts-hmac-sha1-96  ldap/passrlsrv.passrl@PASSRL
  1  des3-cbc-sha1            ldap/passrlsrv.passrl@PASSRL
  1  arcfour-hmac-md5         ldap/passrlsrv.passrl@PASSRL
  1  des-cbc-md5              ldap/passrlsrv@PASSRL
  1  des-cbc-md4              ldap/passrlsrv@PASSRL
  1  des-cbc-crc              ldap/passrlsrv@PASSRL
  1  aes256-cts-hmac-sha1-96  ldap/passrlsrv@PASSRL
  1  des3-cbc-sha1            ldap/passrlsrv@PASSRL
  1  arcfour-hmac-md5         ldap/passrlsrv@PASSRL


on my client:
imac:/etc root# ktutil 
ktutil:  rkt /etc/krb5.keytab
ktutil:  list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    1             ldap/passrlsrv.passrl@PASSRL
   2    1             ldap/passrlsrv.passrl@PASSRL
   3    1             ldap/passrlsrv.passrl@PASSRL
   4    1             ldap/passrlsrv.passrl@PASSRL
   5    1             ldap/passrlsrv.passrl@PASSRL
   6    1             ldap/passrlsrv.passrl@PASSRL
   7    1                    ldap/passrlsrv@PASSRL
   8    1                    ldap/passrlsrv@PASSRL
   9    1                    ldap/passrlsrv@PASSRL
  10    1                    ldap/passrlsrv@PASSRL
  11    1                    ldap/passrlsrv@PASSRL
  12    1                    ldap/passrlsrv@PASSRL

Do you think that there is an incompatibility between heimdal kdc and mit client ?
Is it possible for instance that the server uses the aes256-cts-hmac-sha1-96 key and the client another one ?


Thank you
Xavier


On Fri 27/02/09 20:59 , Ken Hornstein <kenh@xxxxxxxxxxxxxxxx> wrote:

> > Feb 27 18:04:20 passrlsrv slapd[9861]: SASL [conn=16] Failure:
> GSSAPI 
> > Error:  Miscellaneous failure (see text) (Decrypt integrity check 
> > failedxt))
> "Decrypt integrity check failed" means that the service key in your
> KDC
> doesn't match the service key stored in the keytab.  You should
> rekey
> your server (and make sure you re-kinit AFTER you do that so you get
> a new
> service ticket that matches your service key).
> --Ken
> 
> 
http://www.celeonet.fr


[Index of Archives]     [Info Cyrus]     [Squirrel Mail]     [Linux Media]     [Yosemite News]     [gtk]     [KDE]     [Gimp on Windows]     [Steve's Art]

  Powered by Linux