[SSSD] pam_krb5 & wrong principal in request

Ondrej Valousek webserv at s3group.cz
Thu Mar 1 13:13:40 UTC 2012


On 03/01/2012 02:04 PM, Jan Zelený wrote:
>> On 03/01/2012 12:21 PM, Ondrej Valousek wrote:
>>> Hello,
>>>
>>> I am running sssd on RHEL-6 with AD and recently found out, that I can no
>>> longer authenticate via ssh. The message is:
>>> pam_krb5[27045]: TGT failed verification using keytab and key for
>>> 'nfs/draco.prague.s3group.com at DUBLIN.AD.S3GROUP.COM': Wrong principal in
>>> request
>>>
>>> My krb5.keytab file has been created using Samba with "net ads join".
>>> I can still run 'kinit<username>' to obtain a TGT.
>>>
>>> Does anyone know what is going on here? Why is sshd verifying the TGT via
>>> just the nfs/ service principal?
>>>
>>> Sorry for a bit off-topic question, but I hoped someone in this list
>>> might point me in the right direction.
>>>
>>> Ondrej
>> Note that with:
>> kinit -S nfs/draco.prague.s3group.com at DUBLIN.AD.S3GROUP.COM ondrejv
>>
>> I am able to successfully obtain the nfs/ principal - so it looks like a
>> bug in pam_krb5, right?
> You should also try kinit -k to see if kinit with the keytab is ok.
>
> Thanks
> Jan
kinit -k -S nfs/draco.prague.s3group.com at DUBLIN.AD.S3GROUP.COM draco$
works fine, too.

So I am probably going to file a bugreport, right?

Ondrej
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120301/5974f937/attachment.html>


More information about the sssd-devel mailing list