[SSSD] pam_krb5 & wrong principal in request

Jan Zelený jzeleny at redhat.com
Thu Mar 1 13:24:22 UTC 2012


> On 03/01/2012 02:04 PM, Jan Zelený wrote:
> >> On 03/01/2012 12:21 PM, Ondrej Valousek wrote:
> >>> Hello,
> >>> 
> >>> I am running sssd on RHEL-6 with AD and recently found out, that I can
> >>> no longer authenticate via ssh. The message is:
> >>> pam_krb5[27045]: TGT failed verification using keytab and key for
> >>> 'nfs/draco.prague.s3group.com at DUBLIN.AD.S3GROUP.COM': Wrong principal
> >>> in request
> >>> 
> >>> My krb5.keytab file has been created using Samba with "net ads join".
> >>> I can still run 'kinit<username>' to obtain a TGT.
> >>> 
> >>> Does anyone know what is going on here? Why is sshd verifying the TGT
> >>> via just the nfs/ service principal?
> >>> 
> >>> Sorry for a bit off-topic question, but I hoped someone in this list
> >>> might point me in the right direction.
> >>> 
> >>> Ondrej
> >> 
> >> Note that with:
> >> kinit -S nfs/draco.prague.s3group.com at DUBLIN.AD.S3GROUP.COM ondrejv
> >> 
> >> I am able to successfully obtain the nfs/ principal - so it looks like a
> >> bug in pam_krb5, right?
> > 
> > You should also try kinit -k to see if kinit with the keytab is ok.
> > 
> > Thanks
> > Jan
> 
> kinit -k -S nfs/draco.prague.s3group.com at DUBLIN.AD.S3GROUP.COM draco$
> works fine, too.
> 
> So I am probably going to file a bugreport, right?

Just to be sure, try klist -k and send me the result.

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120301/8bd0ad0b/attachment.sig>


More information about the sssd-devel mailing list