<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi.<br>
<br>
On 17.10.2014 11:02, Victor Sudakov wrote:<br>
</div>
<blockquote cite="mid:20141017050231.GB60527@admin.sibptus.tomsk.ru"
type="cite"><br>
<pre wrap="">I am attaching a traffic dump.
Please look at Frame No. 36, where a ticket is requested for
"HTTP/proxy.sibptus.transneft.ru", and then at Frame No. 39, where
the ticket is granted, but for the wrong principal name.
</pre>
</blockquote>
The thing is, valid exchange should not and does not contain the
KRB5KRB_AP_ERR_MODIFIED error, and yours does. This indicates
something is wrong between these two hosts (as I understand,
10.14.134.4 is a Windows Server, and .122 is a workstation). You
need to investigate on your DC what's happening, Probably these are
the etype errors (may be not). If your DC is really w2k (not w2k3 or
w2k8) and the workstation is of different generation, this can
happen. Also, lots of howtos spread around the Internet, make an
engineer believe that he should kreate the keytab with only one
encryption type for squid, insted kreating the keytab with all of
available on the DC ciphers, This can also lead to complicated
situations.<br>
<br>
There's also a decent article there:
<a class="moz-txt-link-freetext" href="http://blogs.technet.com/b/askds/archive/2008/06/11/kerberos-authentication-problems-service-principal-name-spn-issues-part-3.aspx">http://blogs.technet.com/b/askds/archive/2008/06/11/kerberos-authentication-problems-service-principal-name-spn-issues-part-3.aspx</a>
<br>
Could help you as it did help me one day.<br>
<br>
Eugene.<br>
<span class="st"><em></em></span>
</body>
</html>