Anyone ?<span></span><br><br>Le samedi 2 mai 2015, Olivier CALVANO <<a href="mailto:o.calvano@gmail.com">o.calvano@gmail.com</a>> a écrit :<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div>Hi<br><br></div>I request your help because i want use NTLM/Kerberos for authenticate my user.<br><br></div>For NTLM, i use Winbind, no problems, <br><br>[root@gw]# wbinfo -t<br>checking the trust secret for domain MYADDOMAIN via RPC calls succeeded<br><br></div>but for Kerberos, i can't create the .keytab<br><br><br>[root@gw]# kinit MYUSERNAME<br>Password for <a href="javascript:_e(%7B%7D,'cvml','MYUSERNAME@MYADDOMAIN.FR');" target="_blank">MYUSERNAME@MYADDOMAIN.FR</a>:<br><br>[root@gw]# klist<br>Ticket cache: KEYRING:persistent:0:0<br>Default principal: <a href="javascript:_e(%7B%7D,'cvml','MYUSERNAME@MYADDOMAIN.FR');" target="_blank">MYUSERNAME@MYADDOMAIN.FR</a><br><br>Valid starting Expires Service principal<br>02/05/2015 04:51:25 02/05/2015 14:51:25 krbtgt/<a href="javascript:_e(%7B%7D,'cvml','MYADDOMAIN.FR@MYADDOMAIN.FR');" target="_blank">MYADDOMAIN.FR@MYADDOMAIN.FR</a><br> renew until 09/05/2015 04:51:07<br><br></div>MYUSERNAME is the same account that i join the domain (net join) with winbind<br><br><br></div>after, i put:<br><br>msktutil -c -b "CN=COMPUTERS" -s HTTP/<a href="http://gw.srv1-v4.tcy.myinternetdomain.org" target="_blank">gw.srv1-v4.tcy.myinternetdomain.org</a> -k /etc/squid/PROXY.keytab --computer-name OPHTCYSRV1V4-K --upn HTTP/<a href="http://gw.srv1-v4.tcy.myinternetdomain.org" target="_blank">gw.srv1-v4.tcy.myinternetdomain.org</a> --server adserver1 --verbose<br><div><br></div><div>and i have a error:<br><br>[root@gw etc]# msktutil -c -b "CN=COMPUTERS" -s
HTTP/<a href="http://gw.srv1-v4.tcy.myinternetdomain.org" target="_blank">gw.srv1-v4.tcy.myinternetdomain.org</a> -k /etc/squid/PROXY.keytab
--computer-name OPHTCYSRV1V4-K --upn
HTTP/<a href="http://gw.srv1-v4.tcy.myinternetdomain.org" target="_blank">gw.srv1-v4.tcy.myinternetdomain.org</a> --server adserver1 --verbose<br> -- init_password: Wiping the computer password structure<br> -- generate_new_password: Generating a new, random password for the computer account<br> -- generate_new_password: Characters read from /dev/udandom = 84<br> -- create_fake_krb5_conf: Created a fake krb5.conf file: /tmp/.msktkrb5.conf-jnxTuG<br> -- reload: Reloading Kerberos Context<br> -- finalize_exec: SAM Account Name is: OPHTCYSRV1V4-K$<br> -- try_machine_keytab_princ: Trying to authenticate for OPHTCYSRV1V4-K$ from local keytab...<br> -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (Client not found in Kerberos database)<br> -- try_machine_keytab_princ: Authentication with keytab failed<br> -- try_machine_keytab_princ: Trying to authenticate for host/<a href="http://gw.srv1-v4.tcy.myinternetdomain.org" target="_blank">gw.srv1-v4.tcy.myinternetdomain.org</a> from local keytab...<br> -- try_machine_keytab_princ: Error: krb5_get_init_creds_keytab failed (Client not found in Kerberos database)<br> -- try_machine_keytab_princ: Authentication with keytab failed<br> -- try_machine_password: Trying to authenticate for OPHTCYSRV1V4-K$ with password.<br> -- create_default_machine_password: Default machine password for OPHTCYSRV1V4-K$ is ophtcysrv1v4-k<br> -- try_machine_password: Error: krb5_get_init_creds_keytab failed (Client not found in Kerberos database)<br> -- try_machine_password: Authentication with password failed<br> -- try_user_creds: Checking if default ticket cache has tickets...<br> -- try_user_creds: Error: krb5_cc_get_principal failed (No credentials cache found)<br> -- try_user_creds: User ticket cache was not valid.<br>Error: could not find any credentials to authenticate with. Neither keytab,<br> default machine password, nor calling user's tickets worked. Try<br> "kinit"ing yourself some tickets with permission to create computer<br> objects, or pre-creating the computer object in AD and selecting<br> 'reset account'.<br> -- ~KRB5Context: Destroying Kerberos Context<br><br><br><br></div><div>same error if i change <a href="http://gw.srv1-v4.tcy.myinternetdomain.org" target="_blank">gw.srv1-v4.tcy.myinternetdomain.org</a> to <a href="http://ophtcysrv1v4.myaddomain.fr" target="_blank">ophtcysrv1v4.myaddomain.fr</a><br></div><div><div><br><div><br></div><div>anyone know the origin of this error ?<br><br></div><div>thanks<br></div><div>Olivier<br><br></div><div><br></div></div></div></div>
</blockquote>