Hello,
I've installed a samba4 server and now I've tried to get a kerberos
ticket,
like this:
base:/usr/local/samba# kinit stefan
stefan@SAMBA4.LOCAL's Password:
kinit: converting creds: Invalid argument
I'm using heimdal-clients (0.6.3) and samba4 svn r22508. My krb5.conf test
configuration:
[libdefaults]
default_realm = SAMBA4.LOCAL
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
[realms]
SAMBA4.LOCAL = {
kdc = base.samba4.local
admin_server = base.samba4.local
}
If I start samba with "-i -d 2" I got this log:
...
Kerberos: AS-REQ stefan@SAMBA4.LOCAL from 10.201.20.1 for
krbtgt/SAMBA4.LOCAL@SAMBA4.LOCAL
Kerberos: No preauth found, returning PREAUTH-REQUIRED -- stefan@SAMBA4.LOCAL
Kerberos: AS-REQ stefan@SAMBA4.LOCAL from 10.201.20.1 for
krbtgt/SAMBA4.LOCAL@SAMBA4.LOCAL
Kerberos: Client sent patypes: encrypted-timestamp, encrypted-timestamp,
encrypted-timestamp, encrypted-timestamp, encrypted-timestamp,
encrypted-timestamp, encrypted-timestamp, encrypted-timestamp,
encrypted-timestamp, encrypted-timestamp, encrypted-timestamp,
encrypted-timestamp
Kerberos: Looking for PKINIT pa-data -- stefan@SAMBA4.LOCAL
Kerberos: Looking for ENC-TS pa-data -- stefan@SAMBA4.LOCAL
Kerberos: No client key matching pa-data (des3-cbc-sha1) --
stefan@SAMBA4.LOCAL
Kerberos: No client key matching pa-data (des3-cbc-md5) -- stefan@SAMBA4.LOCAL
Kerberos: ENC-TS Pre-authentication succeeded -- stefan@SAMBA4.LOCAL using
arcfour-hmac-md5
Kerberos: Client supported enctypes: des3-cbc-sha1, des3-cbc-md5,
arcfour-hmac-md5, des-cbc-md5, des-cbc-md4, des-cbc-crc
Kerberos: Using arcfour-hmac-md5/arcfour-hmac-md5
Kerberos: Requested flags: renewable, proxiable, forwardable
Kerberos: AS-REQ authtime: 2007-04-25T17:50:05 starttime: unset endtime:
2007-04-26T03:50:05 renew till: 2007-05-25T17:50:05
Kerberos: TGS-REQ stefan@SAMBA4.LOCAL from 10.201.20.1 for
krbtgt/SAMBA4.LOCAL@SAMBA4.LOCAL
Kerberos: check_PAC check failed for krbtgt/SAMBA4.LOCAL@SAMBA4.LOCAL
(stefan@SAMBA4.LOCAL) from 10.201.20.1 with Invalid argument
Kerberos: Failed building TGS-REP to 10.201.20.1
...
Any tips?
Cheers
Stefan
--
Stefan Gohmann Entwicklung gohmann@univention.de
Univention GmbH Linux for your Business fon: +49 421 22 232- 0
Mary-Somerville-Str.1 28359 Bremen fax: +49 421 22 232-99
http://www.univention.de
