Active-Directory
Apache 在 keytab 文件中找不到 kerberos 主體
虛擬主機已經配置了這些選項;
AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate On KrbMethodK5Passwd Off KrbAuthRealms EXAMPLE.COM KrbAuthoritative On KrbServiceName HTTP/something.example.com@EXAMPLE.COM Krb5KeyTab /path/to/krb/site.keytab require valid-user
site.keytab 可以被 apache 讀取,並且包含一個有效的主體;
root@pa2# klist -k /path/to/krb/site.keytab Keytab name: FILE:/path/to/krb/site.keytab KVNO Principal ---- -------------------------------------------------------------------------- 13 HTTP/something.example.com@EXAMPLE.COM (des-cbc-crc) 13 HTTP/something.example.com@EXAMPLE.COM (des-cbc-md5) 13 HTTP/something.example.com@EXAMPLE.COM (arcfour-hmac) 13 HTTP/something.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96) 13 HTTP/something.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96) root@pa2# kvno -k /path/to/krb/site.keytab HTTP/something.example.com@EXAMPLE.COM HTTP/something.example.com@EXAMPLE.COM: kvno = 13, keytab entry valid
但是當我嘗試訪問該站點時,我在 apache 錯誤日誌中得到了這個錯誤;
[Mon Mar 21 10:30:37.846616 2016] [auth_kerb:error] [pid 11217] [client ...:60195] gss_accept_sec_context() failed: Unspecified GSS failure. Minor code may provide more information (, Cannot find key for HTTP/something.example.com@EXAMPLE.COM kvno 5 in keytab)
目前的kvno確實不是5。
在客戶端 windows 電腦上發布
klist purge
解決了 kvno 問題。