Reg: Kerberos Login handler

[Douglas E. Engert]

Some of the examples below are with the IDP on unix. I have
not tried running an IDP on Windows. The KDCs are AD domain
controllers.

On 1/17/2013 2:15 PM, Prasanna wrote:
> Dear Douglas,
>
> I do created a SPN using KTPass command and generated a keytab
>
> handler.xml
>
>
>

You may also need in the:
  <ph:LoginHandler xsi:type="krb:KERBEROS"
                   kerberosCfg="/etc/krb5.conf"

with the krb5.conf listing the KDCs for the realm. Depenrs
on the Java version.

>
>
> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</ph:AuthenticationMethod>
>          <krb:Realm domain="IMPEROIDMSTAGE.COM">
>
> <krb:principal>HTTP/imperoidmstage at IMPEROIDMSTAGE.COM</krb:principal>


That does not look correct. The imperoidmstasge must be the hostname of the IDP.
It must be fully qualified, as the client browser will be trying to get
a service ticket for that principal.

>
>              <krb:password>Passw0rd</krb:password>

(I have always pointed at the keytab:
                <krb:keytab>/etc/krb5.keytab.http</krb:keytab>
but the password may work if that is the password for the AD account
that has the SPN. Using the password would explain the "User not found
in Kerberos database".)

check the AD ad account to make sure it has a servicePrincipalName=HTTP/fqdn.of.idp
Must be a FQDN.

>          </krb:Realm>
>
>
>
>
>
>
>      </ph:LoginHandler>
>
> I have got no idea to test the SPNEGO...

That the browser doing kerberos to the server...

>
> Few errors which I get are,
>
> 1. KDC 'IMPEROIDMSTAGE.COM', logging error

  Is that the name of the KDC? or just the REALM (AD Domain Name)
> 2. Error validating security context
> 3. Client not found in kerberos (6)
      The SPN is not found, because you uare uing the password in
      place of the keytab      and the SPN is not found in AD.
>
> Hope to resolve these. Please let me know if you come across anything...
>
>
> Thanks
> Prasanna
>
>
>
>
>
> -----
> Prasanna V B
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Reg-Kerberos-Login-handler-tp7584113p7584124.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444