Creating keytabs and service principal names

kerberosspn

I'm trying to set up a keytab for a Java server to support Kerberos authentication on a Windows network. I'm struggling to get it working even at the level of the command line tools, haven't even got as far as the server setup yet! My plan just now is to try and get it working on my development PC as I have development work and debugging to do. So my goal is to have the Java server running on my PC, and the client running on the same machine connecting to it.

Here's what I've done so far, I'm really blundering my way through so I could be doing all kinds of wrong stuff!

Created a service principal name

I got one of our domain administrators to run this command:

setspn -A TEST/pc-name.mydomain.com my-user-name

This appeared to complete successfully and I can list this SPN successfully with

setspn -L my-user-name

Created a keytab file

I created a keytab with this command:

ktpass /princ TEST/pc-name.mydomain.com@MYDOMAIN.COM /pass <my-password> /ptype KRB5_NT_SRV_HST /out <keytab-filename>

This appears to create a keytab successfully, although it does warn that ptype and account type do not match (but whatever I choose for ptype, I get the same warning). If I run this command:

klist -k file:/<keytab-filename>

Then it lists the SPN I'd expect, namely TEST/pc-name.mydomain.com@MYDOMAIN.COM

The problem!

Now I want to check that the keytab works for this SPN, so I'm running

kinit -t <keytab-filename> TEST/pc-name.mydomain.com@MYDOMAIN.COM

I then get an error "krb_error 6 Client not found in Kerberos database".

What am I doing wrong?

Best Answer

I'm not quite sure whether my-user-name refers to a computer object or a user object in active directory; I'll assume it's a user object. In that case, I think setspn is not appropriate; this is meant to modify the SPNs of existing machine accounts. For a user account, I'm skeptical that SRV_HST is right.

Apparently, support for SPNs associated with user objects is somewhat limited; I read somewhere that this is really restricted to one user. I also couldn't manage to get your ktpass invocation to work for me, as it insisted on a) specifying a user account (through mapuser) that should be associated with the SPN, and b) setting the SPN password. I think the latter is unavoidable to create a keytab through ktpass.

I managed to create a keytab in the "standard way", i.e. by setting up a dedicated user account and associating it with an SPN:

ktpass /princ TEST/host@DOMAIN /mapuser user@DOMAIN /pass *  /out foo.keytab /ptype KRB5_NT_PRINCIPAL

That operation (expectly) broke login for the user, however, I was then able to kinit with

 kinit -k -t /tmp/foo.keytab  TEST/host@DOMAIN
Related Topic