directory-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Wu, James C." <James.C...@disney.com>
Subject RE: kinit failed on - Integrity check on decrypted field failed
Date Mon, 08 Apr 2013 01:14:56 GMT
Here is the content of the krb5.conf file. 


 [logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 debug = true
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 rdns = false
 forwardable = true
 allow_weak_crypto = yes

[realms]
 EXAMPLE.COM = {
  kdc = 127.0.0.1:60088
  admin_server = 127.0.0.1:60464
  default_domain = EXAMPLE.COM
 }


[domain_realm]
 .EXAMPLE.COM = EXAMPLE.COM
 EXAMPLE.COM = EXAMPLE.COM

-----Original Message-----
From: Emmanuel Lécharny [mailto:elecharny@gmail.com] 
Sent: Friday, April 05, 2013 10:33 PM
To: Apache Directory Developers List
Subject: Re: kinit failed on - Integrity check on decrypted field failed

Le 4/6/13 2:23 AM, Wu, James C. a écrit :
> Hi,

Hi,
>
> I am trying to set up ApacheDS as a KDC. After adding hnelson using 
> the following ldif, I could not get kinit to get the ticket
>
> 	 dn: uid=hnelson,ou=users,dc=example,dc=com
> 	objectclass: top
> 	objectclass: person
> 	objectclass: inetOrgPerson
> 	objectclass: krb5Principal
> 	objectclass: krb5KDCEntry
> 	cn: Horatio Nelson
> 	sn: Nelson
> 	uid: hnelson
> 	userpassword: secret
> 	krb5PrincipalName: hnelson@EXAMPLE.COM
>
>
> The log output of ApacheDS show the following output:
>
> 	[cloud-user@n7-z01-0a2a0c3a ~]$ [17:15:57] ERROR [org.apache.directory.server.KERBEROS_LOG]
- No timestamp found
> 	[17:15:57] WARN [org.apache.directory.server.kerberos.protocol.KerberosProtocolHandler]
- Additional pre-authentication required (25)
> 	[17:15:57] WARN [org.apache.directory.server.KERBEROS_LOG] - Additional pre-authentication
required (25)
> 	[17:16:00] WARN [org.apache.directory.server.kerberos.protocol.KerberosProtocolHandler]
- Integrity check on decrypted field failed (31)
> 	[17:16:00] WARN [org.apache.directory.server.KERBEROS_LOG] - 
> Integrity check on decrypted field failed (31)
>
> Could someone give me some hint?

First, can you give us the version you are using ?

Can you also provide the krb5.conf file you are using ?

Its very likely that the encryptionType you are using on the client is not correctly recognized
by the server.

--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com 

Mime
View raw message