01-21-2010
Kerberos and LDAP Auth
Good day
I am trying to configure Kerberos and LDAP authentication on AIX 5.3 with Windows 2003 R2 but something is not quite right.
When I ran kinit username I get a ticket and I can display it using klist.
When the user login I can see the ticket request on Windows 2003, but the user gets the following error "3004-007 You entered an invalid login name or password."
Is there any way that I can turn debugging on so that I can see where the problem might be. I am sure it is something small but I don't know where.
Thank you for any assistance.
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
I am running iPlanet 6 on HP-UX 11, and presently all users can access the site.
There are 6000 users accessing the website from an Windows Network. I would like users to access the site, but would also like to log user ID's in the access log, without prompting users for an ID/Password.
Is... (1 Reply)
Discussion started by: shuterj
1 Replies
2. HP-UX
I am getting the following error message when trying to login to the client:
while verifying tgt
If I move the /etc/krb5.keytab out of /etc, it works fine. This is HP-UX v23
Does anyone have any ideas? (1 Reply)
Discussion started by: dhernand
1 Replies
3. AIX
I'm having a bear of a time getting my LDAP connection going, so I hope someone here has some insight.
I have AIX 5.3 running on an LPAR. I have ldap-client, ldap-max-crypto-client, gskak, and gskte installed. I'm able to set up the connection via mksecldap, and I can query users just fine... (1 Reply)
Discussion started by: AlexDeGruven
1 Replies
4. Red Hat
RedHat ELS 5.2 & Sun directory
getent passwd: works
toto:*:1000:100:toto:/home/toto:/bin/bash
getent group: works
mygroup:*:10001:1000,1001
but id toto doesnt works :(
uid=1000(toto) gid=100(users) groupes=100(users)
BTW in /etc/ldap.conf i use a different mapping for the posix... (4 Replies)
Discussion started by: sncr24
4 Replies
5. UNIX for Advanced & Expert Users
Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is..
I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs... (9 Replies)
Discussion started by: raidzero
9 Replies
6. Emergency UNIX and Linux Support
Hi all
We have squid-2.5.STABLE11-3.FC4 running in our environment.
LDAP authentication works fine. Active Directory 2003 Users are prompted to enter credentials every time they access the net. The system works perfectly, but I need to configure Squid to block users in a specific AD group.... (1 Reply)
Discussion started by: wbdevilliers
1 Replies
7. AIX
@kah00na and all others,
i have done al steps of the HowTo "Authenticate AIX users from MSActive Directory", found in this forum, but it still does not work.
The test with kinit USERNAME works fine. But if i try to login i get the "UNKNOWN_USER" error in the debug.log.All steps to change... (11 Replies)
Discussion started by: tomys
11 Replies
8. AIX
The KRB5ALDAP compound load module is giving me fits. Everything looks like it should be working, but no.
Goal: Integrate AIX host with Active Directory using a KRB5ALDAP compound load module so that users can be created in AD and used in AIX, with unix attributes (registry values) being... (2 Replies)
Discussion started by: jgeiger
2 Replies
9. Gentoo
Hi,
since the upgrade to Gnome 3.6 (now i have 3.8) the authentication over LDAP stops working. The whole machine does not start anymore. The machine boot, but no gdm and no X. I can login, with root, but then the tty hangs. When i look at ttyF12 i see a lot of systemd service the runs random,... (1 Reply)
Discussion started by: darktux
1 Replies
10. UNIX for Advanced & Expert Users
Has anyone attempted to define GPO / HBAC policies in Windows Server 2012 that could be respected by Kerberos/LDAP on AIX?
I'm looking to associate servers to groups so that when a user part of a group tries to login to a host not associated with that group, it would be denied. This would allow... (3 Replies)
Discussion started by: Devyn
3 Replies
LEARN ABOUT REDHAT
kdestroy
KDESTROY(1) General Commands Manual KDESTROY(1)
NAME
kdestroy - destroy Kerberos tickets
SYNOPSIS
kdestroy [-5] [-4] [-q] [-c cache_name]
DESCRIPTION
The kdestroy utility destroys the user's active Kerberos authorization tickets by writing zeros to the specified credentials cache that
contains them. If the credentials cache is not specified, the default credentials cache is destroyed. If kdestroy was built with Kerberos
4 support, the default behavior is to destroy both Kerberos 5 and Kerberos 4 credentials. Otherwise, kdestroy will default to destroying
only Kerberos 5 credentials.
OPTIONS
-5 destroy Kerberos 5 credentials. This overrides whatever the default built-in behavior may be. This option may be used with -4
-4 destroy Kerberos 4 credentials. This overrides whatever the default built-in behavior may be. This option is only available if
kinit was built with Kerberos 4 compatibility. This option may be used with -5
-q Run quietly. Normally kdestroy beeps if it fails to destroy the user's tickets. The -q flag suppresses this behavior.
-c cache_name
use cache_name as the credentials (ticket) cache name and location; if this option is not used, the default cache name and location
are used.
The default credentials cache may vary between systems. If the KRB5CCNAME environment variable is set, its value is used to name
the default ticket cache.
Most installations recommend that you place the kdestroy command in your .logout file, so that your tickets are destroyed automatically
when you log out.
ENVIRONMENT
Kdestroy uses the following environment variables:
KRB5CCNAME Location of the Kerberos 5 credentials (ticket) cache.
KRBTKFILE Filename of the Kerberos 4 credentials (ticket) cache.
FILES
/tmp/krb5cc_[uid] default location of Kerberos 5 credentials cache ([uid] is the decimal UID of the user).
/tmp/tkt[uid] default location of Kerberos 4 credentials cache ([uid] is the decimal UID of the user).
SEE ALSO
kinit(1), klist(1), krb5(3)
BUGS
Only the tickets in the specified credentials cache are destroyed. Separate ticket caches are used to hold root instance and password
changing tickets. These should probably be destroyed too, or all of a user's tickets kept in a single credentials cache.
KDESTROY(1)