Home / server / Questions / 259548
Accepted
Maurice Perry
Asked: 2011-04-15 00:30:02 +0800 CST

NTLM token sent instead of Kerberos ticket

  • 772

I am trying to implement kerberos SSO in our network using spnego on a tomcat server.

We have created an account (TCNKRBGINA) on the domain for the preauthentication, and setspn'ed it to the http server:

Setspn -A HTTPS/testtech.etat-ge.ch TCNKRBGINA
Setspn -A HTTP/testtech.etat-ge.ch TCNKRBGINA

But the client (IE or Firefox) sends an NTLM token instead of a kerberos ticket.

The problem doesn't seem to be on the server side because, when no Authorization header is sent, it correctly returns a 401 status code with a WWW-Authenticate: Negotiate header. The next request sent by the client contains the NTLM token, before the server had a chance to contact the domain controller.

windows-server-2008 kerberos spnego

1 Answers

  1. Best Answer

    Got it, thanks to wireshark. The server name testtech.etat-ge.ch was defined in the DNS as an alias for bleutest.ceti.etat-ge.ch. It seems that the name used by kerberos is obtained by a reverse-lookup.

    • 5