Home / server / Questions / 914939
In Process
jouell
Asked: 2018-06-03 15:27:54 +0800 CST

IE 10 not authenticating Cross Realm (Window AD to Unix/MIT Kerberos) via SPNego

  • 772

Setup:

  1. Domain1 - Win Server 2016 DC - PATRICA.COM

  2. Win 7 Client is joined to Domain 1 - viewing shares on the DC work fine. www.thomas.com is added to 'local network' in IE 10

  3. Domain2 - MIT Kerberos KDC - THOMAS.COM

  4. Apache WWW/Mod_auth_kerb - keytabs for HTTP/[email protected] and other relevant forms.
  5. Unix/Ubuntu client

All on 192.168.0.X - test network.

Two-way transitive trust setup w/same password.

The unix client can make a kerberized connection OK to WWW.

The windows client does not seem to lookup how to find THOMAS.COM. It looks up it's DNS name and does get a 401 Negoatiate back from the WWW server and then tries ntlm. I've tried running "ksetup /addkdc REALM IP" on both the windows client and the win 2016 DC. How does the client figure out www.thomas.com is part of THOMAS.COM?

active-directory

0 Answers