Trying to make Windows Server 2016 Active Directory + Kerberos and Java OpenJDK 8 kinit to obtain a ticket-granting ticket returns KrbException: Identifier doesn't match expected value (906)

I have two Azure VMs, and I want to obtain a kinit ticket-granting-ticket with Windows Server 2016, one at 10.0.1.4 and the other at 10.0.1.7.

The 10.0.1.4 VM contains an Active Directory with LDAP and a DNS Server. The computer name is WinServer2016Fo. So the Active Directory Domain Controller is WinServer2016Fo.corp.demo.com and the Kerberos Key Distribution Center is WINSERVER2016FO.CORP.DEMO.COM, as I understand it is the domain controller name, all in uppercase.

The 10.0.1.7 VM contains Java OpenJDK 8. The computer name is demoMachine. I have verified with Telnet that I can connect from 10.0.1.7 to WinServer2016Fo.corp.demo.com (10.0.1.4) using port 88 (the one which Kerberos uses).

The Domain is corp.demo.com, I created an user for that domain, called demoHttp with password demoHttp

I have linked the user demoHttp to demoMachine using setspn as follows:

setspn -S HTTP/demoMachine.corp.demo.com demoHttp

Then I created the krb5.keytab as follows:

ktpass -out krb5.keytab -princ HTTP/[email protected] -mapUser demoHttp -mapOp set -pass demoHttp -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL

The krb5.ini at the 10.0.1.7 (demo.corp.demo.com VM):

[libdefaults]
          default_realm = CORP.DEMO.COM
          default_keytab_name = FILE:c:\Windows\krb5.keytab
          default_tkt_enctypes = rc4-hmac 
          default_tgs_enctypes = rc4-hmac 
          forwardable  = true
          renewable  = true
          noaddresses = true
          clockskew  = 300
          udp_preference_limit = 1
          allor_weak_crypto = true
[realms]
          CORP.DEMO.COM = {
                kdc = WinServer2016Fo.corp.demo.com:88
                default_domain = corp.demo.com
    }
[domain_realm]
        corp.demo.com = CORP.DEMO.COM

The problem is when I try to run kinit with OpenJDK 8:

kinit.exe "-J-Dsun.security.krb5.debug=true" -k -t C:\Windows\krb5.keytab HTTP/demoMachine.corp.demo.com

It throws the following exception:

PS C:\Users\demoHttp> .\Downloads\openjdk-8u41-b04-windows-i586-14_jan_2020\java-se-8u41-ri\bin\kinit.exe "-J-Dsun.security.krb5.debug=true" -k -t C:\Windows\krb5.keytab HTTP/demoMachine.corp.demo.com
Java config name: null
LSA: Found Ticket
LSA: Made NewWeakGlobalRef
LSA: Found PrincipalName
LSA: Made NewWeakGlobalRef
LSA: Found DerValue
LSA: Made NewWeakGlobalRef
LSA: Found EncryptionKey
LSA: Made NewWeakGlobalRef
LSA: Found TicketFlags
LSA: Made NewWeakGlobalRef
LSA: Found KerberosTime
LSA: Made NewWeakGlobalRef
LSA: Found String
LSA: Made NewWeakGlobalRef
LSA: Found DerValue constructor
LSA: Found Ticket constructor
LSA: Found PrincipalName constructor
LSA: Found EncryptionKey constructor
LSA: Found TicketFlags constructor
LSA: Found KerberosTime constructor
LSA: Finished OnLoad processing
Native config name: C:\windows\krb5.ini
Loaded from native config
>>>KinitOptions cache name is C:\Users\demoHttp\krb5cc_demoMachineHttp
Principal is HTTP/[email protected]
>>> Kinit using keytab
>>> Kinit keytab file name: C:\Windows\krb5.keytab
>>> Kinit realm name is CORP.DEMO.COM
>>> Creating KrbAsReq
>>> KrbKdcReq local addresses for elm are:

        demoMachine/10.0.1.7
IPv4 address

        demoMachine/fe80:0:0:0:fc1c:feca:403e:10f7%6
IPv6 address
>>> KdcAccessibility: reset
>>> KeyTabInputStream, readName(): WINSERVER2016FO.CORP.DEMO.COM
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): demoMachine.corp.demo.com
>>> KeyTab: load() entry length: 95; type: 23
Looking for keys for: HTTP/[email protected]
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 17 16 23.
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes available; only have keys of following t
ype:  No error
KrbException: Do not have keys of types listed in default_tkt_enctypes available; only have keys of following type:
        at sun.security.krb5.internal.crypto.EType.getDefaults(EType.java:280)
        at sun.security.krb5.KrbAsReqBuilder.build(KrbAsReqBuilder.java:261)
        at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:315)
        at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
        at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)
        at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)
PS C:\Users\demoHttp>

Another test:

PS C:\Users\demoHttp> .\Downloads\openjdk-8u41-b04-windows-i586-14_jan_2020\java-se-8u41-ri\bin\kinit.exe "-J-Dsun.security.krb5.debug=true" -k -t C:\Windows\krb5.keytab H
P/[email protected]
>>>KinitOptions cache name is C:\Users\demoHttp\krb5cc_demoHttp
Principal is HTTP/[email protected]
>>> Kinit using keytab
>>> Kinit keytab file name: C:\Windows\krb5.keytab
Java config name: null
LSA: Found Ticket
LSA: Made NewWeakGlobalRef
LSA: Found PrincipalName
LSA: Made NewWeakGlobalRef
LSA: Found DerValue
LSA: Made NewWeakGlobalRef
LSA: Found EncryptionKey
LSA: Made NewWeakGlobalRef
LSA: Found TicketFlags
LSA: Made NewWeakGlobalRef
LSA: Found KerberosTime
LSA: Made NewWeakGlobalRef
LSA: Found String
LSA: Made NewWeakGlobalRef
LSA: Found DerValue constructor
LSA: Found Ticket constructor
LSA: Found PrincipalName constructor
LSA: Found EncryptionKey constructor
LSA: Found TicketFlags constructor
LSA: Found KerberosTime constructor
LSA: Finished OnLoad processing
Native config name: C:\windows\krb5.ini
Loaded from native config
>>> Kinit realm name is WINSERVER2016FO.CORP.DEMO.COM
>>> Creating KrbAsReq
>>> KrbKdcReq local addresses for elm are:

        demoMachine/10.0.1.7
IPv4 address

        demoMachine/fe80:0:0:0:fc1c:feca:403e:10f7%6
IPv6 address
>>> KdcAccessibility: reset
>>> KeyTabInputStream, readName(): WINSERVER2016FO.CORP.DEMO.COM
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): demoMachine.corp.demo.com
>>> KeyTab: load() entry length: 95; type: 23
Looking for keys for: HTTP/[email protected]
Added key: 23version: 44
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 17 16 23.
>>> KrbAsReq creating message
getKDCFromDNS using UDP
getKDCFromDNS using TCP
>>> KrbKdcReq send: kdc=WinServer2016Fo TCP:88, timeout=30000, number of retries =3, #bytes=246
>>> KDCCommunication: kdc=WinServer2016Fo TCP:88, timeout=30000,Attempt =1, #bytes=246
>>>DEBUG: TCPClient reading 140 bytes
>>> KrbKdcReq send: #bytes read=140
>>> KdcAccessibility: remove WinServer2016Fo
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
         sTime is Wed Sep 30 20:02:17 UTC 2020 1601496137000
         suSec is 459157
         error code is 68
         error Message is null
         sname is krbtgt/[email protected]
         msgType is 30
Exception: krb_error 68 null (68) null
KrbException: null (68)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:76)
        at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
        at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
        at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)
        at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)
Caused by: KrbException: Identifier doesn't match expected value (906)
        at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
        at sun.security.krb5.internal.ASRep.init(ASRep.java:64)
        at sun.security.krb5.internal.ASRep.<init>(ASRep.java:59)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:60)
        ... 4 more
PS C:\Users\demoHttp>

Goal

I'm setting up multi-user CIFS mounts in an Active Directory environment under CentOS 8.2. The storage server supports SMB3.1.1 protocol.

Prerequisites

I could easily integrate the system to the Active Directory and I've edited SSSD (/etc/sssd/sssd.conf) and realm configuration to match preferences and needs.

Results:

• Active Directory users can login

I've also created a dedicated user that I'll name in this post "mountorino". mountorino has required share permissions (RO) and NTFS permissions (traverse root folder) to mount the CIFS shares. Identification information is stored in the /root/cifs.cred file.

Scenario A: NTLM

Mounting the CIFS shares with the multiuser and ntlmsspi options:

//<server>/<share> /mnt/<mount point> cifs auto,_netdev,rw,noexec,nodev,nosuid,noperm,cache=strict,hard,vers=3.1.1,multiuser,sec=ntlmsspi,credentials=/root/cifs.cred 0 0

Results:

• It works as long as, from the end-user context, I run the cifscreds add --username <user> <server> command
• It doesn't work if I run cifscreds add --username <user> --domain <domain> command

Scenario B: Kerberos

Mounting the CIFS shares with the multiuser, krb5i, and cruid options:

//<server>/<share> /mnt/<mount point> cifs auto,_netdev,rw,noexec,nodev,nosuid,noperm,cache=strict,hard,vers=3.1.1,multiuser,sec=krb5i,cruid=0,credentials=/root/cifs.cred 0 0

Results:

• It works as long as, as root, I run the kinit mounterino@<DOMAIN> command

Questions:

• With NTLM, why cifscreds add --username <user> --domain <domain> doesn't work? The user, the server and the client all are members of the same Windows domain!
• More importantly, with Kerberos, how can I make root to get a Kerberos ticket before automounting fstab entries happens? I understand that by generating a keytab file, I won't have to type moutorino password when running kinit, which allows to automate kinit usage. But how do I make sure kinit is run before automounts are mounted? PAM? systemd unit?

Sources

• https://computingforgeeks.com/join-centos-rhel-system-to-active-directory-domain/
• https://access.redhat.com/articles/3023821
• https://superuser.com/questions/1498295/how-can-i-write-to-dfs-share-with-different-users-other-than-mount-user-on-the-l
• FSTAB CIFS kerberos

Best regards, MauvaisJoueur

I m trying to authenticate the host for kbr5p nfs mount where Microsoft active directory is acting as the Kerberos server.

sudo kinit -k -t /etc/krb5.keytab host/[email protected]
kinit: Client 'host/[email protected]' not found in Kerberos database while getting initial credentials

But in Active directory the following commands works

PS C:\Program Files\vmware\VMware OVF Tool> setspn -l ROBODAROBODA
Registered ServicePrincipalNames for CN=ROBODAROBODA,CN=Computers,DC=example,DC=com:
        host/[email protected]
        HOST/robodaroboda.example.com
        HOST/ROBODAROBODA

In the packet trace, unknown principal error is observed. Request:

    Kerberos AS-REQ
        Record Mark: 202 bytes
            0... .... .... .... .... .... .... .... = Reserved: Not set
            .000 0000 0000 0000 0000 0000 1100 1010 = Record Length: 202
        Pvno: 5
        MSG Type: AS-REQ (10)
        padata: Unknown:149
            Type: Unknown (149)
                Value: <MISSING>
        KDC_REQ_BODY
            Padding: 0
            KDCOptions: 00000010 (Renewable OK)
                .0.. .... .... .... .... .... .... .... = Forwardable: Do NOT use forwardable tickets
                ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket
                ...0 .... .... .... .... .... .... .... = Proxiable: Do NOT use proxiable tickets
                .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied
                .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated
                .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated
                .... .... 0... .... .... .... .... .... = Renewable: This ticket is NOT renewable
                .... .... ...0 .... .... .... .... .... = Opt HW Auth: False
                .... .... .... ..0. .... .... .... .... = Constrained Delegation: This is a normal request (no constrained delegation)
                .... .... .... ...0 .... .... .... .... = Canonicalize: This is NOT a canonicalized ticket request
                .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled
                .... .... .... .... .... .... ...1 .... = Renewable OK: We accept RENEWED tickets
                .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt using the skey
                .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket
                .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket
 Client Name (Principal): host/ROBODAROBODA
            Name-type: Principal (1)
            Name: host
            Name: ROBODAROBODA
            Server Name (Service and Instance): krbtgt/EXAMPLE.COM
                Name-type: Service and Instance (2)
                Name: krbtgt
                Name: EXAMPLE.COM
            till: 2020-04-05 18:37:06 (UTC)
            Nonce: 407713677
            Encryption Types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des-cbc-md5-nt 19 des3-cbc-sha1 rc4-hmac 25 26
                Encryption type: aes256-cts-hmac-sha1-96 (18)
                Encryption type: aes128-cts-hmac-sha1-96 (17)
                Encryption type: des-cbc-md5-nt (20)
                Encryption type: Unknown (19)
                Encryption type: des3-cbc-sha1 (16)
                Encryption type: rc4-hmac (23)
                Encryption type: Unknown (25)
                Encryption type: Unknown (26)

Response:

Kerberos KRB-ERROR
    Record Mark: 112 bytes
        0... .... .... .... .... .... .... .... = Reserved: Not set
        .000 0000 0000 0000 0000 0000 0111 0000 = Record Length: 112
    Pvno: 5
    MSG Type: KRB-ERROR (30)
    stime: 2020-04-04 18:37:06 (UTC)
    susec: 931508
    error_code: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN (6)
    Realm: EXAMPLE.COM
    Server Name (Service and Instance): krbtgt/EXAMPLE.COM
        Name-type: Service and Instance (2)
        Name: krbtgt
        Name: EXAMPLE.COM

Can anyone please help me understand why I am seeing the unknown principal error?

I've got a strange problem with an Active Directory SPN Account.

This does not work: kinit HTTP/[email protected]

However, "setspn -l SA_MyUser" lists "HTTP/my.host.com" as registered service principal. It has got to be a problem withthe AD account, but what could it be?

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server.

I am following the official Ubuntu guide to set up a Kerberos client here: https://help.ubuntu.com/community/Samba/Kerberos, but I have encountered a problem when running the kinit command to connect to the domain server.

The command I am running is: kinit [email protected]. This command returns the following error:

Realm not local to KDC while getting initial credentials. Unfortunately, I cannot find any one else via Google searches that have experienced this exact error, so I have no idea what it means.

The client is able to ping the server's hostname, so the DNS server is pointing to the domain server.

Below is my krb5.conf file:

[libdefaults]
default = DS.DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc true

[realms]
    DS.DOMAIN.COM = {
        kdc = ds.domain.com:88
        admin_server = ds.domain.com
        default_domain = domain.com
    }

[domain_realm]
    .domain.com = DS.DOMAIN.COM
    domain.com = DS.DOMAIN.COM

How can I correct these errors? I would greatly appreciate all help I can get!