I have created a K8S cluster on a macOS machine using kind. I have an echo-service running on that cluster that I can access on localhost when kubectl port-forward svc/echo-service 7893:7893 is running.
I would have expected to be able to access the service on the K8S cluster IP (http://10.104.60.162:7893/), but that doesn't work. Did I miss something?
I am trying to query the "member" attribute of a groupOfNames object, and in AD, I can be sure to retrieve all of them, should they exceed the maximum of 1000 entries, by using ranged attribute queries. They look like this:
member;range=0-999
This seems not to work in OpenLDAP, I get no member attributes back at all. What is the alternative, if there is one?
Title says it all: from which version onward is the LimitRequestFieldSize no longer hardcoded to a max. of 8k?
It seems 2.2.15 is still affected.
I've got an Apache2 httpd running in front of a Tomcat, doing authentication via mod_auth_kerb.
When I open the console in Firebug, I see lots of 401's
See screenshot:
Is there a way to avoid this? I guess its causing an additional roundtrip which impacts performance.
We have a strange problem regarding Kerberos authentication with Apache mod_auth_kerb. We use a very simple krb5.conf, where only a single (main) AD server is configured. There are many domains in the forest, and it seems that SSO is working for most of them, except one.
I don't know what is special about that domain, the error message that I see in the Apache logs is "Server not found in Kerberos database":
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(1025): [client xx.xxx.xxx.xxx] Using HTTP/[email protected] as server principal for password verification
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(714): [client xx.xxx.xxx.xxx] Trying to get TGT for user [email protected]
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(625): [client xx.xxx.xxx.xxx] Trying to verify authenticity of KDC using principal HTTP/[email protected]
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(640): [client xx.xxx.xxx.xxx] krb5_get_credentials() failed when verifying KDC
[Wed Aug 31 14:56:02 2011] [error] [client xx.xxx.xxx.xxx] failed to verify krb5 credentials: Server not found in Kerberos database
[Wed Aug 31 14:56:02 2011] [debug] src/mod_auth_kerb.c(1110): [client xx.xxx.xxx.xxx] kerb_authenticate_user_krb5pwd ret=401 user=(NULL) authtype=(NULL)
When I try to kinit that user on the machine on which Apache is running, it works. I also checked that DNS lookups work, including reverse lookup.
Who can tell me whats going?
I've got a strange problem with an Active Directory SPN Account.
This does not work: kinit HTTP/[email protected]
However, "setspn -l SA_MyUser" lists "HTTP/my.host.com" as registered service principal. It has got to be a problem withthe AD account, but what could it be?
Iv'e got a Java app that is SSO-enabled using Kerberos under the URL http://alf-test.example.com/. Unfortunately somethings not working, the AD says it doesn't know the service principal. This is the TGS-REQ exchange:
Request:
Kerberos TGS-REQ
Record Mark: 1499 bytes
0... .... .... .... .... .... .... .... = Reserved: Not set
.000 0000 0000 0000 0000 0101 1101 1011 = Record Length: 1499
Pvno: 5
MSG Type: TGS-REQ (12)
padata: PA-TGS-REQ
KDC_REQ_BODY
Padding: 0
KDCOptions: 40810000 (Forwardable, Renewable, Canonicalize)
Realm: EESERV.LOCAL
Server Name (Service and Instance): HTTP/alf-test.example.com
Name-type: Service and Instance (2)
Name: HTTP
Name: alf-test.example.com
till: 2037-09-13 02:48:05 (UTC)
Nonce: 632225483
Encryption Types: rc4-hmac rc4-hmac-old rc4-md4 des-cbc-md5 des-cbc-crc rc4-hmac-exp rc4-hmac-old-exp
Reply:
Kerberos KRB-ERROR
Record Mark: 125 bytes
0... .... .... .... .... .... .... .... = Reserved: Not set
.000 0000 0000 0000 0000 0000 0111 1101 = Record Length: 125
Pvno: 5
MSG Type: KRB-ERROR (30)
stime: 2011-06-08 12:06:23 (UTC)
susec: 23385
error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7)
Realm: EESERV.LOCAL
Server Name (Service and Instance): HTTP/alf-test.example.com
Name-type: Service and Instance (2)
Name: HTTP
Name: alf-test.example.com
e-data
However, the following works:
kinit HTTP/alf-test.example.com
Also, I get this output when I want setspn to list the service principal names, which looks good to me:
setspn -l test-alfrescohttp
Registered ServicePrincipalNames for CN=Alfresco-Test HTTP,CN=Users,DC=example,DC=com:
HTTP/alf-test
HTTP/alf-test.example.com
So, the service principal seems to exist, but I constantly see the KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN error in Wireshark when the browser first hits the host. I'm confused, what could be wrong here?
Best regards, Michael
I have a problem with NTLM single-sign-on with IE8.
We've got multiple domain controllers and users from multiple domains that we try to authenticate to a web application via NTLMv1 passthru.
Somehow IE fails to send the user's domain in the NTLM Type 1 message. This has the effect that the webapp can not match users properly to their domain controllers, resulting in failed logon attempts, because a user from domain X tries to authenticate to domain controller Y.
This problem does not occur with Firefox, as it always sends the correct domain header.
So: how do I get IE to send the domain in the NTLM header?
I have a remote win xp machine to which I connect via RDP. When I open a Cisco VPN connection (4.8 client) on that machine, the RDP connection drops because all traffic is routed over the VPN connection now.
Is there a way to make this work?
me => rdp => winXp => vpn => target