【发布时间】：2015-02-15 14:08:19
【问题描述】：
下午好 SSO 不起作用（客户端 IE 9、FireFox 38）
error.httpd.log
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1944): [client 172.20.204.231] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1944): [client 172.20.204.231] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1279): [client 172.20.204.231] Acquiring creds for HTTP/itsm-dev@TEST.DOMAIN.COM.UA
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1698): [client 172.20.204.231] Verifying client data using KRB5 GSS-API
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1714): [client 172.20.204.231] Client didn't delegate us their credential
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1742): [client 172.20.204.231] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.
[Sun Feb 15 10:06:02 2015] [debug] src/mod_auth_kerb.c(1139): [client 172.20.204.231] GSS-API major_status:00070000, minor_status:00000000
[Sun Feb 15 10:06:02 2015] [error] [client 172.20.204.231] gss_accept_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible (, Unknown error)
export KRB5_TRACE=/dev/stdout
kinit -V -k -t /etc/krb5.keytab -p HTTP/itsmproxy.test.domain.com.ua@test.domain.com.ua
Using default cache: /tmp/krb5cc_0
Using principal: HTTP/itsmproxy.test.domain.com.ua@test.domain.com.ua
Using keytab: /etc/krb5.keytab
[16729] 1424007693.340272: Getting initial credentials for HTTP/itsmproxy.test.domain.com.ua@test.domain.com.ua
[16729] 1424007693.342682: Looked up etypes in keytab: (empty
[16729] 1424007693.342729: Getting initial credentials for HTTP/itsmproxy.test.domain.com.ua@test.domain.com.ua
[16729] 1424007693.342780: Looked up etypes in keytab: (empty
kinit: Keytab contains no suitable keys for HTTP/itsmproxy.test.domain.com.ua@test.domain.com.ua while getting initial credentials
klist -kte /etc/krb5.keytab2
Keytab name: FILE:/etc/krb5.keytab2
KVNO Timestamp Principal
---- ----------------- --------------------------------------------------------
5 01/01/70 03:00:00 HTTP/itsm-dev@TEST.DOMAIN.COM.UA (arcfour-hmac)
问题可能出在哪里？
【问题讨论】：
-
您需要清楚自己要做什么以及问题所在。目前，您的问题只是一大段日志文本，而不是问题。
-
SSO 不起作用。为什么不知道。担心的日志条目：警告：收到的令牌似乎是 NTLM，Kerberos 模块不支持。检查您的 IE 配置。
-
虽然 kvno 说一切都很好：kvno HTTP/itsm-dev@TEST.DOMAIN.COM.UA HTTP/itsm-dev@TEST.DOMAIN.COM.UA: kvno = 5
标签： linux apache single-sign-on rhel