Repository navigation
Kerberos #8791
Replies: 1 comment 7 replies
|
Hey did you ever resolve this? I was just looking at the container and realized it did not have any binaries with which to create a keytab so also started thinking about mounting an externally generated keytab but not sure that that is even supposed to work. |
|
Looks like my issue was actually not kerberos but trying to use FreeIPA OTP with kerberos instead of SSSD. |
|
The documentation mentions a script called |
|
When I had this issue it was the Computer did not trust the domain for kerberos authentication (Active Directory). When adding to the GPO the url of the keycloak as trusted site (internet options) , it started working. |
|
@syniex how did you realize this was the problem? The only message that I get when I try to login via browser is "Kerberos is not set up. You cannot login." But I dont know if that message say its not set up on the server or on my browser the right way? |
Wireshark, I saw the 401 status code keycloak sent to the browser with Authorization WWW negotiate. Then I saw on the keycloak log the Spengo/gssapi error. That told me the keyclock is trying to do kerberos authentication but the browser rejected it (it will prompt you like http basic authentication) Hopes that will help you. |
Uh oh!
There was an error while loading. Please reload this page.
Hello, im running keycloak in a kubernetes environment and ive some issues with getting kerberos authentication to work.
Ive genereated a keytabfile and mounted that file to the pod and ive given the path to the keytab file in the kerberos configuration, but when i try to login using kerberos i get this error: 15:06:28,430 WARN [org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator] (default task-27) SPNEGO login failed: java.security.PrivilegedActionException: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
any ideas?
All reactions