Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Captain's Log, star date 21:34.5...

devel / comp.protocols.kerberos / Re: GSS-API error gss_accept_sec_context: Request ticket server HTTP/ not found in keytab

SubjectAuthor
o Re: GSS-API error gss_accept_sec_context: Request ticket server HTTP/Kerberos Enthusiast

1
Re: GSS-API error gss_accept_sec_context: Request ticket server HTTP/ not found in keytab

<mailman.125.1668495201.8148.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=326&group=comp.protocols.kerberos#326

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: kerberos...@gmail.com (Kerberos Enthusiast)
Newsgroups: comp.protocols.kerberos
Subject: Re: GSS-API error gss_accept_sec_context: Request ticket server HTTP/
not found in keytab
Date: Tue, 15 Nov 2022 09:12:05 +0530
Organization: TNet Consulting
Lines: 79
Message-ID: <mailman.125.1668495201.8148.kerberos@mit.edu>
References: <CAGshih-EXCKjUbs0EGjOUL9fn5ZrAnqWP5wvgX=-xVPUTTKr5Q@mail.gmail.com>
<CAGshih9QY8hga0WDf+uc-Fgt6m3AUFLsas7LgtVNMQjs3m-K6A@mail.gmail.com>
<81516897-8535-0d62-ac52-3ffaf151d86f@mit.edu>
<CAGshih_gaYUyR6mNE4AdDm-37AatrnMXRrK=yUvxuUZYr6MVdw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="11222"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: kerberos@mit.edu
To: Greg Hudson <ghudson@mit.edu>
Authentication-Results: mit.edu;
dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-Results: mit.edu; arc=pass smtp.remote-ip=18.9.3.18
ARC-Seal: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1668483784; cv=pass;
b=Uk1slat36jBMIIK6oFw/rUYM4sc79e2xtTGJr67FGjJZC4UVMTxFQVgs4Fraxd8gIekk2sQQgv8OpZfqlvWFVwLWQY33hvSEKy5qCHXb+zewFe7KioP402J0HIASMQBzmkzYH2AiC2Y61UF2S5Ej86x5JvPYBD9gemZkt92IOUhfhPojdVbgliNOmT5Abbw8YObmNSYTmdsBvGDrJXKD1Jtrt9PE9vNFW4RV6itgwfba7gQXdIHoOCIB71ecYo5mB/3MlsbOMBCFyMdxmqgTkm3/wt0/GVadEeIjXfdLXuiXysMWHV3T+BcrhpbcCQUQaemJG9eNzs8GBgZci2oOHQ==
ARC-Message-Signature: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1668483784;
c=relaxed/relaxed; bh=TjrT6pJ05Sn4BzDYz+/fl+SqZTVNGRoKmUBypJd5ZzM=;
h=DKIM-Signature:DKIM-Signature:MIME-Version:From:Date:Message-ID:
Subject:To;
b=HFH1gcIgFZcFMLJI44FJMvPPcMDGqBsbko+3BbvjnZiQQx8fg1drFi1YZFV9Cy8VsZQ5fQbZ1NtRK0G4g/JFkY07NtImrf+PghkGG8nvSADUdPfM5XnD3+t3z3unrEQFYcRZglbEoQjbgpswCRmLEhKpdftoV5HcwRzfkquYVl9kdX06tvV+Ycwvl8a5Vi6fiT9AR/b5JRH2ExnmqPQ9z6aEEJYjHd/ZbrhLvd5Tz0L+CeUCBo2cYU1VZQQYYbcfWVyVsM8Fx7jNpJ6r2oHDL/a5QUaiKq6tV0TTQzQ9/C2qCj7XXmCjVbO3taAPRTYZQ0jrVJ8M/xVfzH2QgNpdLQ==
ARC-Authentication-Results: i=2; mit.edu; dkim=pass (1024-bit key)
header.d=mitprod.onmicrosoft.com header.i=@mitprod.onmicrosoft.com
header.b=OTw/FsWw;
dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com
header.b=q7FwJNDr
Authentication-Results: mit.edu;
dkim=pass (1024-bit key) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.b=OTw/FsWw;
dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com
header.b=q7FwJNDr
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=DKMRyT8wEQwzT8VU3rx90j4L0ywkHZR+YjVB7u5xxAvjX8/oeRyGz16J6pJ/UwEQmZjTWgUJhWJyy07Y7lCoQJjTmXMURTVIworOlcqeb3YfrCgs12TdV2/WWG0YhqSjI/UDVwTk/jDX0iNBkluZqG/dA8jVRB+lTfDCh3zP9L/Vqq/keZ2C0ysO7BxLmoF63jpRui+ZRdyVVynZlmnFde+kaNdTnZHnh6o64tUkKG3PISlOd6qGZ3ybH9r/2+NIKego+1QueTBeuUdpnhFhhyhqmNv8bnyu414EZ+ZS0LycoVguM/YdzupuZw2mQdcHkQqegYQkn0g9Oyd/D4rDMA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=TjrT6pJ05Sn4BzDYz+/fl+SqZTVNGRoKmUBypJd5ZzM=;
b=n+v9IkdEm6cPYDYaf1fe4QAfs/YGVjjqevd64X7gkLormQire4h9JPal/hF8AZ+OVgMQu12C2DjH8PysAEvUckrsfLJjuEQWTFY4uRyXo2GQ9ofdIpUE6QVWIQUVNM4CxhkM+bS9pJVNqDFL0pykBP8JvojYW5EpIR1oSE7etIBfaLVpdeNWfz80/cbGSY2px0YGSZ6B6id5AwxibU21ozZhaH8YQlszfCI+u8qljJuvVARdIHpYsqHhzTY4wHdhBMaHFQ4lJ+YVzW75TgqDIErt5EGMmV/mcZtNQAnwzUrYZ9hYX0cGQ7YJa22UX3nrhLxS87AxRTaKGy3XSwOT4w==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
209.85.167.169) smtp.rcpttodomain=mit.edu smtp.mailfrom=gmail.com; dmarc=pass
(p=none sp=quarantine pct=100) action=none header.from=gmail.com; dkim=pass
(signature was verified) header.d=gmail.com; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=TjrT6pJ05Sn4BzDYz+/fl+SqZTVNGRoKmUBypJd5ZzM=;
b=OTw/FsWwjddov2w8XI3UceR81v6g/ls2n7axVC9UkUNCiPIjxMMilEuO89yMbH96I4sRfJdNySUN5fgLPi6mnrw7G8BYZXOHIulUsi6bUhjBqEXYbj08enS3CTpXkzrjooTNEARaUpTa5v3hxXJFSfRolnqobVyLG9dJkqXCuSE=
Authentication-Results: spf=pass (sender IP is 209.85.167.169)
smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.167.169 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.167.169; helo=mail-oi1-f169.google.com; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
h=cc:to:subject:message-id:date:from:in-reply-to:references
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=TjrT6pJ05Sn4BzDYz+/fl+SqZTVNGRoKmUBypJd5ZzM=;
b=q7FwJNDrb+PdmJzupxMHjiXUcVo7ROo2QvpzsPHtJL4S4TPZN/lQDVgQDR+F5okjvb
AV4Vk60U8toQ6Tb3R5v6UQ5dwOhJOGrZWsrXO48grpPFM7+jpl4hdxiMROkTxYLiN1EX
G/ThzRvZnLHPoVCtVzkb5+13uXmn6XZGMwz+xeVBu/RGaHiRAz+lqohEJlGvIvER7his
Ai4J2ffRpALrAal5WhQIuN2v9rP60Htn0QfPQTeZDNaqlhbrCHf6qIGLZM3GflWr/Jlh
auFQBX4rSbx/87UUDsoHIvHUAwBiIsw+cfsYdLcGSXp9n5Ywi9MaG3RMKdp9zAY8Yl0x
bKog==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=cc:to:subject:message-id:date:from:in-reply-to:references
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=TjrT6pJ05Sn4BzDYz+/fl+SqZTVNGRoKmUBypJd5ZzM=;
b=wN4gsMGm7xUwjzfNFRBikHV4hzB7Y8iDwHX5aYPT7hYPy8uFrZajYzb4wLOCGSLuBt
xYQJEpSFpNGDkyayh6TBJWogCfJS16Ofvatv0MkkME4S86q68u9iYUCiGhjB0N89LWBJ
3YTu0MMi6E8wHWeHwBxg7EqFAiMdQ1nnQlDA4SP3chL3zLI8ZeNs28MMOBTaMBSSCu80
+aartPGqwk9PPeb7kTYU9btOKhe+mjXdDYtXlN89+925HOoPkj95Urb226PA9oy8eLGT
XayXi4XCINOPHYSKCGio9WVV7HwHC4Kyr6AyOQ+SPCCDs58mt4VzciWnow/QW2e6RhIj
YwAQ==
X-Gm-Message-State: ANoB5pnvkBynlMXPMeOMU0Mj4k2ggiMmuaxaSPZZUK6BWsD2xO7ousUD
pH3Z7UmiZil4qArJpy7TKgzCtVCqraYSgQ/M2BTltxWKRg8=
X-Google-Smtp-Source: AA0mqf4Xwd3ONf5lfhiGuV2qtdL5XY0UI4JyaNZHmAUwfJ5qeMbXwpAnHzyiXH6c3iWaJKDLPUl7DvvAhy2Yu7lw/XY=
X-Received: by 2002:a05:6808:179f:b0:359:c939:d41e with SMTP id
bg31-20020a056808179f00b00359c939d41emr59967oib.292.1668483740012; Mon, 14
Nov 2022 19:42:20 -0800 (PST)
In-Reply-To: <81516897-8535-0d62-ac52-3ffaf151d86f@mit.edu>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: CO1NAM11FT005:EE_|DM5PR01MB2826:EE_
X-MS-Office365-Filtering-Correlation-Id: 12926ed2-4c2d-4830-50a0-08dac6bb66ad
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: iW1+U4n7M/q2FZk0MCCv6JBObh2Pv3mV0FEeD/3oa0lDJ0bUfR1VKKF3DQKjVA1tmUVkugPcL0PyoqYKxM+7Iub19SzS+pskQFmIEMkmbHRBpR5jb1p/1Rr83SKY/4Tq1I9qF8q2GGKJ6fehFYebEruApxdDqRbn8QN7XnQ815bCt9V4ZU9YHBqkcBwp6uNc7yi/KUjwaLv8UdUHrj+TRCSaIaLz8thL64PqrJnygvhZnfLDMDs0yrWb1QOKGmaSABS4Ohbgy+amRIyStgw/VbF5Vrgu6r8ZpevyKRXfO1E6xbwx4KIO9clbctu0bf9OYITmwQSniWsMB0jy6s7q/sLkxf0aRugfELPQNbmJke5IBiRa0aW4Gwy7HvJHzwoKBd+si0zrHUlhrLmKxmrt0GPA/7XPtcbCMEZkRjhkf5OjvQc7d6kVe5DziT3VLQqvZI2aOHfOv0N1lxfF5QjfWZFdUY4LAqVByTtJorvjrw8oqXoG8YwRp2XCSTZDXzmsn5y310pK7a5AtcSEOJmox2v7DX5mbrimqzC+/QAS/mhBlrdZOir42VSp/mwLP+9ujBPSMV6OP2txTjcdcNdcade8l1vYxjSdaqxBmeTv3nUwmilJch1LYIokd16T4bTUw7SyPvX8jtksVRBZXjl5ofH2rnQY7sLfdcc4gEHXBFen+1Lj20nVW2weHHJ9W8XIgs6xdBt1wgfYo3ZFUrLjbw==
X-Forefront-Antispam-Report: CIP:209.85.167.169; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mail-oi1-f169.google.com; PTR:mail-oi1-f169.google.com;
CAT:NONE;
SFS:(13230022)(4636009)(376002)(396003)(346002)(39860400002)(136003)(451199015)(55446002)(6666004)(53546011)(33964004)(26005)(786003)(966005)(76482006)(316002)(498600001)(42186006)(166002)(336012)(82202003)(7636003)(2906002)(86362001)(356005)(73392003)(83380400001)(7596003)(6862004)(44832011)(8676002)(70586007)(68406010)(4326008)(5660300002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Nov 2022 03:42:21.0164 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 12926ed2-4c2d-4830-50a0-08dac6bb66ad
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT005.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR01MB2826
X-OriginatorOrg: mitprod.onmicrosoft.com
X-Mailman-Approved-At: Tue, 15 Nov 2022 01:53:20 -0500
X-Content-Filtered-By: Mailman/MimeDel 2.1.34
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <CAGshih_gaYUyR6mNE4AdDm-37AatrnMXRrK=yUvxuUZYr6MVdw@mail.gmail.com>
X-Mailman-Original-References: <CAGshih-EXCKjUbs0EGjOUL9fn5ZrAnqWP5wvgX=-xVPUTTKr5Q@mail.gmail.com>
<CAGshih9QY8hga0WDf+uc-Fgt6m3AUFLsas7LgtVNMQjs3m-K6A@mail.gmail.com>
<81516897-8535-0d62-ac52-3ffaf151d86f@mit.edu>
 by: Kerberos Enthusiast - Tue, 15 Nov 2022 03:42 UTC

Hi Greg,

Thanks for the response.

Still getting this error with gss_acquire_cred ():

*GSS-API error gss_accept_sec_context: d0000: Unspecified GSS failure.
Minor code may provide more information *
*GSS-API error gss_accept_sec_context: 186a5 : Request ticket server
HTTP/krbsite.krb.local@KRB.LOCAL not found in keytab (ticket kvno 4)*

Sequence of gss apis call for this kerberos authentication :
krb5_gss_register_acceptor_identity();
gss_import_name();
gss_acquire_cred();
gss_accept_sec_context();

*Note : After merging both keytab files this issue did not occured.*

>>
When using gss_acquire_cred_from() in place of gss_acquire_cred() getting
below error :

One additional argument in gss_acquire_cred_from() that is
"*gss_const_key_value_set_t
cred_store"* where specified keytab name when acquiring credentials.
Is there any loop (upto count no.) needed to run for
multiple authentication requests for different services ?

*GSS-API error gss_acquire_cred_from: d0000 : Unspecified GSS failure.
Minor code may provide more information *
*GSS-API error gss_acquire_cred_from: 25ea101: No key table entry found
matching HTTP/**krbsite.krb.local@*

It seems file based keytab is not updated for every kerberos
authentication call.

Is the gss_acquire_cred_from() call still required to call
krb5_gss_register_acceptor_identity or not ?

Thanks,

On Sat, 12 Nov 2022 at 00:14, Greg Hudson <ghudson@mit.edu> wrote:

> On 11/11/22 10:33, Kerberos Enthusiast wrote:
> > It seems, if multiple servers supply separate keytabs, then the
> > subsequent kerberos auth request targeted for multiple kerberos servers
> > with separate keytabs and application keep on
> > updating "default_keytab_name" global variable and it causes some of the
> > authentication requests to fail and it throws this error
>
> There is no global variable named default_keytab_name in MIT krb5.
> There is a krb5.conf configuration variable with this name, but it is
> never changed by the GSS or Kerberos libraries.
>
> > *"GSS-API error gss_accept_sec_context: Request ticket server HTTP/ not
> > found in keytab" *(major code - 186a5, d0000)
>
> This message is a little bit puzzling, because the principal name
> ("HTTP/") is incomplete, and because the message of this form in the
> code includes a parenthetical about the ticket kvno.
>
> > Using this api *krb5_gss_register_acceptor_identity() *to set the default
> > keytab file for kerberos authentication.
>
> This function sets a thread-specific global variable. It should work to
> invoke it before each call to gss_acquire_cred(), or before each call to
> gss_accept_sec_context() using the default acceptor credential. Or:
>
> > Can we use any other gss_api to maintain the local context of the keytab
> > file and send this keytab for every authentication request?
>
> gss_acquire_cred_from() allows the caller to specify a keytab name when
> acquiring credentials. See:
>
>
> https://web.mit.edu/kerberos/krb5-latest/doc/appdev/gssapi.html#credential-store-extensions
>

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor