带有mod_auth_kerb:验证码589824和令牌的Kerberos SSO似乎是NTLM

Question

我遇到了一些困难Kerberking一个主机，T.P.No。我正在浏览http://grolmsnet.de/kerbtut，它已经为其他用户提供了一个没有添加到windows域的主机。

环境：

OS是CentOS 5.9，

Kerberos、Apache和mod_auth_kerb随YUM安装：

httpd.x86_64                              2.2.3-76.el5.centos          installed
httpd-devel.i386                          2.2.3-76.el5.centos          installed
httpd-devel.x86_64                        2.2.3-76.el5.centos          installed

mod_auth_kerb.x86_64                      5.1-5.el5                    installed

krb5-devel.x86_64                         1.6.1-70.el5                 installed
krb5-libs.i386                            1.6.1-70.el5                 installed
krb5-libs.x86_64                          1.6.1-70.el5                 installed
krb5-workstation.x86_64                   1.6.1-70.el5                 installed
pam_krb5.i386                             2.2.14-22.el5                installed
pam_krb5.x86_64                           2.2.14-22.el5                installed

ktpass.exe /princ HTTP/[e-mail] /mapuser testsone2\user 
/crypto DES-CBC-MD5 +DesOnly /Pass *** /ptype KRB5_NT_PRINCIPAL /out t.keytab

# kinit -V [e-mail]
Password for [e-mail]: 
Authenticated to Kerberos v5

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [e-mail]

Valid starting     Expires            Service principal
05/13/13 15:32:13  05/14/13 01:32:17  krbtgt/[e-mail]
  renew until 05/14/13 15:32:13


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

# kvno HTTP/[e-mail]
HTTP/[e-mail]: kvno = 9

# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [e-mail]

Valid starting     Expires            Service principal
05/13/13 15:32:13  05/14/13 01:32:17  krbtgt/[e-mail]
  renew until 05/14/13 15:32:13, Etype (skey, tkt): ArcFour with HMAC/md5, ArcFour with HMAC/md5 
05/13/13 15:34:27  05/14/13 01:32:17  HTTP/[e-mail]
  renew until 05/14/13 15:32:13, Etype (skey, tkt): DES cbc mode with CRC-32, DES cbc mode with RSA-MD5 

Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

# ktutil 
ktutil: rkt t.keytab
ktutil: l
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    9 HTTP/[e-mail]

T.P.NO是反向解析为T.P.NO的ip地址的A记录解析

这是我的虚拟主机配置，它是一个简单的乘客服务rails应用程序。在使用身份验证相关指令添加位置节之前测试了工作：

<VirtualHost *:80>
  DocumentRoot /home/p/testapp/public
  ServerName t.p.no

  RackEnv staging
  RailsEnv staging

  <Directory /home/p/testapp/public>
    Options -MultiViews
  </Directory>

  <Location />
    AuthType Kerberos
    AuthName "Logg inn"
    KrbMethodNegotiate On
    KrbMethodK5Passwd Off
    KrbAuthRealms TESTSONE2.P.LOCAL
    KrbServiceName HTTP # No difference if using full SPN here
    Krb5KeyTab /etc/httpd/keys/t.keytab
    require valid-user
  </Location>

  LogLevel debug
  CustomLog logs/t.p.no-access_log combined_forwarded
  ErrorLog logs/t.p.no-error_log

</VirtualHost>

当客户端在Internet Explorer中输入T.P.NO时，Apache会记录以下内容：

[debug] src/mod_auth_kerb.c(1496): [client 139.x.x.201] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[debug] src/mod_auth_kerb.c(1496): [client 139.x.x.201] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[debug] src/mod_auth_kerb.c(1151): [client 139.x.x.201] Acquiring creds for HTTP/[e-mail]
[debug] src/mod_auth_kerb.c(1270): [client 139.x.x.201] Verifying client data using KRB5 GSS-API
[debug] src/mod_auth_kerb.c(1286): [client 139.x.x.201] Verification returned code 589824
[debug] src/mod_auth_kerb.c(1313): [client 139.x.x.201] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.
[error] [client 139.116.152.201] gss_accept_sec_context() failed: Invalid token was supplied (No error)

在第二个请求中，客户机在fiddler的Auth-tab中发送一个标题:Authorization:Negotiate[token data]。令牌数据如下所示：

-[NTLM Type1: Negotiation]------------------------------
Provider: NTLMSSP
Type: 1
OS Version: 6.1:7601
Flags:  0xe2088297
    Unicode supported in security buffer.
    OEM strings supported in security buffer.
    Request server's authentication realm included in Type2 reply.
    Sign (integrity)
    NTLM authentication.
    Negotiate Always Sign.
    Negotiate NTLM2 Key.
    Supports 56-bit encryption.
    Supports 128-bit encryption.
    Client will provide master key in Type 3 Session Key field.
Domain_Offset: 0; Domain_Length: 0; Domain_Length2: 0
Host_Offset: 0; Host_Length: 0; Host_Length2: 0
Host: 
Domain: 
------------------------------------

所有帮助找出原因的NTLM令牌被发送将非常感谢！

Answer 1

如前所述，我的测试客户机是2008服务器R2。一篇关于Windows 7客户端和Windows Server 2008 R2的文章(http://support.microsoft.com/kb/977321)指出，在这些产品中，默认情况下禁用用于Kerberos身份验证的DES加密。

我按照本文中的步骤在客户机上重新启用DES，KDC是2003，所以它应该仍然支持DES。然后验证成功。