can't get it to work - failed to get server creds

[disaster123]

Hello,

sorry for posting an issue but i can't get it to work and the error message does not help.

Apache Config:
AuthType GSSAPI
AuthName "Login"
GssapiConnectionBound On
GssapiSignalPersistentAuth On
Require valid-user
GssapiCredStore keytab:/etc/krb5_http.keytab

Apache Log file:
[Thu Sep 14 22:20:23.994211 2017] [auth_gssapi:debug] [pid 21099:tid 140206177675008] mod_auth_gssapi.c(857): [client 10.242.2.4:34880] URI: /test, no main, no prev
[Thu Sep 14 22:20:23.994262 2017] [auth_gssapi:error] [pid 21099:tid 140206177675008] [client 10.242.2.4:34880] NO AUTH DATA Client did not send any authentication headers
[Thu Sep 14 22:20:24.527259 2017] [auth_gssapi:debug] [pid 21099:tid 140206169282304] mod_auth_gssapi.c(857): [client 10.242.2.4:34880] URI: /test, no main, no prev
[Thu Sep 14 22:20:24.527690 2017] [auth_gssapi:error] [pid 21099:tid 140206169282304] [client 10.242.2.4:34880] GSS ERROR gss_acquire_cred_from failed to get server creds: [Unspecified GSS failure. Minor code may provide more information (Permission denied)]

And i started chromium with:
chromium-browser --auth-server-whitelist="10.255.250.96" --auth-negotiate-delegate-whitelist="10.255.250.96"

Greets,
Stefan

[rcritten]

Make sure Apache has read permission of the keytab

[disaster123]

It has. httpd process is running as wwwrun file is wwwrun 0600.

[simo5]

1. Do NOT set GssapiConnectionBound you do not want that.
2. GSSAPI is trying to access a file and gets back EPERM: (Permission denied)
   So either the file permission are incorrect, or you have a MAC system like SELinux or Apparmor blocking apache from accessing /etc/krb5_http.keytab
   You can check the audit log on your system or, worst case strace apache to see what file access is being denied

[simo5]

ah also, so no use --auth-negotiate-delegate-whitelist, unless you really plan to delegate your TGT to your webserver (and given your config you do not) you shouold never delegate your creds.

[disaster123]

OK it wanted to read /etc/krb5.conf as well so i need to allow wwrun to read that file and i also removed GssapiConnectionBound.

Now the log looks like this:
[Fri Sep 15 17:23:23.486883 2017] [auth_gssapi:debug] [pid 30651:tid 140204584535808] mod_auth_gssapi.c(857): [client 10.242.2.4:39942] URI: /test, no main, no prev
[Fri Sep 15 17:23:23.487001 2017] [auth_gssapi:error] [pid 30651:tid 140204584535808] [client 10.242.2.4:39942] NO AUTH DATA Client did not send any authentication headers
[Fri Sep 15 17:23:23.946046 2017] [auth_gssapi:debug] [pid 30651:tid 140204601321216] mod_auth_gssapi.c(857): [client 10.242.2.4:39942] URI: /test, no main, no prev
[Fri Sep 15 17:23:23.980027 2017] [auth_gssapi:error] [pid 30651:tid 140204601321216] [client 10.242.2.4:39942] INTERNAL ERROR Mechanism needs continuation but neither GssapiConnectionBound nor GssapiUseSessions are configured

[simo5]

Add GssapiAllowedMech krb5
Your client is probably trying to fall back to the NTLMSSP mechanism

[simo5]

This also means the client was not able to get a ticket for the services, what URL are you giving to the browser ?

[disaster123]

OK i added GssapiAllowedMech krb5 - now the log file says:
[Fri Sep 15 18:21:06.277044 2017] [auth_gssapi:error] [pid 30652:tid 140204727211776] [client 10.242.2.3:33782] NO AUTH DATA Client did not send any authentication headers
[Fri Sep 15 18:21:06.774265 2017] [auth_gssapi:debug] [pid 30652:tid 140204743997184] mod_auth_gssapi.c(857): [client 10.242.2.3:33782] URI: /test, no main, no prev
[Fri Sep 15 18:21:06.783103 2017] [auth_gssapi:error] [pid 30652:tid 140204743997184] [client 10.242.2.3:33782] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]
[Fri Sep 15 18:21:06.933981 2017] [auth_gssapi:debug] [pid 30652:tid 140204752389888] mod_auth_gssapi.c(857): [client 10.242.2.3:33782] URI: /test, no main, no prev
[Fri Sep 15 18:21:06.934089 2017] [auth_gssapi:error] [pid 30652:tid 140204752389888] [client 10.242.2.3:33782] NO AUTH DATA Client did not send any authentication headers

URL in Browser: http://10.255.250.96/test

Does this URL need to match the HTTP service URL in http.keytab?

[simo5]

The server name used in the URL MUST match the hostname used in the keytab. IP addresses will not work.

[simo5]

However you "might" create a principal named HTTP/10.255.250.96@{YOUR-REALM} and add it's keys to the keytab too, YMMV ...

[disaster123]

OK i tried it this way - not sure if it is ok:

On the FreeIPA System running kerberos:
# ipa host-add X.office.Y.de
# ipa service-add HTTP/X.office.Y.de

Does it matter that the real hostname of the server (/etc/hosts) is different? it's X.office.internal

[simo5]

what matters is only what you use in the URL, if you use https://X.office.Y.de it will work, if you use https://X.office.internal it won't work

[disaster123]

Thanks again - but it does not work.

Apache log says:
[Fri Sep 15 19:15:51.876740 2017] [auth_gssapi:debug] [pid 6664:tid 140053900023552] mod_auth_gssapi.c(857): [client 10.242.2.3:44674] URI: /, no main, no prev
[Fri Sep 15 19:15:51.876867 2017] [auth_gssapi:error] [pid 6664:tid 140053900023552] [client 10.242.2.3:44674] NO AUTH DATA Client did not send any authentication headers
[Fri Sep 15 19:15:52.451315 2017] [auth_gssapi:debug] [pid 6664:tid 140053950379776] mod_auth_gssapi.c(857): [client 10.242.2.3:44676] URI: /, no main, no prev
[Fri Sep 15 19:15:52.452489 2017] [auth_gssapi:error] [pid 6664:tid 140053950379776] [client 10.242.2.3:44676] GSS ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]
[Fri Sep 15 19:15:52.609971 2017] [auth_gssapi:debug] [pid 6664:tid 140053631457024] mod_auth_gssapi.c(857): [client 10.242.2.3:44678] URI: /, no main, no prev

chromium output is:
[12282:12312:0915/191554.077985:ERROR:http_auth_gssapi_posix.cc(863)] Problem initializing context.
Major: (0x000D0000) Unspecified GSS failure. Minor code may provide more information | Minor: (0x000186A7) SPNEGO failed to negotiate a mechanism
Context: GSS_C_NO_CONTEXT

[simo5]

I think you need to debug this at the client side now, Chromium apparently still failing to get a ticket for the server.

If you check your tickets on the client do you see a ticket for the server in the credential cache ?

[disaster123]

no klist on the client just shows a single ticket from the login for the krbtgt service