The keytab file contains for each SPN/encryption type pair the corresponding key material in order to decrypt the Kerberos ticket.
The command below illustrates how the content of the keytab file can be checked:
A keytab file with invalid key material always results in a failed authentication. However, the cause and the part of what is invalid could differ every time. To figure out what is wrong, analyze the Kerberos ticket sent by the client and compare it with the information in the keytab file (in main focus are KVNO, SPN, and encryption type).
Possible causes:
- KVNO (Key Version Number)
- The Kerberos ticket issued by the Active Directory Domain Controller is encrypted with the Kerberos system user's password (see chapter ). Whenever the Kerberos system user's password is changed or a new key tab file is created (see chapter ), the Active Directory Domain Controller increments the KVNO of this user's password internally. When a user requests a Kerberos service ticket from the Domain Controller, the issued ticket always contains the KVNO used to encrypt the ticket (indicating which password has been used). Normally the KVNO in the key tab file is identical to the one of the Kerberos ticket received by the client since the key tab file and the Kerberos ticket are created with the same key material. A different KVNO could be an indication that probably the Kerberos system user's password has been altered and the key tab file contains outdated key material.
- Nevertheless, it is not a requirement that the KVNO is identical, for as long as the same password is used, Kerberos authentication will work without issues (e.g. resetting the password to the same value would increment the KVNO but the password is still the same). A log message with the information "Mechanism level: Checksum failed" means that the key material used by the Active Directory Domain Controller and the one in the key tab file are different. If unsure whether the key material is still valid, simply re-create the key tab file (see Create the Keytab File).
- SPN and encryption type
- Check in the Kerberos ticket sent by the client for which SPN it was issued. Possible reasons for failed authentication with a log message like "Cannot find key of appropriate type to decrypt AP-REQ - AES256 CTS mode with HMAC SHA1-96" could be:
- The particular SPN is not configured in the key tab file.
- The particular SPN is configured in the key tab file with a different encryption type.
- The particular SPN does not match the Service Principal in the IAM Configuration (depending on the authentication flow that would be in the plugin "Kerberos Config" or "SPNEGO Config").
Useful checks:
- Test whether it is possible on Airlock IAM to retrieve a Kerberos TGT ticket from the Active Directory Domain Controller using the keytab file (network connection on 88/udp and 88/tcp is required).
In case that kinit
reports "kinit: Resource temporarily unavailable while getting initial credentials", ensure that the kdc configured in the krb5.conf
file is accessible, the hostname can be resolved and network connectivity to the kdc via 88/udp and 88/tcp is possible.