{"id":7722,"date":"2013-05-25T11:33:06","date_gmt":"2013-05-25T16:33:06","guid":{"rendered":"http:\/\/jianmingli.com\/wp\/?p=7722"},"modified":"2013-07-06T11:07:15","modified_gmt":"2013-07-06T16:07:15","slug":"ldapip_address-instead-of-ldapfqdn-in-kerberos-tgs-req","status":"publish","type":"post","link":"https:\/\/jianmingli.com\/wp\/?p=7722","title":{"rendered":"ldap\/ip_address instead of ldap\/fqdn in Kerberos TGS-REQ"},"content":{"rendered":"
\n

Contents<\/h2>\n
    \n\t
  1. \n\t\tIssue<\/a>\n\t<\/li>\n\t
  2. \n\t\tCause<\/a>\n\t<\/li>\n\t
  3. \n\t\tFix<\/a>\n\t<\/li>\n\t
  4. \n\t\tMisc<\/a>\n\t<\/li>\n\t
  5. \n\t\tReferences<\/a>\n\t<\/li>\n<\/ol>\n<\/ol>\n<\/div>\n
     <\/div>\n

    Issue<\/h2><\/span>\n

    For some reason, when using Kerberos ticket to authenticate to ldap server across domain, the fully qualified domain name (dc01.domain_b.net) was changed *automatically* to IP address in the TGS-Req.<\/p>\n

    From WireShark:<\/p>\n

    > Server Name (Unknown): ldap\/192.168.1.70<\/p>\n

    It should be:<\/p>\n

    > Server Name (Unknown): ldap\/dc01.domain_b.net<\/p>\n

    This is causing ‘Server not found in Kerberos database’ error message:<\/p>\n

    > Caused by: GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7))<\/p>\n

    Cause<\/h2><\/span>\n

    The JNDI LDAP service provider client sets the SPN to ldap\/ip_address if PTR record for the IP address resolves to a non-existent server name that can not be corroborated with an “A” record in DNS. This is part of Kerberos canonicalization. You have to ensure that your PTR records and A records align in DNS.<\/p>\n

    Fix<\/h2><\/span>\n

    Add PTR record<\/strong> for dc01.domain_b.net<\/em> in current<\/strong> domain name server so that reverse lookup is successful.<\/p>\n

    Before:<\/p>\n

    \r\n>nslookup 192.168.1.70\r\nServer:  dc01.domain_a.net\r\nAddress:  10.10.11.22\r\n\r\n*** dc01.domain_a.net can't find 192.168.1.70: Non-existent domain\r\n<\/pre>\n
    After:<\/p>\n
    \r\n>nslookup 10.22.220.70\r\nServer:  dc01.domain_a.net\r\nAddress:  10.10.11.22\r\n\r\nName:    dc01.domain_b.net\r\nAddress:  192.168.1.70\r\n<\/pre>\n
    Misc<\/h2><\/span>\n
    Java 7 seems to have resolve this issue?<\/p>\n
    References<\/h2><\/span>\n
    https:\/\/forums.oracle.com\/forums\/thread.jspa?messageID=4694706<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    Issue For some reason, when using Kerberos ticket to authenticate to ldap server across domain, the fully qualified domain name (dc01.domain_b.net) was changed *automatically* to IP address in the TGS-Req. From WireShark: > Server Name (Unknown): ldap\/192.168.1.70 It should be: … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[287,34],"tags":[628,566],"class_list":["post-7722","post","type-post","status-publish","format-standard","hentry","category-kerberos","category-ldap","tag-kerberos","tag-ldap"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8cRUO-20y","_links":{"self":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7722"}],"version-history":[{"count":7,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7722\/revisions"}],"predecessor-version":[{"id":7755,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7722\/revisions\/7755"}],"wp:attachment":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}