Kerberos fails when accessing site by IP address

问题

Problems appear when accessing Kerberos protected site by IP address. For example:

http:/10.10.1.x:3001/ gives failure.

http:/my-host:3001/ sso is completes successfully.

Apache error logs say:

src/mod_auth_kerb.c(1261): [client 10.10.1.x] Acquiring creds for HTTP@10.10.1.x [client 10.10.1.x] gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)

src/mod_auth_kerb.c(1261): [client 10.10.1.x Acquiring creds for HTTP@my-host [debug] src/mod_auth_kerb.c(1407): [client 10.10.1.x] Verifying client data using KRB5 GSS-API [debug] src/mod_auth_kerb.c(1423): [client 10.10.1.x] Verification returned code 0

As you could see Kerberos tries to find HTTP@10.10.1.x or HTTP@my-host principals. For both principals created dummy accounts in ActiveDirectory. In keytab file also included both of them:

KVNO Timestamp         Principal
---- ----------------- -----------------------------------------------------
   5 01/01/70 03:00:00 HTTP/10.10.1.x@MY_DOMAIN.LAN (ArcFour with HMAC/md5)

  11 09/04/12 12:03:01 HTTP/my-host@MY_DOMAIN.LAN (ArcFour with HMAC/md5)

Kinit works for both of them.

Kerberos config on server:

   Krb5Keytab /etc/krb5.keytab
   AuthType Kerberos
   KrbMethodNegotiate On
   AuthName "Kerberos Login"
   KrbAuthRealms MY_DOMAIN.LAN
   KrbVerifyKDC Off
   KrbMethodK5Passwd On
   Require valid-user

Someone could guess where the problem is? Is it possible to use IP address in Kerberos SSO?

回答1:

Kerberos does not work with IP adresses, it relies on domain names and correct DNS entries only.

回答2:

In a Microsoft KB article it says that is by design:

https://support.microsoft.com/en-ca/kb/322979

The title of the above KB is: Kerberos is not used when you connect to SMB shares by using IP address

回答3:

I realize this is a very old thread, but it is a top choice for any related searches. I think it's worth noting that Microsoft has recently added Kerberos client support using IPv4 and IPv6.

Beginning with Windows 10 version 1507 and Windows Server 2016, Kerberos clients can be configured to support IPv4 and IPv6 hostnames in SPNs.

To reduce the impact of disabling NTLM a new capability was introduced that lets administrators use IP addresses as hostnames in Service Principal Names. This capability is enabled on the client through a registry key value.

Since this is a client-side fix, your Kerberos client must be running an appropriate version of Windows and receive the TryIPSPN registry entry. Your service must also have an IP-based SPN registered to it in Active Directory.

来源：https://stackoverflow.com/questions/12260587/kerberos-fails-when-accessing-site-by-ip-address

标签

authentication

ubuntu-10.04

kerberos