Failed to validate remote GSSAPI token: Key table entry not found

[Anon Anon]

I try to build a environment for Kerberos Authentication Scheme for Apache Web Server on Windows 2008R2
My environment are

AD & DNS windows 2008 SP1

Policy Server R12.5 windows 2008 SP1 (Host Name is POLISERVER)

Web Agenet R12.5
Apache Web Server on windows 2008R2 (Host Name is APHSERVER)

I create two account service name ,generate & deploy two keytab files
policy server : kbssmuser (service principal is smps/POLISERVER.abc.com)
web server : kbsapserver (service principal is HTTP/APHSERVER.abc.com)

ACO configuration
httpserviceprincipal='HTTP/[e-mail]'.
smpsserviceprincipal='smps/[e-mail]'.


But I try to verify the protect resource url
The Apahce Web Server return 500 error code
The WebAgent Trace log return error message : Failed to validate remote GSSAPI token: Key table entry not found

How do I fix the problem ?

Regards,

Tommy

[System]

Hi All,

Any suggestions here for Tommy?

Thanks!
Chris

tsai_hsing wrote:

I try to build a environment for Kerberos Authentication Scheme for Apache Web Server on Windows 2008R2
My environment are

AD & DNS windows 2008 SP1

Policy Server R12.5 windows 2008 SP1 (Host Name is POLISERVER)

Web Agenet R12.5
Apache Web Server on windows 2008R2 (Host Name is APHSERVER)

I create two account service name ,generate & deploy two keytab files
policy server : kbssmuser (service principal is smps/POLISERVER.abc.com)
web server : kbsapserver (service principal is HTTP/APHSERVER.abc.com)

ACO configuration
httpserviceprincipal='HTTP/[e-mail]'.
smpsserviceprincipal='smps/[e-mail]'.


But I try to verify the protect resource url
The Apahce Web Server return 500 error code
The WebAgent Trace log return error message : Failed to validate remote GSSAPI token: Key table entry not found

How do I fix the problem ?

Regards,

Tommy

[Anon Anon]

Hi Chris
I had try to use Kerberos Authentication Scheme for Apache Web Server on Windows 2008R2 about two months but still does not work fine

And also ask CA on line support help.
Now support gave me a answer "the authentication server and the web agent protecting those resources must be on a Microsoft IIS web server."
I don't knows if it is final answer that " I must use IIS instead of Apache for Kerberos Authentication Scheme "
As I knew if I choice IIS on Windows ,I can just use IWA Authentication Scheme (NTLM) ,I don' need working hot to set up Kerberos Authentication Scheme steps.
Thanks.

Regards,

Tommy

[Patrick Dussault]

Hi,

 

It is probably late to come on this, but just in case :

 

Apache is supported and will work with Kerberos

and SiteMinder.

 

The error :

 

Failed to validate remote GSSAPI token: Key table entry not found

 

Check :

 

- The AD Account you use have just and only 1 Principal;

- The AD Account has the same kvno as the one in the

  keytab;

- The krb5.ini is configure and located at the default

  place on the OS file system;

- The keytab file is reachable and readable;

 

Best Regards,

Patrick

[SungHoon_Kim]

It should not matter if it is IIS or Apache.

 

If this is still an issue for you, please try setting up following my document here.

How to setup SiteMinder Kerberos Authentication - Part 1

 

In this document, the web server is IIS 7.5 but it should not matter if the web server is Apache.

 

Cheers,

 

Kim

[sso_rajkiran]

#tsai_hsing
Please let us know how did you resolve the following error.

[Legacy User]

Hi Tommy Tsai_Hsing

 

I see that this is marked as assumed answered. However were you able to resolve this error message?

 

[07/29/2015][01:08:45.021][19016][2910451520][SmKCC.cpp:139][SmKcc::getCredentials][Failed to validate remote GSSAPI token: Minor Status=-1765328203, Major Status=851968, Message=Key table entry not found][wa_apache][/demo/headers.pl][GET][*10.130.211.115][][][][]

 

 

Regards

Hubert