Advanced Server 10.5.7, Kerberos Authentication not responding

Hi everyone,
Hoping Captain Obvious can help me out. I have searched the web and forums and i'm not getting very far.
This is the first time I am managing a Mac Server - I come from a Windoz Server background.
So ->
Installed 10.5.7 Server
Setup DNS
(tested AOK)
Setup Open Directory
Setup iChat Server
Setup AFP
The server seems to be running ok, all the above services work. It has been working for a few weeks.
Then I started to harden it and was looking at kerberos authentication, so I first went into iChat server and changed the form of Authentication to "Any" method.
When I try to log in from iChat I go into this endless Certificate acceptance loop
When I try to log in via AFP with Kerberos authentication, I go noplace.
Second I switch back to standard authentication, i get right in.
I turned on VPN services and that is a dead end as well because of this authentication issue.
What could be causing this Kerberos issue? DNS? or did Captain Obvious miss a button?
Your help is greatly appreciated

Hi davidh,
Thank you for responding. I found that command just as I was passing out last night, so it was ironic to find your msg when I woke up. The thing is that I didn't know what I was looking at until I read your msg and yes, I see 3 entries for each kerberized service.
Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp Principal
3 05/05/09 21:37:50 afpserver/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7 E595E78DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 afpserver/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7 E595E78DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 afpserver/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7 E595E78DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 cifs/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7E595E 78DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 cifs/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7E595E 78DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 cifs/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7E595E 78DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 vnc/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7E595E7 8DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:50 vnc/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7E595E7 8DBA6658C9FE5AD54683DA4A9F
3 05/05/09 21:37:51 vnc/LKDC:SHA1.43AB07C7E595E78DBA6658C9FE5AD54683DA4A8F@LKDC:SHA1.43AB07C7E595E7 8DBA6658C9FE5AD54683DA4A9F
3 05/27/09 22:44:34 fcsvr/[email protected]
3 05/27/09 22:44:34 fcsvr/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 fcsvr/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 pcast/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 pcast/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 pcast/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 vnc/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 vnc/vader. mydomain.com@VADER. MYDOMAIN.COM
3 05/27/09 22:44:34 vnc/vader. mydomain.com@VADER. MYDOMAIN.COM
I'm starting to think that it's actually running, but if it is... how come i can't authenticate via Kerb?
Let me know what you think and what I can do next..thanks

Similar Messages

Can no longer access blueyonder emails on iphone.I get the following error message: The mail server 'imap4.blueyonder.co.uk is not responding', how do I fix pls?

Hi there
As I've mentioned above, I can't seem to access my emails from my blueyonder account on my iphone. When I first set up my account on the phone, I had no problems at all receiving emails. Then recently, just out of the blue I get the following error message: 'Cannot Get Mail, The Mail Server 'imap4.blueyonder.co.uk' is not responding. Verfiy that you have entered the correct account info in mail settings. I definitely have the right settings, I even checked with Virgin but they are not able to assist with my problem. Has anyone else experienced this problem, if so,how did you fix it? If you could explain in simple terms as I'm not tech savvy!
Many thanks!

http://www.apple.com/uk/support/iphone/mail/
work through this

Hi I have mac os x 10.6.6 and need to update however keep getting the message " software update server ( 172.22.13.4 ) is not responding". My internet connections are all working. Any ideas how to solve this?

Hi I have mac os x 10.6.6 and need to update however keep getting the message " software update server ( 172.22.13.4 ) is not responding". My internet connections are all working. Any ideas how to solve this?

If you have enough room on the boot drive, head to System Preferences > Accounts and create another Admin Account, log out and into it and try your Software Update again.
If this doesn't work, connect a Ethernet cable to the router or modem (power off/on) and try again.
If this doesn't work then run through this list of fixes.
..Step by Step to fix your Mac
Diagnosing network issues

The Software Update Server (10.0.0.250) is not responding.

Since upgrading to LION OS v 10.7, i cannot get software update to work and this is the message i keep getting "The Software Update Server (10.0.0.250) is not responding."
I had to download itunes update off support website to get it to work. i cant get the Java update or anything elseto work. any help?

Hi. This jsut helped me:
HazyRigby
Re: Software Update can’t find the update server
Sep 8, 2008 12:49 AM (in response to blue.blar)
Hi blue,
Assuming that your Internet connectivity is working fine otherwise—
Try moving (if you'd like to replace it if this doesn't fix the problem) or deleting the file /Library/Preferences/com.apple.SoftwareUpdate.plist.
If that doesn't work, I'd go to Apple's downloads page and get the 10.5.4 combo updater and install that. That might fix it.
Hope that helps!
—Hazy
iBook, iMac (early Intel), MacBook, Mac OS X (10.5.4)

HT1338 "The Software Update Server (10.0.1.250) is not responding."

My network works well. But I still get this message "The Software Update Server (10.0.1.250) is not responding."

Are you using a local server for software updates? That IP address is internal, must be on your local network. If so, check with your server administrator.
Best of luck.

Kerberos Authentication Not Working on OS X 10.6

Using FF version 20.0, on OS X 10.6.8, I can not get it to use Kerberos authentication to allow SSO to a SharePoint web site.
On OS X 10.8, with the same configuration in the about:config, everything works fine - the user is not prompted for credentials.
I have put the necessary entires in network.negotiate-auth.delegation-uris and network.automatic-ntlm-auth.trusted-uris, network.negotiate-auth.gsslib is set to true.
When I have setup to log the errors from the authentication module, I find in the log file "Fail to load gssapi library".
Interestingly on 10.8, when I start Firefox from the command line the Kerberos authentication does not work. When I start it via the icon, it does. What is the difference? Are the preferences not being loaded when launching via the command line?
Thanks for any help,
Richard

Found the solution:
Was a combination of kinit being run on login (apparently a known 10.6 bug). Our Mac team were able to alter the appropriate plist file so that this does happen on login.
We also had to add an extra SPN for the actual server, as well as the DNS name of the SharePoint site we were trying to access with Kerberos authentication - although this may have something to do with using host-named site collections at the SharePoint end.
Main problem was the kinit thing though.

Server log having multiple Kerberos Authentication failed events

I my windows server log i can see so many Kerberos Authentication failure Events, Could you please explain why this is happening and how to resolve this?

Hello Friend,
here is the log
Time of Day
Name
Source Country
Destination IP
Destination Country
Destination Port
Event Count
2014-12-10 09
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
2
2014-12-10 08
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
6
2014-12-10 08
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
2
2014-12-10 08
4771: Kerberos Pre-authentication Failed
N/A
Not Reported
N/A
Not Reported
2
2014-12-10 07
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
14
2014-12-10 07
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
1
2014-12-10 06
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
12
2014-12-10 06
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
2
2014-12-10 05
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
16
2014-12-10 05
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
1
2014-12-10 04
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
22
2014-12-10 03
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
8
2014-12-10 03
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
1
2014-12-10 02
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
11
2014-12-10 02
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
4

Windows AD with Kerberos authentication not supported for NW AS JAVA 7.1

The Admin guide for BO 3.1 states that Windows AD with Kerberos authentication is not supported on NetWeaver AS.
Can anybody suggest & confirm on this???

I know we haven't been receiving cases for it, but I think in theory it should work fine. BO doesn't really care what web/app kerberos comes from as the manual authentication uses the java SDK (i.e tomcat 5.5 would use Sun JDK 1.5), and SSO kerberos (vintela) uses 3rd party libraries. It's possible our 3rd party libraries may not support netweaver yet. If I hear anything else I'll post.
Regards,
Tim

Can i use a different ADS server as KDC for Kerberos authentication ?

Hi all:
For some security concerns, I cannot use my central ADS as KDC and run ktpss, setspn in central ADS.
Can I use another ADS server as KDC server and run ktpass, setspn to configure the Kerberos ?

My portal UME is configured to central ADS as Database+LDAP
I donot want to make the central ADS as KDC server running. I just want to make another ADS server as KDC server, is it possible ?

Kerberos Authentication between Sharepoint 2013 Foundation - SSRS 2012 - Oracle 11g failing with ORA-12638: Credential retrieval failed

I have set up SharePoint 2013 Foundation, SharePoint Reporting Services and SQL Server 2012 in a single server. I then created a Data Connection to Oracle 11g. Upon testing the connection, it throws the error “ORA-12638: Credential retrieval failed”.
Given below are the steps of installation and configuration.
Installation till basic authentication:
The installation has been done in a
single server.
Installed SQL Server 2012 (Developer version).
Selected only the following features:
Database Engine Services
Analysis Services
Reporting Services – SharePoint
Reporting Services Add-in for SharePoint Products
Management Tools – Basic
- Management Tools - Complete
2. Installed SQL Server 2012 SP1.
3. Installed SQL Server 2012 SP2.
  4. Installed SharePoint Foundation 2013.
5. Created web application (without Kerberos; we did not even create the SPNs).
      The application pool has been configured to use Reporting Services account since it is a single server installation. This account has been registered as a managed
account.
6. Created Site Collection.
7. Verified that Reporting Services is not installed.
8. Installed SharePoint Reporting Services from SharePoint 2013 Management Shell.
9. Verified that Reporting Services is installed.
10. Created a new SQL Server Reporting Services Service Application and associated the Web Application to the new SQL server Reporting Services Service Application.
11. Verified that SQL Server Reporting Services Service Application and its proxy have started. Reset IIS.
12. Created a Site.
  13. Created a Data Connection library with “Report Data Source” content type.
14. Created a Report Model library with “Report Builder Model” content type.
15. Created a Report library with “Report Builder Report” content type.
16. Uploaded an SMDL to the Report Model library.
  17. Added the top level site to Local Intranet instead of as a Trusted Site in the browser settings.
  18. Able to create and save a report using Report Builder.
Hence, basic authentication is working and SSRS is able to connect to Oracle database.
Next we have to configure Kerberos settings between SharePoint and SQL Server.
Implementation of Kerberos authentication
In the Report Server machine, opened the file C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\WebServices\Reporting\rsreportserver.config and added the Authentication Types of RSWindowsNegotiate
and RSWindowsKerberos.
2. Set up the following SPNs.
               a) SQL Server Database Engine service (sqlDbSrv2):
                setspn -S MSSQLSvc/CER1110:1433 CERDEMO\sqlDbSrv2
                setspn -S MSSQLSvc/CER1110.cer.demo.com:1433 CERDEMO\sqlDbSrv2
             In the Delegation tab of the account, selected "Trust this user for delegation to any service (Kerberos only)".
b) Account: SharePoint Setup Admin account (spAdmin2)
     setspn -S HTTP/CER1110:9999 CERDEMO\spAdmin2
                setspn -S HTTP/CER1110.cer.demo.com:9999 CERDEMO\spAdmin2
                In the Delegation tab of the account, selected "Trust this user for delegation to any  service
(Kerberos only)".
c) Account: SQL Server Reporting Service account (sqlRepSrv2)
                   setspn -S HTTP/CER1110 CERDEMO\sqlRepSrv2
                   setspn -S HTTP/CER1110.cer.demo.com CERDEMO\sqlRepSrv2
                   In the Delegation tab of the account, selected "Trust this user for delegation to any service
(Kerberos only)".
3. Configure the Web Application to use “Negotiate (Kerberos)”.
4. Logged in as SharePoint Administrator to the SharePoint server and opened the top level site in the IE browser.
     The Event Viewer logged the login process for the SharePoint Administration account as
Negotiate and not Kerberos.
5. Implemented Kerberos for Oracle database and client.
     Able to connect to the Oracle database via Kerberos authentication using SQL Plus.
6. Turn on Windows Firewall.
7. While testing the site's data connection using Kerberos settings, got the error
“Can not convert claims identity to windows token. This may be due to user not logging in using windows credentials.”
      Note: The Data Connection for basic authentication still worked.
8. Created a Claims to Windows Token Service account (spC2WTS2).
9. Started the Claims to Windows Token Service.
10. Registered the Claims to Windows Token Service account as a Managed Account.
11. Changed the Claims To Windows Token Service to use the above managed account.
12. Verified that the Claims to Windows Token Service account (spC2WTS2) is automatically added to the WSS_WPG local group on the SharePoint box.
      Note: The Reporting Services service account is also a part of the WSS_WPG local group.
13. Added the Claims to Windows Token Service account (spC2WTS2) to the Local Admin Group on the machine having the SharePoint App Server.
14. In the SharePoint box, added the Claims to Windows Token Service account (spC2WTS2) in the Act as part of the operating system policy right.
15. The Claims to Windows Token Service account (spC2WTS2) has the WSS_WPG group configured.
      When the C2WTS service was configured to use the managed account Claims to Windows Token Service account (spC2WTS2) earlier, the spC2WTS2 account was automatically
added to the WSS_WPG local group on the SharePoint box. The WSS_WPG group in turn is configured in c2wtshost.exe.config file.
16. Verified that the Reporting Services account is a managed account and part of the WSS_WPG group.
17. Earlier Service Application Pool - SQL Server Reporting Services App Pool service was associated with the SharePoint Admin account.
      Changed this to associate the Reporting Service account with the Service Application Pool - SQL Server Reporting Services App Pool service.
18. Changed the delegation of the Reporting Service account to constrained delegation with Protocol Transitioning. This is because we are transitioning from one authentication scheme (Claims) to another (Windows Token).
      For this, the delegation has been changed to "Trust this user for delegation to specified services only". Also, selected the sub radio button "Use
any authentication protocol". Selected the Oracle Kerberos service as the service to which this account can present delegated credentials.
      Note: The Reporting Service account already had an HTTP SPN.
19. Next, the goal was to make the Claims To Windows Token Service account match the Reporting Service account.
       For this, we created a fake SPN for the Claims To Windows Token Service account since the delegation tab was missing.
       The delegation has been changed to "Trust this user for delegation to specified services only". Also, selected the sub radio button "Use any
authentication protocol". Selected the Oracle Kerberos service as the service to which this account can present delegated credentials.
20. Restarted the SharePoint server.
21. Tested the data connection with the Kerberos settings again.
       Got the error
“ORA-12638: Credential retrieval failed”.
Can anyone tell me what is wrong with this setup?

http://www.freeoraclehelp.com/2011/10/kerberos-authentication-for-oracle.html
Problem4: ORA-12638: Credential retrieval failed
Solution: Make sure that SQLNET.KERBEROS5_CC_NAME is set in sqlnet.ora and okinit has been run before attempting to connect to the database.
Do check
http://webcache.googleusercontent.com/search?q=cache:5a2Pf3FH7vkJ:externaltable.blogspot.com/2012/06/kerberos-authentication-and-proxy-users.html+&cd=5&hl=en&ct=clnk&gl=in
If this helped you resolve your issue, please mark it Answered. You can reach me through http://itfreesupport.com/

Installation of oracle9i2 on redhat advanced server

I installed linux advanced server3.When i try to install oracle9i2
when i am running the runinstaller i am getting these errors
initialising java virtual machine from /tmp/orainstall /jre/bin/java please wait
/jre/bin/.386/native_threads/java..
error while loading shared librareis libstdc++
-libc6.1-1 cannot open shared object file:no such file or direcotories.
wheterh i ahve to install these packages.When i inserted advanced server cd 1 but this is
not installing from the cd.How to check where these rpm in the cd or which cd.How to install these
packages.
su - root
rpm -ivh \
compat-db-4.0.14-5.i386.rpm \
compat-gcc-7.3-2.96.122.i386.rpm \
compat-gcc-c++-7.3-2.96.122.i386.rpm \
compat-libstdc++-7.3-2.96.122.i386.rpm \
compat-libstdc++-devel-7.3-2.96.122.i386.rpm \
openmotif21-2.1.30-8.i386.rpm \
setarch-1.3-1.i386.rpm \
tcl-8.3.5-92.i386.rpm
with regards
ramya

Hi,
have a look at the following website:
http://www.oracle-base.com/articles/9i/Oracle9iInstallationOnRedHatAS3.php
There it's also explained where to find the filesets and how to install them.
Regards,
Steffen Jaiser

Kerberos authentication prompting for credentials in Sharepoint 2013

Hello all,
I think I’m a bit confused on what I should expect out of Kerberos and sharepoint.
Following the steps located in
http://blog.blksthl.com/2012/09/26/the-first-kerberos-guide-for-sharepoint-2013-technicians/ , I’ve setup Kerberos in my Sharepoint 2013 environment. My hope was that configuring kerberos authentication would solve the issue of users being prompted for
credentials when they access sharepoint. I know that one way to address this problem is to tweak the IE settings by adding the site to the local intranet or trusted zones, but am I wrong in thinking that Kerberos should also authenticate the user on to the
site? Here’s my situation:
Previously, I had our sharepoint URL in the trusted zone and had IE set to pass my credentials through, and that worked. After configuring Kerberos, I can see the tickets on my system using klist and the security log on our web front-end shows that I authenticated
using Kerberos.
However, if I then remove the sharepoint URL from the trusted zone in IE, I still get prompted for credentials. If I cancel the credential prompt, I get a 401 error and the security log on the server shows a NTLM login attempt.
As soon as I put the URL back in the trusted zone, I can access the site and the server log shows a Kerberos authentication.
I’m I wrong in thinking that if Kerberos was working properly then I shouldn't need to have the URL in the trusted zone?
Thanks
Bill

Thanks for the quick reply, Alex. At least it’s good to know it appears to be working as designed.
Thanks again,
Bill

HT1338 server will not respond when trying to update

The Software Update Server (macupdate.cg.ac.uk) is not responding.
Please help this is the message i get every time i try and update my software now i have an iphone 5 my itunes needs to be updated but it wont because i need the latest software update so i can download the new version of i tunes. I am using Mac OS X 10.6.7 i am running fine on internet and am connected with good broadband speed.
Thanks in advance

You're saying that there is an issue when trying to use Software Update to get to 10.6.8, correct? An alternate way to apply that update is to download the 10.6.8 update from the Apple download site.
Before running it, bring up Disk Utility, repair permissions, apply the update, and repair permissions again when done. With that, you can now install iTunes 7.

CS5 - "Not Responding" message when saving large files??

For quite some time now, I have been getting a message in the Save Progress Bar Dialogue that says "Not Responding" .... after I start saving a file. The progress bar will advance about 20%, then it will say (Not Responding) in the box.... and then it will disappear and the file will save.
It's very disconcerting to see this error pop up time-after-time when saving files.
I also get this error when opening certain files.
Anybody else get this error?
The files may typically have several 'placed' files from Photoshop.... which is another topic and unresolved problem with Illustrator too.
Anything to worry about??
Thanks.
Oh...
I have an Intel i7 with 12gbs of ram, a fast SAS boot drive, and plenty of bells and whistles in the 'power' department.
Todd

Have you already tried saving the file to a different location (maybe on the other drive)?
Just to find out if it's Illustrator or the drive.

Problems with update sever not responding

Hi,
I've had my mac pro for a few weeks now but when I went to update the software a window just pops up stating "the software update server (10.0.0.86) is not responding". My internet connection (via wireless) is working completely fine I can access the net using safari + Firefox
I have manually updated to OS X 10.6.2 but that still didn't fix the problem?
any help would be great! thanks,
Zane.

Hi,
After self attempts of trying to work the problem out I just rang apple support and had the most helpful guy guide me through fixing it (after a few attempts)
Here's how it was fixed:
-Open finder
-under Macintosh HD, open the library folder then scroll down through the list till you find preferences
-Once inside the preferences folder you need to find a file named: com.apple.SoftwareUpdate.plist
Drag that file to your desktop then try to run software update. If it works then just drag the file (com.apple.softwareupdate.plist) from your desktop into the bin (delete it)
Thanks to the WONDERFUL help from the guy at Apple support (Australia) this solution got mine up and running. Thought I would put the instructions up here if anyone else runs into the same problem

Advanced Server 10.5.7, Kerberos Authentication not responding

Similar Messages

Maybe you are looking for