Kinit: Client not found in Kerberos database while getting initial credentials

Question

Hi all,
I am trying to configure application which uses Kerberos authentication.
Error message: 
kinit: Client not found in Kerberos database while getting initial credentials
I use Windows Server 2003 domain controller as LDAP server, Tomcat application (on Linux) and IIS application as client, and apache load balancer.
There is multidomain environment:  russia.domain.net, europa.domain.net, asia.domain.net;
Tomcat and IIS servers works behind a proxy server (Apache on Linux). 
For applications created two DNS  records type A. all DNS use IP address of Apache proxy server:
application-sandbox.russia.domain.net
applicationweb-sandbox.russia.domain.net
To confiure kerberos authentication i have performed the following steps:
1. Create user account in EUROPA domain and configure delegation for this:
EUROPE\application_sandbox
2. Register SPN for this account:
setspn -A HTTP/application-sandbox.russia.domain.net EUROPE\application_sandbox
setspn -A HTTP/application-sandbox EUROPE\application_sandbox
3. After i verified registered SPN for this account:
setspn.exe -L EUROPE\application_sandbox
Registered ServicePrincipalNames for CN=kxxb999,OU=Users,DC=europe,DC=domain,DC=net:
        HTTP/application-sandbox
        HTTP/application-sandbox.russia.domain.net
3. After i generate a keytab file:
ktpass /princ HTTP/application-sandbox.russia.domain.net:@RUSSIA.DOMAIN.NET /ptype krb5_nt_principal /crypto rc4-hmac-nt /mapuser EUROPE\application_sandbox /out application_sandbox.keytab -kvno 0 /pass Pa$$w0rd
4. Properties of account looks like the following:
Get-ADUser -Identity appication_sandbox -Properties CN, ServicePrincipalNames, UserPrincipalName
CN : kxxb999
DistinguishedName : CN=kxxb999,OU=Users,DC=europe,DC=domain,DC=net
Enabled : True
GivenName :
Name : kxxb999
ObjectClass : user
SamAccountName : application_sandbox
ServicePrincipalNames : {HTTP/application-sandbox, HTTP/application-sandbox.russia.domain.net}
Surname : application_sandbox
UserPrincipalName : HTTP/[email protected]
4.Note that CN and User logon name are different. SPN registered for DNS record.
There are no computer in domain with name application-sandbox.russia.domain.net. this is a DNS record for application.
5. Then i copy keytab file to Linux machine, configure krb5.conf file and trying to get TGT for registered principal name.
krb5.conf file:
[libdefaults]
default_realm = EUROPE.DOMAIN.NET
dns_lookup_realm = false
dns_lookup_kdc = false
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
[realms]
RUSSIA.DOMAIN.NET = {
kdc = dc01.russia.domain.net
admin_server = dc01.russia.domain.net
default_domain = russia.domain.net
EUROPE.DOMAIN.NET = {
kdc = dc01.europe.domain.net
admin_server = dc01.europe.domain.net
default_domain = europe.domain.net
[domain_realm]
europe.domain.net = EUROPE.DOMAIN.NET
.europe.domain.net = EUROPE.DOMAIN.NET
russia.domain.net = RUSSIA.DOMAIN.NET
.russia.domain.net = RUSSIA.DOMAIN.NET
[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true
Then i verified created keytab file:
klist -e -k -t application_sandbox.keytab
Keytab name: FILE:application_sandbox.keytab
KVNO Timestamp Principal
0 01/01/70 01:00:00 HTTP/[email protected] (arcfour-hmac)
And trying to get TGT ticket:
kinit -V -k -t application_sandbox.keytab HTTP/[email protected]
Using default cache: /tmp/krb5cc_0
Using principal: HTTP/[email protected]
Using keytab: application_sandbox.keytab
kinit: Client not found in Kerberos database while getting initial credentials
But if i use SamAccountName name with kinit commant then i can aquire TGT ticket:
[root@localhost security]# kinit application_sandbox
Password for [email protected]:
[root@localhost security]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]
Valid starting Expires Service principal
06/30/14 16:37:41 07/01/14 02:37:38 krbtgt/[email protected]
renew until 07/01/14 16:37:41
I'm in trouble. can anyone faced this problem?
Thank you

Answer 1

Hi all,
according to Amy answer I thought, how user principal could  not be found in Kerberos database, e.g AD domain.
My HTTP service works in RUSSIA domain, but user principal created in EUROPE domain.
Next, i have checked my ktpass command:
ktpass /princ HTTP/[email protected] /ptype krb5_nt_principal /crypto rc4-hmac-nt /mapuser EUROPE\application_sandbox /out application_sandbox.keytab -kvno 0 /pass
Pa$$w0rd
especially  the following parameters:
/princ HTTP/[email protected]
/mapuser EUROPE\application_sandbox
When generating keytab it changes userlogon name to HTTP/application-sandbox.russia.domain.net and set domain domain to RUSSIA.DOMAIN.NET
But no user principal with name application_sandbox in RUSSIA.DOMAIN.NET domain (e.g. Kerberos realm)
So solution is change RUSSIA.DOMAIN.NET to EUROPE.DOMAIN.NAME in ktpass command.
After that i am able to get TGT and authenticate in domain.