Mod_auth_kerb - Kerberos Authentication Apache Module

Hi,
I was wondering has anyone managed to compile modauthkerb for mac os x?
I am desperately trying to get it sorted but it won't compile properly!!
Please help!

To solve this we gave up trying to compile any additional modules and found that we could kerberize the xserve once we had set active directory to trust our xserve for delegation.

Similar Messages

Kerberos authentication with Apache Kerberos Module

Hi,
Using the Java GSS tutorials, I have been able to create code to successfully authenticate with our KDC server or from a local ticket cache.
However, I have been unsuccessful in using the obtained credentials to perform client authentication with a web server running Apache using Kerberos for authentication (mod_kerberos).
I have tried to use an SSLSocket to connect to the server, which works fine. To request a page that requires client side authentication, I have passed the necessary client headers, over the socket connection e.g.
GET: http://www.myhost.com/protected_page.html
HOST: www.myhost.com
AUTHENTICATE: negotiate XXXXX
However, I do not know what to put in place of XXXXX. Using some PHP code and Firefox, I have been able to observe what Firefox is passing to the web server to perform client side authentication. It is clearly passing a base64 encoded string, which is related to the cached Kerberos credentials.
Can anyone tell me, how I can use Java and GSS to perform client side authentication with an Apache web server that is using the Kerberos authentication module? I know it is possible to do so using SPEGNO in a Windows environment, but this is a Linux/Unix environment, so it is not an option.
Thanks for any help or advice,
Neil.

Here are your options:
1) Configure Krb5LoginModule programmatically.
If the environment variable KRB5CC_NAME points to the ticket cache location,
(which is updated each time), you can configure the Krb5LoginModule
programmatically and set the "ticketCache" option to the value obtained
from KRB5CC_NAME.
Refer to following docs for details:
http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/tutorials/LoginConfigFile.html
http://java.sun.com/j2se/1.5.0/docs/api/javax/security/auth/login/Configuration.html
http://java.sun.com/j2se/1.5.0/docs/api/javax/security/auth/login/AppConfigurationEntry.html
2) Use native Kerberos from the platform
Java SE 6 provides support for native GSS/Kerberos on Solaris/Linux platforms.
NOTE: If native GSS/Kerberos on your platform does not have support for SPNEGO,
you will not be able to use this option.
For details refer to following docs:
http://download.java.net/jdk6/docs/technotes/guides/security/jgss/jgss-features.html
Seema

Does a Kerberos authentication module exist?

Does anyone know of a Kerberos authentication module for Portal Server? If not, can anyone think of any security implications that would suggest "rolling my own" would not be a good idea?

No we don't have any kerberos auth module as a part of the product and you can develop your own using the auth api's.

Issue in confuguration of Kerberos authentication

Hi all
We are trying to configure Kerberos authentication for single sign-on on a SAP WAS 6.40 Java System. We configured the Kerberos using SPNEGO wizard. After configuring when we tried to login to UME, but it prompted for Username and Password which confirms that single sign on is not working.
In default trace file we got the following info
i. Key for the principal [email protected] not available in default key     tab
ii. [Krb5LoginModule] authentication failed
     Unable to obtain password from user
iii. Login module com.sun.security.auth.module.Krb5LoginModule from authentication stack com.sun.security.jgss.accept does not authenticate the caller.
iv. LOGIN.FAILED
    Unable to obtain password from user
1. Why password cannot be obtained from user?
2. Is there a default keytab other than the one created by the spnego wizard?
3. If there is one, then can we add the key for [email protected] in         that file and how?
4. How can this be resolved?
Regards
Deepu

Your log files are recording an authentication error, so that usually means your login information is incorrect, or just corrupted. Try reseting your Kerberos password, and if that doesn't work, double-check your Kerberos connectivity and configuration settings.

Question about Java GSS-Kerberos authentication

Hi,
I am new to GSS API. I have a client requirement to use Java GSS Kerberos Authentication instead of using IIS for Integrated Windows Authentication. In IWA, the IE browser automatically picks up the logged-in windows user credentials and passes it to IIS, which authenticates you against Active Directory and returns SUCCESS.
We are planning to write a Servlet/JSP code on Apache Tomcat on Solaris 10, which uses Java GSS API to do Kerberos Authentication and return SUCCESS to the user. When I look at the examples:
http://java.sun.com/j2se/1.4.2/docs/guide/security/jgss/tutorials/AcnOnly.html#RunAc
it says:
"You will be prompted for your Kerberos user name and password, and the underlying Kerberos authentication mechanism specified in the login configuration file will log you into Kerberos. If your login is successful, you will see the following message: Authentication succeeded!"
Does this mean that in Kerberos Authentication using Java GSS API, the user will have to enter his windows credentials for authentication? Is there a way for the credentials to be passed from Windows automatically to the API, without user intervention?
Any links detailing the procedure would be of great help.
Thanks,
shetty2k

We are having a similar requirement from our end. To make situation worst I do not even have an idea about an approach.
What are the ways that we can use windows credentials to authenticate against IIS with tomcat?
any help is greatly appreciated.
R.

EP 6.0 SP2 + external kerberos authentication

We recently installed EP 6.0 SP2 Patch 4 HF 6 on an Aix 5.2 unix platform. We would like to create our own authentication scheme that uses a login module written in Java that does kerberos authentication externally. From reading the Portal Security Guide it appears that this is a doable approach. Has anyone actually done this with the portal on a unix platform? Which Java kerberos library implementation did you use?
Thanks in advance.
Sincerely,
Steven McElwee, Duke University

Hi,
as mentioned above, you need a second server. This one could be Windows. People use this architecture in productive environments.
If this does not work for you, you need to go the second approach: Custom JAAS login module using the WebCallback plus a kerberos library.
Here some links:
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sapportals.km.docs/documents/a1-8-1/pluggable authentication implementing a jaas login module presentation
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sapportals.km.docs/documents/a1-8-1/pluggable authentication implementing a jaas login module exercises
Best regards,
Oliver

Kerberos Authentication on an NT machine.

I have this config file:
MyAuth {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true doNotPrompt=true;
I want to authenticate a user using an already existing Kerberos Cache. This works fine on a sun box, but fails on an NT. I think I need to set the TicketCache attribute for the NT machine, but can't find out how designate the memory cache. Anyone have any idea how to do this (which enables single signon)?

A listing of the Exception would have been good, however, l can give you a few tips on where to look.
(1) Check your runtime arguments that you supply to the JAAS login module. They should include:
% java -Djava.security.manager
-Djava.security.krb5.realm=<your_realm>
-Djava.security.krb5.kdc=<your_kdc>
-Djava.security.auth.login.config=jaas.conf JaasLogin
Namely check that your realm and kdc parameters are pointing to the correct addresses.
(2) Make sure that Kerberos Authentication Protocol is used on the NT Domain server.
I have found that and application called KerbTray has been very useful in providing useful information. This program allows you to view the Credential Information stored in the Credentials Cache. This application can be found at the Microsoft site.
For further reference.. check out the information on :
http://java.sun.com/j2se/1.4/docs/guide/security/jgss/tutorials/AcnOnly.html
Goodluck.

Kerberos authentication

Hi,
I have set up kerberos authentication for my application, but I allways get 401 - Unauthorized.
I've done all steps from http://e-docs.bea.com/wls/docs92/secmanage/sso.html - Single Sign-On with Microsoft Clients: Main Steps.
C:\jaas.conf:
com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
principal="host/[email protected]" useKeyTab=true refreshKrb5Config=true
keyTab="c:\\pc179.keytab" storeKey=true debug=true;
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required
principal="host/[email protected]" useKeyTab=true refreshKrb5Config=true
keyTab="c:\\pc179.keytab" storeKey=true debug=true;
C:\krb5.conf:
\[libdefaults\]
default_realm = CCA.CZ
dns_lookup_kdc = true
default_tkt_enctypes = des-cbc-crc
default_tgs_enctypes = des-cbc-crc
\[realms\]
CCA.CZ = {
kdc = BOBES.CCA.CZ
\[domain_realm\]
.cca.cz = CCA.CZ
\[appdefaults\]
autologin = true
forward = true
forwardable = true
encrypt = true
I also have created security realm CCA.CZ as a copy of myrealm with WebLogic Negotiate Identity Assertion provider added.
Server is starting with parameters -Djava.security.krb5.conf=c:/krb5.conf -Djava.security.auth.login.config=c:/jaas.conf -Djavax.security.auth.useSubjectCredsOnly=false -Dweblogic.security.enableNegotiate=true -Dsun.security.krb5.debug=true -Djava.security.krb5.realm=CCA.CZ -Djava.security.krb5.kdc=BOBES.CCA.CZ
When I request any secured page, the server returns 401 with WWW-Authenticate: Negotiate header. So browser sends another request with Authorization: Negotiate and ticket. Server then returns 401 without authentication header (instead of requested page - which I expect).
Can you please tell me what am I doing wrong?
(WebLogic v10.3)
Edited by: user11038158 on 15.4.2009 0:50

Hi:
Did you manage to overcome this problem? I'm having the same problem and any help would be highly appreciated.
Cheers,
Albert

Kerberos authentication with Active Directory

I have tried using JAAS to authenticate to MS Active Directory and keep getting "javax.security.auth.login.LoginException: Pre-Authentication Information was invalid"
I have tried authenticating with multiple user accounts and on three different realms (Active Directory domains).
How do I need to format the username? I know that when using JNDI to access Active Directory I have to use the format "[email protected]" or the RDN. I have tried it both ways with JAAS kerberos authentication as well as with just the username by itself. I don't think that the username format is the problem though because if I set the account lockout policy to 5 failed attempts, sure enough my account will be locked out after running my code 5 times. If I give a username that doesn't exist in Active Directory I get the error "javax.security.auth.login.loginexception: Client not found in Kerberos database" Is there something special that I have to do to the password?
I know that there is just something stupid that I'm missing. Here is the simplest example of code that I'm working with:
import java.io.*;
import javax.security.auth.callback.*;
import javax.security.auth.login.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
public class krb5ADLogin1 {
public static void main(String[] args){
LoginContext lc = null;
try {
lc=new LoginContext("krb5ADLogin1", new TextCallbackHandler());
lc.login();
catch(Exception e){
e.printStackTrace();
Here is my config file:
krb5ADLogin1 {
com.sun.security.auth.module.Krb5LoginModule required;
The command I use to start the program is:
java -Djava.security.krb5.realm=mydomain.com
-Djava.security.krb5.kdc=DomainController.mydomain.com
-Djava.security.auth.login.config=sample.conf krb5ADLogin1

Hi there ... the Sun web site has the following snippet:
http://java.sun.com/j2se/1.4/docs/guide/security/jgss/tutorials/Troubleshooting.html
+ javax.security.auth.login.LoginException: KrbException::
Pre-authentication information was invalid (24) - Preauthentication failed
Cause 1: The password entered is incorrect.
Solution 1: Verify the password.
Cause 2: If you are using the keytab to get the key (e.g., by
setting the useKeyTab option to true in the Krb5LoginModule entry
in the JAAS login configuration file), then the key might have
changed since you updated the keytab.
Solution 2: Consult your Kerberos documentation to generate a new
keytab and use that keytab.
Cause 3: Clock skew - If the time on the KDC and on the client
differ significanlty (typically 5 minutes), this error can be
returned.
Solution 3: Synchronize the clocks (or have a system administrator
do so).
Good luck,
-Derek

Kerberos Authentication Not Working on OS X 10.6

Using FF version 20.0, on OS X 10.6.8, I can not get it to use Kerberos authentication to allow SSO to a SharePoint web site.
On OS X 10.8, with the same configuration in the about:config, everything works fine - the user is not prompted for credentials.
I have put the necessary entires in network.negotiate-auth.delegation-uris and network.automatic-ntlm-auth.trusted-uris, network.negotiate-auth.gsslib is set to true.
When I have setup to log the errors from the authentication module, I find in the log file "Fail to load gssapi library".
Interestingly on 10.8, when I start Firefox from the command line the Kerberos authentication does not work. When I start it via the icon, it does. What is the difference? Are the preferences not being loaded when launching via the command line?
Thanks for any help,
Richard

Found the solution:
Was a combination of kinit being run on login (apparently a known 10.6 bug). Our Mac team were able to alter the appropriate plist file so that this does happen on login.
We also had to add an extra SPN for the actual server, as well as the DNS name of the SharePoint site we were trying to access with Kerberos authentication - although this may have something to do with using host-named site collections at the SharePoint end.
Main problem was the kinit thing though.

Exchange Management Console couldn't start with Kerberos authentication failed

When I was making changes to Client Access\owa settings, chaning from Basic authentication to Form authentication (upn name) then changed to Basic again. It was ok after changing to Form authentication but moment after changing back to Basic, I couldn't
no longer access owa (blank page when one vertical line) and in Exchange Management Console, I got "Initialization failed" - The following error occured while attempting to connect to the specified Exchange server 'sgp-ex1.mydomain.com':
The attempt to connect to http://sgp-ex1.mydomain.com/powershell using "Kerberos" authentication failed: Connecting to the remote server failed with the following error message: The WinRM client cannto process
the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid. For more information, see the about_Remote_Troubleshooting Help topic.
I tried the troubleshooting tool from Exchange team blog:
http://blogs.technet.com/b/exchange/archive/2010/12/07/3411644.aspx. It give 3 possible causes for this error: 1. WSMan module entry is missing from global module section of c:\Windows\System32\InetSrv\Config\ApplicationHost.config; 2. Kerbauth module shows
up as Managed module or has been loaded in the Default Web Site Level; 3. The Path of the Powershell virtual directory has been modified.
I checked carefully, all the 3 causes do not apply to my situation as WSman entry is in order, the Kerbauth is native and local and the path of Powershell virtual directory is correct.
I find that in Application log, there are Event 2297 and 2307 dumped at the time of failure:
The worker process for application pool 'MSExchangeSyncAppPool' encountered an error 'Confiugration file in not well-formed XML' trying to read configuration data from file '\\?\C:\inetpubl\temp\apppools\MSExchangeSyncAppPool\MSExchangeSyncAppPool.config',
line number '2'. The data field contains the error code.
Help is very much appreciated.
Valuable skills are not learned, learned skills aren't valuable.

Unfortunately, all the links you provided didn't help.
The first link contains 3 methods:1 Removing WinRM feature and reinstalling. 2 Rename the web.config file in location C:\inetpub\wwwroot 3 Have you installed Microsoft Dynamics CRM 4. I?
As my server is Windows 2008 R2, the first method does not apply. I couldn't find any web.config in c:\Inetpub\wwwroot. The web.config however is found in many times in .netframework and winsxs directories. The 3rd method doesn't apply as I don't have CRM.
The 2nd link contains 3 possible causes. The first 2 are the same as the ones I mentioned in my initial post. I couldn't verify the last cause because when open Exchange Management Shell, I got this error: [sgp.ex1.mydomain.com] connecting to remote server
failed with the following server failed with the following error message: The WinRM client cannot process the request, it cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalide. For more
information, see the about_Remote_Troubleshooting Help topic.
I do not think the user is not remote powershell enabled because the problem happened suddenly, while I was making changes to Authentication settings of OWA(default) in Client Access in Exchange Management Console. If the user account is not remote powershell
enabled, then I couldn't event connect to EMC in the first place.
The last link didn't help because I could open up modules under PowerShell virtual directory in IIS.
I think since the event log is saying MSExchangeSyncAppPool.config and DefaultAppPool.config not well-formed XML, that might be a clue.
In the event id 2307 this is the message:
The worker process for application pool 'DefaultAppPool' encountered an error 'Configuration file is not well-formed XML
' trying to read configuration data from file '\\?\C:\inetpub\temp\apppools\DefaultAppPool\DefaultAppPool.config', line number '2'. The data field contains the error code.
Valuable skills are not learned, learned skills aren't valuable.

Portal Drive Single Sign On and Kerberos Authentication

Hi,
We are using NW2004s SP10 Portal and we have successfully configured Kerberos authentication with Windows Active Directory 2003. To access the KM Content in windows explorer format, we are using Portal Drive but Portal Drive still asks for authentication i.e. SSO is not working for Portal Drive. I have understood from the forums and sap help site that SSO from portal drive will work only for NTLM authentication and client certificates. Can you please help regarding below questions.
1. Can Kerberos and NTLM authentication be configured together.
2. If yes, what are the steps to configure NTLM authentication for NW2004s SAP Portal and Active Directory 2003.
3. Any other approach to make Portal Drive SSO work.
Helpful answers will be rewarded.
Regards,
Chandra

Hi Gregor,
I did two things:
first i made a change in the portalapp.xml in the PAR file "com.sap.km.cm.par". In the section authentication scheme for "docs" I changed the authentication scheme to "default" to make sure that documents are opened using the default authentication scheme (SPNego) instead of basic authentication
second, I used the SPNego wizard to configure SPNego. So I didn't adjust anything in the Visual Admin or the authentication template apart from adding the Template to the Ticket policy configuration.
Again, this only worked after installing the latest vesion.
Hope this helps
Marcel

BO XI Release 2 - NLTM versus Kerberos Authentication

Hello,
I have some problem with Authentication. At first time I set up only in CMS Kerberos Authentication, but now I would like to change it to NLTM, but if I clear the Use Kerberos authentication and I mark off Use NTLM authentication and I set up update, it doesn´t work.
Authentication Options
Use NTLM authentication
Use Kerberos authentication
Cache security context (required for SSO to database)
Service principal name:
Thank you very much for your answer,
unhappy:( Marika

You can set up kerberos for both, it's required for java. .net will support both kerberos and NTLM although unless you are trying to delegate credentials all the way to your DB, then it usually isn't desired in .net because the configuration is far more complex
You can simple look at your logon url to figure out if you are hitting IIS (urls end in aspx and no port #) or tomcat(urls end in .do and port 8080).
Regards,
Tim

Kerberos Authentication between Sharepoint 2013 Foundation - SSRS 2012 - Oracle 11g failing with ORA-12638: Credential retrieval failed

I have set up SharePoint 2013 Foundation, SharePoint Reporting Services and SQL Server 2012 in a single server. I then created a Data Connection to Oracle 11g. Upon testing the connection, it throws the error “ORA-12638: Credential retrieval failed”.
Given below are the steps of installation and configuration.
Installation till basic authentication:
The installation has been done in a
single server.
Installed SQL Server 2012 (Developer version).
Selected only the following features:
Database Engine Services
Analysis Services
Reporting Services – SharePoint
Reporting Services Add-in for SharePoint Products
Management Tools – Basic
- Management Tools - Complete
2. Installed SQL Server 2012 SP1.
3. Installed SQL Server 2012 SP2.
  4. Installed SharePoint Foundation 2013.
5. Created web application (without Kerberos; we did not even create the SPNs).
      The application pool has been configured to use Reporting Services account since it is a single server installation. This account has been registered as a managed
account.
6. Created Site Collection.
7. Verified that Reporting Services is not installed.
8. Installed SharePoint Reporting Services from SharePoint 2013 Management Shell.
9. Verified that Reporting Services is installed.
10. Created a new SQL Server Reporting Services Service Application and associated the Web Application to the new SQL server Reporting Services Service Application.
11. Verified that SQL Server Reporting Services Service Application and its proxy have started. Reset IIS.
12. Created a Site.
  13. Created a Data Connection library with “Report Data Source” content type.
14. Created a Report Model library with “Report Builder Model” content type.
15. Created a Report library with “Report Builder Report” content type.
16. Uploaded an SMDL to the Report Model library.
  17. Added the top level site to Local Intranet instead of as a Trusted Site in the browser settings.
  18. Able to create and save a report using Report Builder.
Hence, basic authentication is working and SSRS is able to connect to Oracle database.
Next we have to configure Kerberos settings between SharePoint and SQL Server.
Implementation of Kerberos authentication
In the Report Server machine, opened the file C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\WebServices\Reporting\rsreportserver.config and added the Authentication Types of RSWindowsNegotiate
and RSWindowsKerberos.
2. Set up the following SPNs.
               a) SQL Server Database Engine service (sqlDbSrv2):
                setspn -S MSSQLSvc/CER1110:1433 CERDEMO\sqlDbSrv2
                setspn -S MSSQLSvc/CER1110.cer.demo.com:1433 CERDEMO\sqlDbSrv2
             In the Delegation tab of the account, selected "Trust this user for delegation to any service (Kerberos only)".
b) Account: SharePoint Setup Admin account (spAdmin2)
     setspn -S HTTP/CER1110:9999 CERDEMO\spAdmin2
                setspn -S HTTP/CER1110.cer.demo.com:9999 CERDEMO\spAdmin2
                In the Delegation tab of the account, selected "Trust this user for delegation to any  service
(Kerberos only)".
c) Account: SQL Server Reporting Service account (sqlRepSrv2)
                   setspn -S HTTP/CER1110 CERDEMO\sqlRepSrv2
                   setspn -S HTTP/CER1110.cer.demo.com CERDEMO\sqlRepSrv2
                   In the Delegation tab of the account, selected "Trust this user for delegation to any service
(Kerberos only)".
3. Configure the Web Application to use “Negotiate (Kerberos)”.
4. Logged in as SharePoint Administrator to the SharePoint server and opened the top level site in the IE browser.
     The Event Viewer logged the login process for the SharePoint Administration account as
Negotiate and not Kerberos.
5. Implemented Kerberos for Oracle database and client.
     Able to connect to the Oracle database via Kerberos authentication using SQL Plus.
6. Turn on Windows Firewall.
7. While testing the site's data connection using Kerberos settings, got the error
“Can not convert claims identity to windows token. This may be due to user not logging in using windows credentials.”
      Note: The Data Connection for basic authentication still worked.
8. Created a Claims to Windows Token Service account (spC2WTS2).
9. Started the Claims to Windows Token Service.
10. Registered the Claims to Windows Token Service account as a Managed Account.
11. Changed the Claims To Windows Token Service to use the above managed account.
12. Verified that the Claims to Windows Token Service account (spC2WTS2) is automatically added to the WSS_WPG local group on the SharePoint box.
      Note: The Reporting Services service account is also a part of the WSS_WPG local group.
13. Added the Claims to Windows Token Service account (spC2WTS2) to the Local Admin Group on the machine having the SharePoint App Server.
14. In the SharePoint box, added the Claims to Windows Token Service account (spC2WTS2) in the Act as part of the operating system policy right.
15. The Claims to Windows Token Service account (spC2WTS2) has the WSS_WPG group configured.
      When the C2WTS service was configured to use the managed account Claims to Windows Token Service account (spC2WTS2) earlier, the spC2WTS2 account was automatically
added to the WSS_WPG local group on the SharePoint box. The WSS_WPG group in turn is configured in c2wtshost.exe.config file.
16. Verified that the Reporting Services account is a managed account and part of the WSS_WPG group.
17. Earlier Service Application Pool - SQL Server Reporting Services App Pool service was associated with the SharePoint Admin account.
      Changed this to associate the Reporting Service account with the Service Application Pool - SQL Server Reporting Services App Pool service.
18. Changed the delegation of the Reporting Service account to constrained delegation with Protocol Transitioning. This is because we are transitioning from one authentication scheme (Claims) to another (Windows Token).
      For this, the delegation has been changed to "Trust this user for delegation to specified services only". Also, selected the sub radio button "Use
any authentication protocol". Selected the Oracle Kerberos service as the service to which this account can present delegated credentials.
      Note: The Reporting Service account already had an HTTP SPN.
19. Next, the goal was to make the Claims To Windows Token Service account match the Reporting Service account.
       For this, we created a fake SPN for the Claims To Windows Token Service account since the delegation tab was missing.
       The delegation has been changed to "Trust this user for delegation to specified services only". Also, selected the sub radio button "Use any
authentication protocol". Selected the Oracle Kerberos service as the service to which this account can present delegated credentials.
20. Restarted the SharePoint server.
21. Tested the data connection with the Kerberos settings again.
       Got the error
“ORA-12638: Credential retrieval failed”.
Can anyone tell me what is wrong with this setup?

http://www.freeoraclehelp.com/2011/10/kerberos-authentication-for-oracle.html
Problem4: ORA-12638: Credential retrieval failed
Solution: Make sure that SQLNET.KERBEROS5_CC_NAME is set in sqlnet.ora and okinit has been run before attempting to connect to the database.
Do check
http://webcache.googleusercontent.com/search?q=cache:5a2Pf3FH7vkJ:externaltable.blogspot.com/2012/06/kerberos-authentication-and-proxy-users.html+&cd=5&hl=en&ct=clnk&gl=in
If this helped you resolve your issue, please mark it Answered. You can reach me through http://itfreesupport.com/

Updating hybrid configuration failed - Kerberos authentication: The network path was not found

I'm configuring Exchange 2010 SP3 as a Hybrid server with Exchange Online. This is a single server running Exchange roles Mailbox, Client Access, Unified Messaging and Hub Transport.
When I run the Manage Hybrid Configuration, I receive the following error:
Updating hybrid configuration failed with error
'System.Management.Automation.Remoting.PSRemotingTransportException: Connecting to remote server failed with the following error message : WinRM cannot process the request. The following error occurred while using Kerberos authentication: The network
path was not found.
The full text from the Hybrid Configuration log file (C:\Program Files\Microsoft\Exchange Server\V14\Logging\Update-HybridConfiguration)
[1/5/2014 21:21:1] INFO:Opening runspace to
http://[servername]/powershell?serializationLevel=Full
[1/5/2014 21:21:1] INFO:Disconnected from On-Premises session
[1/5/2014 21:21:1] ERROR:Updating hybrid configuration failed with error 'System.Management.Automation.Remoting.PSRemotingTransportException: Connecting to remote server failed with the following error message : WinRM cannot process the request. The following
error occured while using Kerberos authentication: The network path was not found.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
   at System.Management.Automation.Runspaces.AsyncResult.EndInvoke()
   at System.Management.Automation.Runspaces.Internal.RunspacePoolInternal.EndOpen(IAsyncResult asyncResult)
   at System.Management.Automation.Runspaces.RunspacePool.Open()
   at System.Management.Automation.RemoteRunspace.Open()
   at Microsoft.Exchange.Management.Hybrid.RemotePowershellSession.Connect(PSCredential credentials, CultureInfo sessionUiCulture)
   at Microsoft.Exchange.Management.Hybrid.Engine.Execute(ILogger logger, String onPremPowershellHost, PSCredential onPremCredentials, PSCredential tenantCredentials, HybridConfiguration hybridConfiguration)
   at Microsoft.Exchange.Management.SystemConfigurationTasks.UpdateHybridConfiguration.InternalProcessRecord()'.
I have sought help, posting on the forum at community.office365.com -
http://community.office365.com/en-us/forums/158/t/212265.aspx. But I've got to a point where I believe the problem is more to do with how PowerShell is operating on the on-prem Exchange server.
Has anyone else come across this problem running the Hybrid Configuration Wizard?

Hello Darrell,
Have you verified the settings of Powershell virtual directories for the on-premises Exchange Servers? The following article has a list of some common issues with that virtual directory and how to correct them:
http://technet.microsoft.com/en-us/library/ff607221(v=exchg.80).aspxI would take a look at the one titled "Configure Kerberos Authentication" specifically to ensure everything
looks good.
As the article states you can run the Exchange BPA and it will check if any of these exist as well.

Mod_auth_kerb - Kerberos Authentication Apache Module

Similar Messages

Maybe you are looking for