Re: Confusion about delegation

2019-02-01 Thread Benjamin Kaduk
On Fri, Feb 01, 2019 at 02:54:39PM -0500, John Byrne wrote: > Thanks, this helps a lot. > > I think the reason it appeared to be working for me when I used the wrong > name HTTP/www.example.com is because I incorrectly had that principal in > the keytab of the other service. An in the second case,

Re: Confusion about delegation

2019-02-01 Thread John Byrne
Thanks, this helps a lot. I think the reason it appeared to be working for me when I used the wrong name HTTP/www.example.com is because I incorrectly had that principal in the keytab of the other service. An in the second case, where I omitted the creds altogether, you are correct, it just authen

Re: Confusion about delegation

2019-02-01 Thread Greg Hudson
On 1/31/19 1:32 PM, John Byrne wrote: > The client_ctx.step() call returns this error: gssapi.raw.misc.GSSError: > Major (851968): Unspecified GSS failure. Minor code may provide more > information, Minor (2529639053): Matching credential not found This is a bad error message, and we have an open

KDC 1.15.1 - addprinc random failure

2019-02-01 Thread Yegui Cai
Hi all. I run KDC 1.15.1. At the host, I use kadmin.local to add a principle. Very strange that my first attempt failed silently while the second attempt succeeded. Here are the steps: [root@gamma-hactive ~]# kadmin.local Authenticating as principal hdfs/ad...@example.com with password. kadmin.lo