Cannot get Kerberos service ticket: KrbException: Server not found in Kerberos database (7)

active-directory kerberos
ohshazbot picture ohshazbot · Dec 13, 2012 · Viewed 101.3k times · Source

I'm developing using the GSSAPI, and I have code which works with a vanilla MIT Kerberos 5 server to do some client/server work. I'm now verifying it's functionality against Active Directory and I've hit an issue.

I have my server authenticated and listening. I can get the client to login. For the record, this is code based off of http://thejavamonkey.blogspot.com/2008/04/clientserver-hello-world-in-kerberos.html. However, I cannot get the client to get the ticket back from AD to get the session between it and the server. I get KrbException: Server not found in Kerberos database (7), and I cannot figure out where the proper place is to add it. I've tried putting the server name with ip in the hosts file, updating dns, putting in server records, etc, with no luck.

If anyone knows where the proper place is to update AD to set a server in the Kerberos Database, that would be great!

Answer

Michael-O picture Michael-O · Dec 13, 2012

This exception comes from the client, right? Please perform a forward and reverse DNS lookup of the server hostname. Your server has incorrect DNS entries. They are absolutely crucial for Kerberos. The proper place is your DNS server, in your case: domain controller. Figure out the IP address of your DNS server and contact your admin. The other option is a missing SPN, please check that too.

Related questions

How to connect with Java into Active Directory

I am using Weblogic, Ejb3.0. Java 1.6 I need to access Active Directory via Java code. I read about several ways (Kerberos, LDAP) Anyone could advice me on comfortable way of doing so? where could I have some full code examples, …

Read More
kinit: Client's credentials have been revoked while getting initial credentials

I have hdp cluster configured with kerberos with AD. All HDP service accounts have principals and keytabs generated including spark. I know service accounts will not have passwords and set to unexpire. Now while doing kinit -kt spark.keytab -p …

Read More
Java Authentication against Active Directory, authentication mismatch?

So I have some code which I'm testing to make sure it works nicely for authentication. It works fine against straight kerberos, so I figured there should only be some minor hiccups with AD. Unfortunately, I cannot get around a …

Read More