Client not found in Kerberos database

Question

I use CAS and Spnego-support,and KDC is 192.168.1.244,my realm is EXAMPLE.COM I test my local Windows domain enviroment,and i can got ticket from Example.com I test it by "kinit" command,but in CAS spnego enviroment,There is a exception Client not found in Kerberos database,and i already create it in C:\windows\krb5.ini,content like follow

krb5.ini

[libdefaults]
   ticket_lifetime = 20000
   default_realm = EXAMPLE.COM
   dns_lookup_realm = true
   dns_lookup_kdc = false
   forwardable = yes
   default_tkt_enctypes = rc4-hmac
   default_tgs_enctypes = rc4-hmac


 [realms]
 # use "kdc =" if realm admins haven't put SRV records into DNS
    EXAMPLE.COM = {
            kdc = 192.168.1.244:88
            #admin_server = 192.168.1.244:749
            default_domain = EXAMPLE.COM         
    }

[domain_realm]
   .example.com = EXAMPLE.COM
   example = EXAMPLE.COM

[logging]
   kdc = CONSOLE

And the exception report like follow:

Debug is  true storeKey false useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Co
nfig is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
                [Krb5LoginModule] user entered username: HTTP/[email protected]

default etypes for default_tkt_enctypes: 23.
Acquire TGT using AS Exchange
>>> KdcAccessibility: reset
default etypes for default_tkt_enctypes: 23.
>>> KrbAsReq calling createMessage
>>> KrbAsReq in createMessage
>>> KrbKdcReq send: kdc=192.168.1.244 UDP:88, timeout=30000, number of retries =3, #bytes=142
>>> KDCCommunication: kdc=192.168.1.244 UDP:88, timeout=30000,Attempt =1, #bytes=142
>>> KrbKdcReq send: #bytes read=96
>>> KrbKdcReq send: #bytes read=96
>>> KdcAccessibility: remove 192.168.1.244
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
         sTime is Tue Dec 31 15:32:08 CST 2013 1388475128000
         suSec is 348958
         error code is 6
         error Message is Client not found in Kerberos database
         realm is EXAMPLE.COM
         sname is krbtgt/EXAMPLE.COM
         msgType is 30
                [Krb5LoginModule] authentication failed
Client not found in Kerberos database (6)
jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
        at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
        at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
        at jcifs.spnego.Authentication.process(Authentication.java:235)
        at org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler.doAuthentication(JCIFSSpnegoAuthenticationHand
ler.java:70)
        at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate_aroundBody2(AbstractPreAndPostP
rocessingAuthenticationHandler.java:85)
       ...
Caused by: KrbException: Client not found in Kerberos database (6)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:66)
        at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:446)
        at sun.security.krb5.Credentials.sendASRequest(Credentials.java:401)
        at sun.security.krb5.Credentials.acquireTGT(Credentials.java:350)
        at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:662)
        ... 176 more
Caused by: KrbException: Identifier doesn't match expected value (906)
        at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
        at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
        at sun.security.krb5.internal.ASRep.<init>(ASRep.java:53)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:50)
        ... 180 more

but why client not found in kerberos database ? kerberos should not be create on my local ? thx for point.

Answer 1

For me, this error occurred because my Krb5LoginModule configuration file was missing the following argument in the accept section:

isInitiator=false

Without that argument, the server was also trying to contact the KDC and get a ticket - but that should not happen - the server should have no need to contact the KDC.