Page History

All Kerberos clients, including the Java Krb5LoginModule, require OS client configuration. The SafehausLoginModule which depends on the Krb5LoginModule also requires OS configuration. Luckily this is pretty easy to do but is Unfortunately, this is platform specific. This HOWTO covers OS configurations configuration of the Kerberos client subystem of clients on various operating systems.

*NIX /etc/krb5.conf Configuration

On most UNIX platforms Kerberos clients look for the /etc/krb5.conf file located in the /etc directory of the host. This file contains configuration settings for both servers and clients however we're only concerned with the client configuration aspect.

Minimum config file

At a minimum, you must configure your host so that it knows where to get Kerberos tickets. The minimum config file must list the default Kerberos realm and the location of at least one key distribution center (KDC).

Note that these configuration examples assume hostnames such as kdc.example.com will resolve on your network. If kdc.example.com is not found, you may see the error Error getting credentials: Cannot resolve network address for KDC in requested realm. Assuming you are running Kerberos on IP address '10.0.0.2', you can correct this with the following /etc/hosts entry.

10.0.0.2       kdc.example.com

In the [libdefaults] section the most important parameter to configure is the default_realm.

In the [realms] section you want to configure the EXAMPLE.COM realm. Remember case makes a difference and realm names need to be in all uppercase. In this section you can configure the server and port for the KDC. Apache Directory is the KDC and Kerberos by default runs on port 88.

In the [domain_realm] section we map the DNS domain name to the Kerberos realm name. Note that the first line has a '.' in front of the domain name.

Below is a minimal file contains a section for logging configuration, default settings, realms and DNS to domain mappings to easily locate the Kerberos Distribution Center (KDC). Below is an example krb5.conf configuration file from my a Linux workstation setup for the EXAMPLE.COM realm:

[logginglibdefaults]
 default = _realm = EXAMPLE.COM

[realms]
 EXAMPLE.COM = {
  kdc = kdc.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

Slightly more advanced configuration

The [realms] section here demonstrates a few configuration options. First, you can adjust the service ports to connect to. Second, you can configure a kpasswd_server. This is for the Change Password protocol service which also runs on Apache Directory. The default port for the Change Password protocol is 464. The last parameter in this section is the default_domain. This is the DNS domain name to use to locate the kdc and the kpasswd_server if they cannot be resolved by the non-qualified host name specified.

[libdefaults]
 default_realm = EXAMPLE.COMFILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false

 ticket_lifetime = 24h
 forwardable = yes 

 default_tgs_enctypes = des-cbc-md5
 default_tkt_enctypes = des-cbc-md5
 preferred_enctypes = des-cbc-md5
 permitted_enctypes = des-cbc-md5 

[realms]
 EXAMPLE.COM = {
  kdc = localhostkdc.example.com:88
  adminkpasswd_server = localhost:749kdc.example.com:464
  default_domain = karasuluexample.homeip.netcom
 }

[domain_realm]
 .karasuluexample.homeip.netcom = EXAMPLE.COM
 karasuluexample.homeip.netcom = EXAMPLE.COM

[kdc]
 profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam

Most advanced Linux configuration

You shouldn't have to get more advanced than this. While you can configure many parameters of tickets, like various times and encryption types, you shouldn't ever have to. You are better off setting realm-wide configuration on the KDC.

This example demonstrates how to configure resolution of KDC's in 2 realms. You would use a client configuration like this when you have configured cross-realm authentication, aka a "trust relationship."

[libdefaults]
 default_realm = EXAMPLE.COM

[realms]
 EXAMPLE.COM = {
   debugkdc = falsekdc.example.com
   forwardable = true
   krb4_convertkpasswd_server = falsekdc.example.com
 }

The logging section should be left as is. In the defaults section the most important parameters to configure is the default_realm. In the place of EXAMPLE.COM substitute in the capitalized Kerberos realm name which you setup for Triplesec in the configuration wizard.

In the \[realms\] section you want to again substitute your realm name for EXAMPLE.COM.  Remember case makes a difference and realm names need to be in all uppercase.  In this section you configure the server and port for the KDC.  Triplesec is the KDC and it's Kerberos port by default runs on port 88.  The next parameter is, *admin_server*, this is for the changepw protocol service which also runs on Triplesec.  The default port is 749 for this protocol and Triplsec runs the service by default on this port.  The last parameter in this section is the *default_domain*.  This is the DNS domain name to use to locate the *kdc* and the *admin_server* if they cannot be resolved by the non-qualified host name specified.

 EU.EXAMPLE.COM = {
  kdc = kdc.eu.example.com
 }
 
[domain_realm]
 .example.com = EXAMPLE.COM
 .eu.example.com = EU.EXAMPLE.COM

Some Kerberos clients

You can install kerberos clients from the apt repositories. A working GUI client is gnome-kerberos and the command-line tools can be found as krb5-workstation.

$ apt-get install gnome-kerberos

or

$ apt-get install krb5-workstation

When you run the gnome-kerberos client (/usr/bin/krb5) after a fresh install, you will see that the EXAMPLE.COM domain is already configured Wiki MarkupThe last section that we're concerned with is the \[domain_realm\] section. Here we map the DNS domain name to the Kerberos realm name. Note that the first line has a '.' in front of the domain name. You must also add a dot and substitute the search domain for the kdc and the admin_server.

Windows krb5.ini Configuration

Windows uses the same exact file format as does *NIX platforms (meaning syntax) except the name of the file is different and the file paths inside are Windows file paths. Other than this you can use the same information above for configuring Windows Kerberos client settings.

MacOSX Kerberos Configuration

The Kerberos configuration on MacOSX is stored in a plist configuration file named edu.mit.Kerberos.KerberosLogin.plist. It contains imilar settings as the krb5.conf file however it is located in specific places. More details on how to configure MacOSX for Kerberos consult the following page:

...

There is however a fallback ot to use a krb5.conf file in /etc for UNIX compatibility mode.