返回
-
标题
Keytab Producing ERROR: Incorrect Password on join with version 4.2.x -
说明
Joining with a keytab created is producing the error:
ERROR: Incorrect Password.
-
原因
The the newer code ( 4.2 ) Its now defaulting to using AES instead of rc4, which doesn’t care about case. With the more secure encryption having the case correct is important.
-
解决办法
When specifying -u <name> with vastool and a keytab, make sure the case of the name matched the case of the principal in AD.
( sAMAccountName ).
You can test that this is the issue by removing the AES ciphers and joining with the keytab.
1.) Copy the keytab to a temporary location to ensure a backup copy is created.
2.) Run the following command replacing <keytab> with the keytab being used:
/opt/quest/bin/vastool ktutil -k <keytab> remove -e aes256-cts-hmac-sha1-96; vastool ktutil -k <keytab> remove -e aes128-cts-hmac-sha1-963.) Try using the keytab to join.4.) If successful run:/opt/quest/bin/vastool -k <path to keytab> -u <join account> attrs <join account> | sed 5q
5) Check the case of the joiner account name. If different that what was used initially test the join again with the correct case and the original keytab with the AES entries.