Apache 2.2 mod_auth_kerb SSO停止工作

我都不知道为什么它停止工作，这是我检查：

的httpd-error.log中：

[Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1264): [client 10.105.5.131] Acquiring creds for HTTP/<FQDN>@<LOCAL.DOMAIN> [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1411): [client 10.105.5.131] Verifying client data using KRB5 GSS-API [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1427): [client 10.105.5.131] Client didn't delegate us their credential [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1446): [client 10.105.5.131] GSS-API token of length 22 bytes will be sent back [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1264): [client 10.105.5.131] Acquiring creds for HTTP/<FQDN>@<LOCAL.DOMAIN> [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1411): [client 10.105.5.131] Verifying client data using KRB5 GSS-API [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1427): [client 10.105.5.131] Client didn't delegate us their credential [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1125): [client 10.105.5.131] GSS-API major_status:00090000, minor_status:00000000 

–

 sudo kinit -t /etc/krb5.keytab HTTP/<FQDN> 

工作正常，没有错误

• 为什么我有两个httpd模块文件夹？ / usr / lib64 / httpd / modules和/ etc / httpd / modules
• 反向代理多个内部FTP服务器
• Apache可以redirect到一个URL，但掩盖新的URL？
• RC4不禁用
• nginx和apache – 同一个IP上的多个虚拟主机 – 正确的configuration

sudo klist：

 Credentials cache: FILE:/tmp/krb5cc_0 Principal: HTTP/<FQDN>@<LOCAL.DOMAIN> Issued Expires Principal Jun 11 17:21:58 2015 Jun 12 00:01:57 2015 krbtgt/<LOCAL.DOMAIN>@<LOCAL.DOMAIN> 

的krb5.conf

 [libdefaults] ticket_lifetime = 24000 default_realm = <LOCAL.DOMAIN> dns_lookup_realm = false dns_lookup_kdc = false default_keytab_name = /etc/krb5.keytab rdns = false [realms] KC.KPLUS = { kdc = <dc.ip>:88 admin_server = <dc.ip>:88 default_domain = <LOCAL.DOMAIN> } [domain_realm] .<local.domain> = <LOCAL.DOMAIN> <local.domain> = <LOCAL.DOMAIN> [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } 

的.htaccess

 AddHandler cgi-script .cgi .pl Options +ExecCGI DirectoryIndex index.pl AuthName "<LOCAL.DOMAIN>" AuthType Kerberos Krb5Keytab /etc/krb5.keytab KrbAuthRealm <LOCAL.DOMAIN> KrbMethodNegotiate on KrbServiceName HTTP/<FQDN>@<LOCAL.DOMAIN> KrbMethodK5Passwd off KrbSaveCredentials on KrbVerifyKDC off Require valid-user 

检查客户端的stream量，显然它开始协商，同意在KRB5机器，并发送票。 因此收到401。

我无法弄清楚这里有什么问题，不胜感激。

  KrbServiceName Any