Issue with Kerberos setting in Sun Solaris 10

[Ray Vand]

Hello,

I am new to Kerberos world and having issue with setting this up and need help and direction.

I am trying to setup SSO in the following environment.

Domain: company.com
Short Domain: AD (This how we login to User Client - AD\<Login Name>

AD domain server --> ads (Windows 2008 R2 )
SAP Server --> SAPSVR (Sun Solaris 10)
User Client --> Mac OS 10.8

I have created user in AD domain server as below

user: sapldap
Password: Changem3 (never expire)
Use DES encryption type for this account

Then I ran the following two command in AD Domain sever

C:\Windows\system32>setspn -A sapldap/ads.company.com AD\sapldap
Registering ServicePrincipalNames for CN=sapldap,CN=Users,DC=company,DC=com
sapldap/ads.company.com
Updated object

C:\Windows\system32>ktpass -princ sapldap/***@COMPANY.COM -mapuser AD\sapldap -crypto DES-CBC-MD5 -ptype KRB5_NT_PRINCIPAL -mapop set +desonly -pass Changem3 -out sapldap.keytab
Targeting domain controller: ADS.company.com
Using legacy password setting method
Successfully mapped sapldap/ads.company.com to sapldap.
Key created.
Output keytab to sapldap.keytab:
Keytab version: 0x502
keysize 66 sapldap/***@COMPANY.COM ptype 1 (KRB5_NT_PRINCIPAL) vno 7 etype 0x3 (DES-CBC-MD5) keylength 8 (0x5785314ff4ada2b6)
Account sapldap has been set for DES-only encryption.

Then I moved the sapldap.keytab to my SAP Server in tmp directory

In my SAP Server, I ran the following commands

modify /etc/krb5.conf as below:

libdefaults]
default_realm = COMPANY.COM
default_keytab_name = /etc/krb5.keytab
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5

[realms]
COMPANY.COM = {
kdc = ads.company.com:88
admin_server = ads.company.com
default.domain = COMPANY.COM
kpasswd_server = ads.company.com
}

[domain_realm]
.company.com = COMPANY.COM
company.com = COMPANY.COM

Then

# ktutil
ktutil: rkt /tmp/sapldap
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 7 sapldap/***@COMPANY.COM (DES cvc mode with RSA-MD5)

ktutil: wkt /etc/krb5.keytab
ktutil: q

Here is where I am getting error/having issue when running next command.

# kinit -V -k sapldap/***@COMPANY.COM

kinit(v5): Key table entry not found while getting initial credentials

but if I use it without -k option it working and It takes password

# kinit sapldap/***@COMPANY.COM
Password for sapldap/***@COMPANY.COM:

Then when I try klist

# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: sapldap/***@COMPANY.COM

Valid starting Expires Service principal
04/19/13 10:01:53 04/19/13 20:01:53 krbtgt/***@COMPANY.COM
renew until 04/26/13 10:01:53

I appreciate any help.

Regards,
RayV

[Benjamin Kaduk]

Post by Ray Vand
Then I moved the sapldap.keytab to my SAP Server in tmp directory
# ktutil
ktutil: rkt /tmp/sapldap
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /etc/krb5.keytab
ktutil: q
Here is where I am getting error/having issue when running next command.
kinit(v5): Key table entry not found while getting initial credentials
but if I use it without -k option it working and It takes password

It is a bit perplexing. Stock Solaris 10 is not an environment I am
familiar with, but I can speak some about the related MIT krb5 codebase.

With a des-cbc-md5 key, a common problem would be the need to specify
allow_weak_crypto=true in krb5.conf. However, since password
authentication works, that is unlikely to be the cause.

What I would try at this point is to use ktutil's addent subcommand to
generate a keytab using the password (which is known to work). It's
probably best to use a separate keytab from /etc/krb5.keytab for this
test, so that the different keytab entries can be told apart. Then use
the -t argument to kinit to specify a path to that new keytab. If I
remember correctly, the keytab entry's kvno field is not used when getting
initiator credentials, so even if 'kinit -k -t' works, that is not a
guarantee that the keytab will work for acceptor credentials, as in that
case the kvno must be correct (that is, in agreement with the KDC (domain
controller) database).

-Ben KAduk

[Dagobert Michelsen]

Hi Ray,

Post by Benjamin Kaduk

Post by Ray Vand
Then I moved the sapldap.keytab to my SAP Server in tmp directory
# ktutil
ktutil: rkt /tmp/sapldap
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /etc/krb5.keytab
ktutil: q
Here is where I am getting error/having issue when running next command.
kinit(v5): Key table entry not found while getting initial credentials
but if I use it without -k option it working and It takes password

It is a bit perplexing. Stock Solaris 10 is not an environment I am
familiar with, but I can speak some about the related MIT krb5 codebase.

I think the host key tab on Solaris with stock Kerberos is at
/etc/krb5/krb5.keytab
instead of /etc/krb5.keytab as documented in kinit(1) on Solaris 10.


Best regards

-- Dago

[Benjamin Kaduk]

Post by Dagobert Michelsen
Hi Ray,

Post by Benjamin Kaduk

Post by Ray Vand
Then I moved the sapldap.keytab to my SAP Server in tmp directory
# ktutil
ktutil: rkt /tmp/sapldap
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /etc/krb5.keytab
ktutil: q
Here is where I am getting error/having issue when running next command.
kinit(v5): Key table entry not found while getting initial credentials
but if I use it without -k option it working and It takes password

It is a bit perplexing. Stock Solaris 10 is not an environment I am
familiar with, but I can speak some about the related MIT krb5 codebase.

I think the host key tab on Solaris with stock Kerberos is at
/etc/krb5/krb5.keytab
instead of /etc/krb5.keytab as documented in kinit(1) on Solaris 10.

That does ring a bell; we had to work around a related issue in OpenAFS
recently.

Thanks!

-Ben

[Ray Vand]

Thank you for your input.
I have done the following.

modify krb5.conf

default_keytab_name = /etc//krb5/krb5.keytab

Then run ktutil command

# ktutil
ktutil: addent -password -p sapldap/ads.company.com -k 9 -e DES-CBC-MD5
Password for sapldap/***@COMPANY.COM:
ktutil: wkt /tmp/ray.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 9 sapldap/***@COMPANY.COM
ktutil: q
# cp /tmp/ray.keytab /etc//krb5/krb5.keytab

# kinit -t /etc/krb5/krb5.keytab
Password for sapldap/***@COMPANY.COM:
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: sapldap/***@COMPANY.COM

Valid starting Expires Service principal
04/22/13 09:33:39 04/22/13 19:33:39 krbtgt/***@COMPANY.COM
renew until 04/29/13 09:33:39
#


But when I try it with -k option, I am still getting error.


# kinit -k -t /etc/krb5/krb5.keytab
kinit(v5): Client not found in Kerberos database while getting initial credentials
#


Thank you in advance for your input.

Regards,
Ray

Post by Dagobert Michelsen
Hi Ray,

Post by Benjamin Kaduk

Post by Ray Vand
Then I moved the sapldap.keytab to my SAP Server in tmp directory
# ktutil
ktutil: rkt /tmp/sapldap
ktutil: l -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /etc/krb5.keytab
ktutil: q
Here is where I am getting error/having issue when running next command.
kinit(v5): Key table entry not found while getting initial credentials
but if I use it without -k option it working and It takes password

It is a bit perplexing. Stock Solaris 10 is not an environment I am
familiar with, but I can speak some about the related MIT krb5 codebase.

I think the host key tab on Solaris with stock Kerberos is at
/etc/krb5/krb5.keytab
instead of /etc/krb5.keytab as documented in kinit(1) on Solaris 10.

That does ring a bell; we had to work around a related issue in OpenAFS recently.
Thanks!
-Ben

[Benjamin Kaduk]

Post by Ray Vand
But when I try it with -k option, I am still getting error.
# kinit -k -t /etc/krb5/krb5.keytab
kinit(v5): Client not found in Kerberos database while getting initial credentials

The default behavior for 'kinit -k' is to try to get credentials for
host/<hostname> -- you still need to specify the principal name on the
commmand line (as you did originally):
kinit -k -t /etc/krb5/krb5.keytab sapldap/***@COMPANY.COM

-Ben Kaduk

[Greg Hudson]

Post by Ray Vand
# kinit -t /etc/krb5/krb5.keytab
# kinit -k -t /etc/krb5/krb5.keytab
kinit(v5): Client not found in Kerberos database while getting initial credentials

You need to specify the principal name (kinit -k sapldap/ads.company.com).

In the second command, because you're using the -k option, the default
principal name is is host/***@defaultrealm, where
localhostname is the canonicalized local hostname.

In the first command, because you're not using -k, the default principal
name is taken from the existing credential cache if you have one (which
I'm guessing you do), or from your local system if you do not.

[Ray Vand]

I get different error.

# kinit -k -t /etc/krb5/krb5.keytab sapldap/***@COMPANY.COM
kinit: Key table entry not found while getting initial credentials
#

Post by Greg Hudson

Post by Ray Vand
# kinit -t /etc/krb5/krb5.keytab
# kinit -k -t /etc/krb5/krb5.keytab
kinit(v5): Client not found in Kerberos database while getting initial credentials

You need to specify the principal name (kinit -k sapldap/ads.company.com).
In the second command, because you're using the -k option, the default
localhostname is the canonicalized local hostname.
In the first command, because you're not using -k, the default principal
name is taken from the existing credential cache if you have one (which
I'm guessing you do), or from your local system if you do not.

[Will Fiveash]

Post by Ray Vand
Hello,
I am new to Kerberos world and having issue with setting this up and need help and direction.
I am trying to setup SSO in the following environment.
Domain: company.com
Short Domain: AD (This how we login to User Client - AD\<Login Name>
AD domain server --> ads (Windows 2008 R2 )
SAP Server --> SAPSVR (Sun Solaris 10)
User Client --> Mac OS 10.8
I have created user in AD domain server as below
user: sapldap
Password: Changem3 (never expire)
Use DES encryption type for this account
Then I ran the following two command in AD Domain sever
C:\Windows\system32>setspn -A sapldap/ads.company.com AD\sapldap
Registering ServicePrincipalNames for CN=sapldap,CN=Users,DC=company,DC=com
sapldap/ads.company.com
Updated object
Targeting domain controller: ADS.company.com
Using legacy password setting method
Successfully mapped sapldap/ads.company.com to sapldap.
Key created.
Keytab version: 0x502
Account sapldap has been set for DES-only encryption.
Then I moved the sapldap.keytab to my SAP Server in tmp directory
In my SAP Server, I ran the following commands

Are you using Kerberos from MIT or the native Solaris 10 Kerberos?
If the answer is the latter, you need to read the Solaris 10 System
Administration Guide: Security Services
<http://docs.oracle.com/cd/E26505_01/html/E27224/index.html>. There is
a section on configuring Kerberos on Solaris 10. Also the native
Solaris krb expects the default system keytab to be
/etc/krb5/krb5.keytab and to be read/write only by root.
If you are using MIT krb then you need to refer to their documentation
as the paths to various krb related config files and keytab differ from
Solaris.

[Benjamin Kaduk]

Still getting error.
kinit(v5): Key table entry not found while getting initial credentials
#
# klist -k /etc/krb5/krb5.keytab
Keytab name: FILE:/etc/krb5/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------

Why is the kvno now 9? Was it not 7 before? What is causing the number
to increment?

That error would seem to indicate that the key in the keytab does not
match the one in the KDC database...

-Ben Kaduk

[Benjamin Kaduk]

[putting the list back in the cc]

Ben,
kvno was 9 because I gave a new value in addent command.

Ah, okay. As I said earlier, I don't think this kvno will affect 'kinit
-k', but is relevant when used as an acceptor.

I created a new one with kvno 7 and tried it. Still getting initial
credentials error.

Right, I wouldn't expect that to change.

Some ways of generating a keytab will increment the kvno on the KDC, which
will cause problems for existing keytabs; it sounds like that is not what
is causing this problem.

ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /tmp/ray.keytab
ktutil: q
# cp /tmp/ray.keytab /etc/krb5/krb5.keytab
kinit(v5): Key table entry not found while getting initial credentials

I assume the space between '@' and "COMPANY.COM" is introduced while
transcribing into email? If it is present in the actual command line it
may cause problems.

You never did say if you are using the Solaris integrated tools or an
external installation of MIT kerberos.

-Ben

[Ray Vand]

Ben,

The space is added when I cut and paste from terminal. I forgot to fix it in the email.
it prompts for password and it takes it. I even tried wrong password and I got error. Which mean it is communicating with KDC.

Also I am using MIT Kerberos version krb5-1.11.1-signed.tar which I download it from MIT site.

Ray

Post by Benjamin Kaduk
[putting the list back in the cc]

Ben,
kvno was 9 because I gave a new value in addent command.

Ah, okay. As I said earlier, I don't think this kvno will affect 'kinit -k', but is relevant when used as an acceptor.

I created a new one with kvno 7 and tried it. Still getting initial credentials error.

Right, I wouldn't expect that to change.
Some ways of generating a keytab will increment the kvno on the KDC, which will cause problems for existing keytabs; it sounds like that is not what is causing this problem.

ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /tmp/ray.keytab
ktutil: q
# cp /tmp/ray.keytab /etc/krb5/krb5.keytab
kinit(v5): Key table entry not found while getting initial credentials

You never did say if you are using the Solaris integrated tools or an external installation of MIT kerberos.
-Ben

[Nebergall, Christopher]

Do you need to have allow_weak_crypto = true set in your krb5.conf?

-Christopher
-----Original Message-----
From: kerberos-***@mit.edu [mailto:kerberos-***@mit.edu] On Behalf Of Ray Vand
Sent: Monday, April 22, 2013 3:38 PM
To: Benjamin Kaduk
Cc: ***@mit.edu
Subject: [EXTERNAL] Re: Issue with Kerberos setting in Sun Solaris 10

Ben,

The space is added when I cut and paste from terminal. I forgot to fix it in the email.
it prompts for password and it takes it. I even tried wrong password and I got error. Which mean it is communicating with KDC.

Also I am using MIT Kerberos version krb5-1.11.1-signed.tar which I download it from MIT site.

Ray

Post by Benjamin Kaduk
[putting the list back in the cc]

Ben,
kvno was 9 because I gave a new value in addent command.

Ah, okay. As I said earlier, I don't think this kvno will affect 'kinit -k', but is relevant when used as an acceptor.

I created a new one with kvno 7 and tried it. Still getting initial credentials error.

Right, I wouldn't expect that to change.
Some ways of generating a keytab will increment the kvno on the KDC, which will cause problems for existing keytabs; it sounds like that is not what is causing this problem.

ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /tmp/ray.keytab
ktutil: q
# cp /tmp/ray.keytab /etc/krb5/krb5.keytab
kinit(v5): Key table entry not found while getting initial credentials

You never did say if you are using the Solaris integrated tools or an external installation of MIT kerberos.
-Ben

________________________________________________
Kerberos mailing list ***@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

[Ray Vand]

Christopher,

Yes, I have. Please see below.

# cat krb5.conf
libdefaults]
default_realm = COMPANY.COM
default_keytab_name = /etc/krb5/krb5.keytab
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
allow_weak_crypto = true

[realms]
COMPANY.COM = {
kdc = ads.company.com:88
admin_server = ads.company.com
default.domain = COMPANY.COM
kpasswd_server = ads.company.com
}

[domain_realm]
.company.com = COMPANY.COM
company.com = COMPANY.COM
#


# kinit -k sapldap/***@COMPANY.COM
kinit(v5): Key table entry not found while getting initial credentials
#

When I use it without -k option, it works and prompts for password and only takes correct password.
klist shows recent date and expiration time.

Ray

Post by Nebergall, Christopher
Do you need to have allow_weak_crypto = true set in your krb5.conf?
-Christopher
-----Original Message-----
Sent: Monday, April 22, 2013 3:38 PM
To: Benjamin Kaduk
Subject: [EXTERNAL] Re: Issue with Kerberos setting in Sun Solaris 10
Ben,
The space is added when I cut and paste from terminal. I forgot to fix it in the email.
it prompts for password and it takes it. I even tried wrong password and I got error. Which mean it is communicating with KDC.
Also I am using MIT Kerberos version krb5-1.11.1-signed.tar which I download it from MIT site.
Ray

Post by Benjamin Kaduk
[putting the list back in the cc]

Ben,
kvno was 9 because I gave a new value in addent command.

Ah, okay. As I said earlier, I don't think this kvno will affect 'kinit -k', but is relevant when used as an acceptor.

I created a new one with kvno 7 and tried it. Still getting initial credentials error.

Right, I wouldn't expect that to change.
Some ways of generating a keytab will increment the kvno on the KDC, which will cause problems for existing keytabs; it sounds like that is not what is causing this problem.

ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /tmp/ray.keytab
ktutil: q
# cp /tmp/ray.keytab /etc/krb5/krb5.keytab
kinit(v5): Key table entry not found while getting initial credentials

You never did say if you are using the Solaris integrated tools or an external installation of MIT kerberos.
-Ben

________________________________________________
https://mailman.mit.edu/mailman/listinfo/kerberos

[Nebergall, Christopher]

What does this return?

kvno -e des-cbc-md5 sapldap/***@COMPANY.COM

-Christopher
-----Original Message-----
From: Ray Vand [mailto:***@filemaker.com]
Sent: Monday, April 22, 2013 4:46 PM
To: Nebergall, Christopher
Cc: Benjamin Kaduk; ***@mit.edu
Subject: Re: [EXTERNAL] Re: Issue with Kerberos setting in Sun Solaris 10

Christopher,

Yes, I have. Please see below.

# cat krb5.conf
libdefaults]
default_realm = COMPANY.COM
default_keytab_name = /etc/krb5/krb5.keytab
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
allow_weak_crypto = true

[realms]
COMPANY.COM = {
kdc = ads.company.com:88
admin_server = ads.company.com
default.domain = COMPANY.COM
kpasswd_server = ads.company.com
}

[domain_realm]
.company.com = COMPANY.COM
company.com = COMPANY.COM
#


# kinit -k sapldap/***@COMPANY.COM
kinit(v5): Key table entry not found while getting initial credentials
#

When I use it without -k option, it works and prompts for password and only takes correct password.
klist shows recent date and expiration time.

Ray

Post by Nebergall, Christopher
Do you need to have allow_weak_crypto = true set in your krb5.conf?
-Christopher
-----Original Message-----
Sent: Monday, April 22, 2013 3:38 PM
To: Benjamin Kaduk
Subject: [EXTERNAL] Re: Issue with Kerberos setting in Sun Solaris 10
Ben,
The space is added when I cut and paste from terminal. I forgot to fix it in the email.
it prompts for password and it takes it. I even tried wrong password and I got error. Which mean it is communicating with KDC.
Also I am using MIT Kerberos version krb5-1.11.1-signed.tar which I download it from MIT site.
Ray

Post by Benjamin Kaduk
[putting the list back in the cc]

Ben,
kvno was 9 because I gave a new value in addent command.

Ah, okay. As I said earlier, I don't think this kvno will affect 'kinit -k', but is relevant when used as an acceptor.

I created a new one with kvno 7 and tried it. Still getting initial credentials error.

Right, I wouldn't expect that to change.
Some ways of generating a keytab will increment the kvno on the KDC, which will cause problems for existing keytabs; it sounds like that is not what is causing this problem.

ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /tmp/ray.keytab
ktutil: q
# cp /tmp/ray.keytab /etc/krb5/krb5.keytab
kinit(v5): Key table entry not found while getting initial credentials

You never did say if you are using the Solaris integrated tools or an external installation of MIT kerberos.
-Ben

________________________________________________
https://mailman.mit.edu/mailman/listinfo/kerberos

[Ray Vand]

Christopher,

Something is wrong with your command. May be it is incomplete.

Can you please send me the correct syntax?

Ray

Post by Nebergall, Christopher
What does this return?
-Christopher
-----Original Message-----
Sent: Monday, April 22, 2013 4:46 PM
To: Nebergall, Christopher
Subject: Re: [EXTERNAL] Re: Issue with Kerberos setting in Sun Solaris 10
Christopher,
Yes, I have. Please see below.
# cat krb5.conf
libdefaults]
default_realm = COMPANY.COM
default_keytab_name = /etc/krb5/krb5.keytab
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
allow_weak_crypto = true
[realms]
COMPANY.COM = {
kdc = ads.company.com:88
admin_server = ads.company.com
default.domain = COMPANY.COM
kpasswd_server = ads.company.com
}
[domain_realm]
.company.com = COMPANY.COM
company.com = COMPANY.COM
#
kinit(v5): Key table entry not found while getting initial credentials
#
When I use it without -k option, it works and prompts for password and only takes correct password.
klist shows recent date and expiration time.
Ray

Post by Nebergall, Christopher
Do you need to have allow_weak_crypto = true set in your krb5.conf?
-Christopher
-----Original Message-----
Sent: Monday, April 22, 2013 3:38 PM
To: Benjamin Kaduk
Subject: [EXTERNAL] Re: Issue with Kerberos setting in Sun Solaris 10
Ben,
The space is added when I cut and paste from terminal. I forgot to fix it in the email.
it prompts for password and it takes it. I even tried wrong password and I got error. Which mean it is communicating with KDC.
Also I am using MIT Kerberos version krb5-1.11.1-signed.tar which I download it from MIT site.
Ray

Post by Benjamin Kaduk
[putting the list back in the cc]

Ben,
kvno was 9 because I gave a new value in addent command.

Ah, okay. As I said earlier, I don't think this kvno will affect 'kinit -k', but is relevant when used as an acceptor.

I created a new one with kvno 7 and tried it. Still getting initial credentials error.

Right, I wouldn't expect that to change.
Some ways of generating a keytab will increment the kvno on the KDC, which will cause problems for existing keytabs; it sounds like that is not what is causing this problem.

ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
ktutil: wkt /tmp/ray.keytab
ktutil: q
# cp /tmp/ray.keytab /etc/krb5/krb5.keytab
kinit(v5): Key table entry not found while getting initial credentials

You never did say if you are using the Solaris integrated tools or an external installation of MIT kerberos.
-Ben

________________________________________________
https://mailman.mit.edu/mailman/listinfo/kerberos

[Will Fiveash]

Post by Ray Vand
kinit(v5): Key table entry not found while getting initial credentials

What does "type kinit" output? If you are using /usr/bin/kinit then you
are running native Solaris krb. If you want to use MIT krb you need to
make sure you have the directory where the MIT krb utilities are
installed ahead of /usr/bin and /usr/sbin in your PATH.

If you want to know what files kinit is opening run:

/usr/bin/truss -t open kinit -k sapldap/***@COMPANY.COM

That will show you what krb5.conf and what krb5.keytab kinit is trying
to open. See the truss man page for more details on truss.

[Benjamin Kaduk]

Post by Ray Vand

Post by Nebergall, Christopher
What does this return?

Something is wrong with your command. May be it is incomplete.
Can you please send me the correct syntax?

The syntax looks fine to me; you will need to show the error message you
are getting.
See also the reply from Will Fiveash for other concerns.

-Ben

[Ray Vand]

#
# kvno -e des-cbc-md5 sapldap/***@COMPANY.COM
kvno: No credentials found with supported encryption types while getting credentials for sapldap/***@COMPANY.COM
#

Ray

Post by Ray Vand

Post by Nebergall, Christopher
What does this return?

Something is wrong with your command. May be it is incomplete.
Can you please send me the correct syntax?

The syntax looks fine to me; you will need to show the error message you are getting.
See also the reply from Will Fiveash for other concerns.
-Ben