多域Kerberos配置1路信任

Question

我已經配置了多域的Kerberos SSO爲Documentum的客戶端與域之間的1間的信任......但是，當登錄到客戶端，我得到下面的錯誤...

[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: resetting state... 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: principal = 'HTTP/mdk1waytrustd3.wtmdk1waydom3.com' 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: realm = 'WTMDK1WAYDOM3.COM' 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: Found name servers using JNDI 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: mdk1waytrustd2.wtmdk1waydom2.com (10.31.70.183) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: mdk1waytrustd1.wtmdk1waydom1.com (10.31.69.52) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: MDK1WAYTRUSTD3.WTMDK1WAYDOM3.COM (10.31.70.184) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: mdk1waytrustd4.wtmdk1waydom4.com (10.31.71.34) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: corpinba8.corp.emc.com (10.30.48.37) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: corpgefr3.corp.emc.com (152.62.196.10) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: The old JCSI Kerberos code for the Windows LSA is now disabled by default; 
if you really want it (rather than the new WinSSPI code) you must set 
     -Djcsi.kerberos.lsa.enable=true 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: Creating LSA credential cache 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: Could not locate default cache: com.dstc.security.kerberos.KerberosException: Could not create credential store com.dstc.security.kerberos.KerberosException: Native in-memory credential cache not supported on this platform (Windows Server 2008 R2) 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: login succeeded 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: loaded InputStream based keytab at time 1351158964992 m/secs, 5 entries 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: binding principal to subject 
[DEBUG] Thu Oct 25 02:56:04 PDT 2012 jcsi.kerberos: binding credentials to subject

有人可以幫助我克服這個問題？

Answer 1

由於'krb5login.conf'使用dstc登錄模塊而不是舊的sun.security.auth模塊導致的根。嘗試修改您的krb5login.conf如下，你會很高興。 :)

HTTP-mdk1waytrustd3-wtmdk1waydom3-com  
{ 
com.dstc.security.kerberos.jaas.KerberosLoginModule required 
principal="HTTP/mdk1waytrustd3.wtmdk1waydom3.com" 
noTGT=true 
debug=true 
refreshKrb5Config=true 
useKeyTab=true 
storeKey=true 
doNotPrompt=true 
useTicketCache=false 
isInitiator=false 
realm="WTMDK1WAYDOM3.COM" 
keyTab="C:\\keytab location\\keytab.keytab"; 
};