kerberos - Krb异常 : Do not have keys of types listed in default_tkt_enctypes available

Question

每次运行命令时我都会得到这个 execption:

kinit -k -t C:\Users\XXXX\user.keytab MYUSER

这是执行

C:\Users\XXXX>kinit -k -t C:\Users\XXXX\user.keytab MYUSER
    Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes available; only have keys of following type:  No error
    KrbException: Do not have keys of types listed in default_tkt_enctypes available; only have keys of following type:
            at sun.security.krb5.internal.crypto.EType.getDefaults(EType.java:280)
            at sun.security.krb5.KrbAsReqBuilder.build(KrbAsReqBuilder.java:261)
            at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:315)
            at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
            at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)
            at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)

我的krb5.ini好像没问题!

[libdefaults]
    default_realm = XXXX.COM
    ticket_lifetime = 24h
    dns_lookup_realm = false
    dns_lookup_kdc = false
    #default_tkt_enctypes = aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    #default_tgs_enctypes = aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
    default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
    renew_lifetime = 7d
    forwardable = true
    ticket_lifetime = 24h

[realms]
XXXX.COM = {
    admin_server = XXXX.com
    kdc = XXXX.com
  }

[domain_realm]
    xxxx.com= XXXX.COM

问题是什么？

Answer 1

这是在提示您在创建 key 表时使用了不兼容的算法。创建 key 表时。我通常使用 RC4-HMAC:

kutil
addent -password -p username@MYDOMAIN.COM -k 1 -e RC4-HMAC
wkt username.keytab
quit

现在它工作正常。