Adding Kerberos keytabs

Prerequisites

  • Check that forward and reverse DNS are working.
  • Check that all clocks are in sync. More than a five-minute clock drift will cause authentication to fail.

Procedure

  1. On the SERVICES menu, under the Authentication submenu, click Kerberos keytabs.
  2. Click Add new keytab and in the Add new keytab dialog, enter a meaningful Name for the keytab.
  3. Click Choose File, select the keytab file.
  4. Enter a descriptive Comment and click Add.
  5. Repeat the previous steps for any other keytabs you need to import.

Follow-up tasks

  • To edit a keytab:
    1. Under the Kerberos keytabs section, place your mouse cursor over the keytab and click Edit.
    2. Make any changes.
      • To turn off the keytab, clear the Enabled option.
    3. Click Save.
  • To delete a keytab:
    1. Under the Kerberos keytabs section, place your mouse cursor over the keytab and click Delete.
    2. When prompted, click Delete. The Smoothwall deletes the keytab.

Troubleshooting a Kerberos service

Make sure of the following when troubleshooting a service that uses Kerberos:

  • Make sure that all the prerequisites have been met.
  • Try another browser for fault-finding.
  • In a Safari browser, try the fully qualified domain name (FQDN) if the short form doesn't work.
  • See if the user logged on before the keytab was created. Try logging off then on again.
  • See if the user logged on before the Smoothwall connected to the domain. Try logging off then on again.
  • Make sure that you're logged on with a domain account.
  • When exporting your own keytabs:
    • Make sure that the keytab contains keys with the same type of cryptography as that used by the client.
    • The “HTTP” in the service principal name (SPN) must be in uppercase.
    • The keytab should contain SPNs containing the short and fully qualified forms of each hostname.