Hi, I have done the modifications as suggested, but no luck, getting the same error. # kinit admin # ipa-addservice host/<a href="http://bmdata01.testing.com">bmdata01.testing.com</a> # ipa-getkeytab -s <a href="http://viji.testing.com">viji.testing.com</a> -p host/<a href="http://bmdata01.testing.com">bmdata01.testing.com</a> -k /etc/krb5.keytab Could you please elaborate the steps which you have done to get it working on both the client and server side? Thanks Viji <div class="gmail_quote">On Tue, Dec 30, 2008 at 11:46 PM, Kozlov <<a href="mailto:mackoel@gmail.com">mackoel@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi, The minor comment is that kadmin is supposed to be substituted with ipa-addservice. The major comment is that you've missed ipa-getkeytab on ipaserver that actually SETS password that you then install on winxp. And try to map all users to one: for example, "* Administrator". Best regards, Kostya Viji V Nair пишет: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"> Hi, Thank you for the information, I have tried all these steps, but no success 1. On the IPA Server I have created a host principal using the following command. </div> # kadmin -q "ank host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>>"<div class="Ih2E3d"> 2. On the windows xp client </div> C:> ksetup /setrealm <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> C:> ksetup /addkdc <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <a href="http://viji.bigmaps.com" target="_blank">viji.bigmaps.com</a> <<a href="http://viji.bigmaps.com" target="_blank">http://viji.bigmaps.com</a>> C:> ksetup /setmachpassword <password> C:> ksetup /mapuser <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> guest C:> ksetup /mapuser * * After the above setup windows is showing <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> as a Kerberos Realm on the login screen, but when I try to login using the user name "admin" it is throwing the following error.<div class="Ih2E3d"> "The system could not log you on. Make sure your user name and domain are correct, and then type your password again. Letters in passwords must be typed using the correct case." But the IPA (kerberos) server is issuing the tickets, the log shows: </div> Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): AS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: NEEDED_PREAUTH: <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> for krbtgt/<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>, Additional pre-authentication required Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): AS_REQ (3 etypes {23 3 1}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> for krbtgt/<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): TGS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> for host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>><div class="Ih2E3d"> I have found some article on Microsoft website, saying this is a bug and apply the latest service pack (SP3), I even tried that, but no success. <a href="http://support.microsoft.com/kb/825081" target="_blank">http://support.microsoft.com/kb/825081</a> Similar Thread: <a href="http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html" target="_blank">http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html</a> Thanks & Regards Viji </div><div><div></div><div class="Wj3C7c"> On Mon, Dec 29, 2008 at 6:35 PM, Konstantin Kozlov <<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>>> wrote: Hi, You can search the list for a similar thread and here are the steps I've followed with success: Add host principal for winxp machine with the encoding des-cbc-crc and passowrd (-P ioption for ipa-getkeytab). Do not store this keytab in /etc/krb5.keytab but rather in some other file. Install MS Support Tools on WinXP, and run ksetup /setdomain ... ksetup /addkdc ... ksetup /setcomputerpassword ... ksetup /mapuser * <your user> WinXP machine asks to login to Kerberos realm at login screen. I failed to map one ipa-user to one win-user. But may be because I didn't have enough time. If you will succeed - leave a note here please. Best regards, Kostya Viji V Nair wrote: Hi, I am a new user of free-ipa, I have installed the free-ipa packages shipped with fedora 10. I have more that 100 windows clients to authenticate. Here is my problem, All the clients are XP SP2, I have installed MIT Kerberos for Windows 3.2.2. Always the native windows login prompt appears first, when i login to windows the kerberos client is asking for authentication. I want to replace this windows authentication with kerberos Any help on the same will be greatly appreciated. Thanks Viji ------------------------------------------------------------------------ _______________________________________________ Freeipa-users mailing list </div></div> <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>><div class="Ih2E3d"> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> -- Konstantin Kozlov Department of Computational Biology, Center for Advanced Studies, SPb State Polytechnical University, 195251, Polytechnicheskaya ul., 29, bld 4, office 204, St.Petersburg, Russia. Tel./fax: +7 812 596 2831 _______________________________________________ Freeipa-users mailing list </div> <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>><div class="Ih2E3d"> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </div></blockquote> </blockquote></div>