https://lukehebert.com/tag/active-directory/Recent content in Active-Directory on Luke HebertHugoen-usFri, 18 Feb 2022 00:00:00 +0000https://lukehebert.com/post/kerberos-message-stream-modified-41/Fri, 18 Feb 2022 00:00:00 +0000https://lukehebert.com/post/kerberos-message-stream-modified-41/JDK 1.8.0u242 and later introduced Kerberos referral handling per RFC 6806, which can break Active Directory name canonicalization and produce a KRB_AP_ERR_MODIFIED error. This post walks through the two configuration fixes that resolve the issue.https://lukehebert.com/post/golden-ticket-attack/Mon, 15 Nov 2021 00:00:00 +0000https://lukehebert.com/post/golden-ticket-attack/A Golden Ticket attack lets an attacker forge Kerberos tickets and impersonate any user in an Active Directory domain. Learn how the attack works and the concrete steps you can take to defend against it.https://lukehebert.com/post/resetting-ad-krbtgt-password/Fri, 05 Nov 2021 00:00:00 +0000https://lukehebert.com/post/resetting-ad-krbtgt-password/A practical guide to resetting the krbtgt account password in Active Directory, including considerations for external trusts and the Microsoft-provided reset script.https://lukehebert.com/post/kerberos-issue-tracker/Fri, 24 Sep 2021 00:00:00 +0000https://lukehebert.com/post/kerberos-issue-tracker/A quick reference for the MIT Kerberos project issue tracker, where bugs, security advisories, and feature requests for the reference Kerberos implementation are tracked and resolved.https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Wed, 10 Feb 2021 00:00:00 +0000https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Learn how to enable Kerberos trace logging in Cloudera Manager’s credential generation scripts to diagnose authentication failures quickly.https://lukehebert.com/post/explain-kerberos-like-im-5/Thu, 10 Dec 2020 00:00:00 +0000https://lukehebert.com/post/explain-kerberos-like-im-5/A plain-English walkthrough of how Kerberos authentication works, using a simple analogy to make the ticket-granting process click. Perfect for anyone who has stared at a KDC diagram and felt lost.https://lukehebert.com/post/ldaps-and-unicodepwd/Tue, 01 Dec 2020 00:00:00 +0000https://lukehebert.com/post/ldaps-and-unicodepwd/LDAPS is a hard requirement when setting passwords via unicodePwd on Active Directory. Non-TLS connections are rejected by AD itself, and SASL is not a supported alternative.https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/Tue, 24 Nov 2020 00:00:00 +0000https://lukehebert.com/post/common-error-codes-for-active-directory-authentication-acceptsecuritycontext/A quick reference for the LDAP error codes returned during Active Directory bind operations, including what each code means and how to interpret the AcceptSecurityContext error message.https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/Tue, 03 Nov 2020 00:00:00 +0000https://lukehebert.com/post/cannot-find-key-of-the-appropriate-type-to-decrypt-ap-rep/A troubleshooting guide for the Kerberos error ‘Cannot find key of the appropriate type to decrypt AP REP,’ covering encryption type mismatches between keytabs and Active Directory, plus practical steps to align AES and RC4 settings.https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/Tue, 17 Oct 2017 00:00:00 +0000https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/A quick reference for LDAP result and error codes, covering both server-side responses and client-side indicators, including Active Directory-specific sub-codes under error 49.https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/Thu, 07 Sep 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/A quick reference for Kerberos enctype numbers and what they map to, so you can stop guessing which cipher a ticket is actually using.https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Mon, 21 Aug 2017 00:00:00 +0000https://lukehebert.com/post/specified-version-of-key-is-not-available-44/Kerberos error 44 occurs when the keytab KVNO does not match the KDC database. This guide walks through diagnosing the mismatch and regenerating the keytab to restore authentication.https://lukehebert.com/post/server-is-unwilling-to-perform-53/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-is-unwilling-to-perform-53/LDAP error 53 means the destination server is refusing a password change request. This post walks through the most common Active Directory requirements and policy settings that trigger the error.https://lukehebert.com/post/server-not-found-kerberos/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-not-found-kerberos/A quick troubleshooting guide for the ‘Server not found in Kerberos database’ error, covering the four most common root causes and how to verify each one.https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/Tue, 18 Jul 2017 00:00:00 +0000https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/A practical troubleshooting guide for the Kerberos AP REP decryption error, covering the most common causes from keytab mismatches to encryption type misconfigurations.https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/active-directory-error-types-ad_mit-client-credentials-revoked/A quick reference for diagnosing Kerberos authentication failures in Active Directory, covering the lockout state machine and the specific error codes (5be, 775, 18) that indicate revoked credentials or a locked account.https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/jdk-break-downs-for-web-ui-and-spengo-u92_u91_u40_u45/Specific JDK 1.8.0 builds (u40, u45, u91, u92) are known to break SPNEGO authentication and Hadoop web interfaces. This post documents the affected versions, the symptoms, and the recommended downgrade path.https://lukehebert.com/post/kerberos-cross-realm-trust/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cross-realm-trust/Kerberos cross-realm authentication relies entirely on TGS exchanges between KDCs. Understanding the three-step ticket flow makes it easier to troubleshoot trust relationships between domains.https://lukehebert.com/post/kerberos-shortname-mapping-auth-to-local/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-shortname-mapping-auth-to-local/A practical walkthrough of how Hadoop maps Kerberos principals to short names via the auth_to_local property, including rule syntax, acceptance filters, and common troubleshooting patterns.https://lukehebert.com/post/multiple-http-principles/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/multiple-http-principles/How to verify and manage HTTP service principal names in Active Directory using ldapsearch and setspn, including a note about Centrify’s uppercase requirement.https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-krb-ap-err-not-us-or-bad-tgs-server-name/A practical look at why the MIT krb5 KDC rejects a TGS-REQ with KRB_AP_ERR_NOT_US, including the exact validation logic and the most common root causes behind the error.