https://lukehebert.com/tag/sso/Recent content in Sso on Luke HebertHugoen-usTue, 29 Mar 2022 00:00:00 +0000https://lukehebert.com/post/id4262-the-saml-nameidentifier-user-is-of-format-urnoasisname/Tue, 29 Mar 2022 00:00:00 +0000https://lukehebert.com/post/id4262-the-saml-nameidentifier-user-is-of-format-urnoasisname/The ID4262 error occurs when a SAML NameIdentifier uses the entity format but contains an invalid URI. Two resolution steps fix the issue within your identity provider configuration.https://lukehebert.com/post/kerberos-issue-tracker/Fri, 24 Sep 2021 00:00:00 +0000https://lukehebert.com/post/kerberos-issue-tracker/A quick reference for the MIT Kerberos project issue tracker, where bugs, security advisories, and feature requests for the reference Kerberos implementation are tracked and resolved.https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Wed, 10 Feb 2021 00:00:00 +0000https://lukehebert.com/post/debug-kerberos-gen-credentials-in-cm/Learn how to enable Kerberos trace logging in Cloudera Manager’s credential generation scripts to diagnose authentication failures quickly.https://lukehebert.com/post/explain-kerberos-like-im-5/Thu, 10 Dec 2020 00:00:00 +0000https://lukehebert.com/post/explain-kerberos-like-im-5/A plain-English walkthrough of how Kerberos authentication works, using a simple analogy to make the ticket-granting process click. Perfect for anyone who has stared at a KDC diagram and felt lost.https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/Tue, 17 Oct 2017 00:00:00 +0000https://lukehebert.com/post/ldap-server-side-and-client-side-result-error-codes/A quick reference for LDAP result and error codes, covering both server-side responses and client-side indicators, including Active Directory-specific sub-codes under error 49.https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/Thu, 07 Sep 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-encryption-type-by-number-enctype/A quick reference for Kerberos enctype numbers and what they map to, so you can stop guessing which cipher a ticket is actually using.https://lukehebert.com/post/server-is-unwilling-to-perform-53/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-is-unwilling-to-perform-53/LDAP error 53 means the destination server is refusing a password change request. This post walks through the most common Active Directory requirements and policy settings that trigger the error.https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/Tue, 18 Jul 2017 00:00:00 +0000https://lukehebert.com/post/400-cannot-find-key-of-appropriate-type-to-decrypt-ap-rep/A practical troubleshooting guide for the Kerberos AP REP decryption error, covering the most common causes from keytab mismatches to encryption type misconfigurations.https://lukehebert.com/post/kerberos-cross-realm-trust/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/kerberos-cross-realm-trust/Kerberos cross-realm authentication relies entirely on TGS exchanges between KDCs. Understanding the three-step ticket flow makes it easier to troubleshoot trust relationships between domains.https://lukehebert.com/post/multiple-http-principles/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/multiple-http-principles/How to verify and manage HTTP service principal names in Active Directory using ldapsearch and setspn, including a note about Centrify’s uppercase requirement.