title: Apache Kerberos Authentication - Client didn't delegate us their credential
body: <p>I'm trying to use mod_auth_kerb to log in users into my website automatically against an AD server running on W2008 Server. Users are already logged in a windows network, and access to the website. </p>
  
  <p>My virtual server conf is:</p>
  
  <pre><code>&lt;Location /&gt;
          Order allow,deny
          Satisfy Any
          AuthType Kerberos
          AuthName "Kerberos Login ORN"
          KrbMethodNegotiate On
          KrbMethodK5Passwd Off
          KrbServiceName Any
          KrbAuthRealms EXAMPLE.ES
          Krb5KeyTab /etc/krb5.keytab
          require valid-user
  &lt;/Location&gt;
  </code></pre>
  
  <p>I succesfully login via kinit from apache:</p>
  
  <pre><code>kinit -t /etc/HTTP-hesl035.keytab
  Password for HTTP-hesl035@EXAMPLE.ES:
  
  klist
  Ticket cache: FILE:/tmp/krb5cc_0
  Default principal: HTTP-hesl035@EXAMPLE.ES
  
  Valid starting     Expires            Service principal
  11/07/13 17:55:46  11/08/13 03:55:51  krbtgt/EXAMPLE.ES@EXAMPLE.ES
          renew until 11/08/13 03:55:46
  </code></pre>
  
  <p>or</p>
  
  <pre><code>kinit HTTP-hesl035
  Password for HTTP-hesl035@EXAMPLE.ES:
  
  klist
  Ticket cache: FILE:/tmp/krb5cc_0
  Default principal: HTTP-hesl035@EXAMPLE.ES
  
  Valid starting     Expires            Service principal
  11/07/13 17:57:26  11/08/13 03:57:26  krbtgt/EXAMPLE.ES@EXAMPLE.ES
          renew until 11/08/13 03:57:26
  </code></pre>
  
  <p>I configure firefox with the settings:</p>
  
  <pre><code>network.negotiate-auth.delegation.uris = testing.example.es
  network.negotiate-auth.trusted.uris = testing.example.es
  </code></pre>
  
  <p>When I access to the site I get an Authoritation Required.</p>
  
  <p>1st Header sent by browser is:</p>
  
  <pre><code>GET Host: testing.example.es
  </code></pre>
  
  <p>1st Header response by server is:</p>
  
  <pre><code>401 Authorization required
  WWW-authenticate: Negotiate
  </code></pre>
  
  <p>2nd header sent by browser is:</p>
  
  <pre><code>GET Host: testing.example.es
  Authentication: Negotiate {TOKEN}
  </code></pre>
  
  <p>2nd header sent by server is:</p>
  
  <pre><code>401 Athorization required
  </code></pre>
  
  <p>Apache log saying the following:</p>
  
  <pre><code>Thu Nov 07 18:06:09 2013] [debug] src/mod_auth_kerb.c(1939): [client 192.168.4.16] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
  [Thu Nov 07 18:06:09 2013] [debug] src/mod_auth_kerb.c(1939): [client 192.168.4.16] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
  [Thu Nov 07 18:06:09 2013] [debug] src/mod_auth_kerb.c(1691): [client 192.168.4.16] Verifying client data using KRB5 GSS-API
  [Thu Nov 07 18:06:09 2013] [debug] src/mod_auth_kerb.c(1707): [client 192.168.4.16] Client didn't delegate us their credential
  [Thu Nov 07 18:06:09 2013] [debug] src/mod_auth_kerb.c(1735): [client 192.168.4.16] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.
  [Thu Nov 07 18:06:09 2013] [debug] src/mod_auth_kerb.c(1138): [client 192.168.4.16] GSS-API major_status:00010000, minor_status:00000000
  [Thu Nov 07 18:06:09 2013] [error] [client 192.168.4.16] gss_accept_sec_context() failed: An unsupported mechanism was requested (, Unknown error)
  </code></pre>
  
  <p>Using krbtray.exe on the users windows machine i see the following tickets:</p>
  
  <pre><code>EXAMPLE.ES
  - host/minit-bn-example.es
  - krbtgt/EXAMPLE.ES
  </code></pre>
  
  <p>I get the krbtgt/EXAMPLE.ES when I visit the apache app.</p>
  
  <p>Seems that the client is sending the kerberos ticket, but not sure of it. Anyone knows about this issue??</p>
  
  <p>EDIT:</p>
  
  <p>If I set KrbMethodK5Passwd to On in my apache conf, I get a popup with user/pass form when accessing the web app. But I cannot login with user credentials. </p>
  
  <p>Apache log says:</p>
  
  <pre><code>[Thu Nov 07 17:41:34 2013] [debug] src/mod_auth_kerb.c(1939): [client 192.168.4.16] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
  [Thu Nov 07 17:41:34 2013] [error] [client 192.168.4.16] Error parsing server name (Any): Hostname cannot be canonicalized
  [Thu Nov 07 17:41:34 2013] [debug] src/mod_auth_kerb.c(1110): [client 192.168.4.16] kerb_authenticate_user_krb5pwd ret=401 user=(NULL) authtype=(NULL)
  </code></pre>
  
  <p>If I use wireshark in windows client to fetch packets, I get 2 kerberos errors from the AD to the windows client:</p>
  
  <pre><code>KRB Error: KRB5KRB_ERR_RESPONSE_TOO_BIG
  KRB Error: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN
  </code></pre>