[Condor-users] KERBEROS AUTH erro

[Arnau Bria <arnau@xxxxxxxxxxxxx>]

Hi,

I've used kerberos auth in condor for a long and worked fine.
But after some kerberos packages update, it has stopped working.

Now I get the error: AUTH_ERROR: KDC policy rejects request

[...]
9/12 09:49:28 SECMAN: Auth methods: KERBEROS
9/12 09:49:28 AUTHENTICATE: in authenticate( addr == '<193.146.196.45:9618>', methods == 'KERBEROS')
9/12 09:49:28 AUTHENTICATE: can still try these methods: KERBEROS
9/12 09:49:28 HANDSHAKE: in handshake(my_methods = 'KERBEROS')
9/12 09:49:28 HANDSHAKE: handshake() - i am the client
9/12 09:49:28 HANDSHAKE: sending (methods == 64) to server
9/12 09:49:28 HANDSHAKE: server replied (method = 64)
9/12 09:49:28 AUTHENTICATE: will try to use 64 (KERBEROS)
9/12 09:49:28 KERBEROS: krb5_unparse_name: condor/cdf/bcncaf@xxxxxxxx
9/12 09:49:28 KERBEROS: param server princ: condor/cdf/bcncaf@xxxxxxxx
9/12 09:49:28 KERBEROS: no user yet determined, will grab up to slash
9/12 09:49:28 KERBEROS: picked user: condor
9/12 09:49:28 KERBEROS: mapping realm FNAL.GOV to domain fnal.gov.
9/12 09:49:28 Client is condor@xxxxxxxx
9/12 09:49:28 KERBEROS: Server principal is condor/cdf/bcncaf@xxxxxxxx
9/12 09:49:28 init_daemon: client principal is 'condor/cdf/bcncaf@xxxxxxxx'
9/12 09:49:28 init_daemon: Using default keytab FILE:/etc/krb5.keytab
9/12 09:49:28 init_daemon: Trying to get tgt credential for service condor/cdf/bcncaf@xxxxxxxx
9/12 09:49:28 AUTH_ERROR: KDC policy rejects request
9/12 09:49:28 AUTHENTICATE: method 64 (KERBEROS) failed.
9/12 09:49:28 AUTHENTICATE: can still try these methods: 
9/12 09:49:28 HANDSHAKE: in handshake(my_methods = '')
9/12 09:49:28 HANDSHAKE: handshake() - i am the client
9/12 09:49:28 HANDSHAKE: sending (methods == 0) to server
9/12 09:49:28 HANDSHAKE: server replied (method = 0)
9/12 09:49:28 AUTHENTICATE: no available authentication methods succeeded, failing!
[...]

Which means that I'm asking for a principal forwardable or proxyable
when it is not supposed to be. But looking for the principal I get:

$ klist -f
Ticket cache: /tmp/krb5cc_10155
Default principal: condor/cdf/bcncaf@xxxxxxxx

09/12/07 09:49:01  09/13/07 11:48:54  condor/cdf/bcncaf@xxxxxxxx
        Flags: A

it hasn't any of the "problematic" flags (in fact some of the scripts
requests the principal like: 
kinit -F -k -t /etc/krb5.keytab condor/cdf/bcncaf@xxxxxxxx

but I don't really know what condor does for getting the principal.
Could someone explain me so?
Anyone had similar experience?

$ condor -v
$CondorVersion: 6.8.3 Jan  4 2007 $
$CondorPlatform: I386-LINUX_RHEL3 $

TIA,
Arnau