spnego

[Tuomas]

Michael B Allen wrote:
> On Thu, Sep 11, 2008 at 12:30 PM, Tuomas
> <tuomaksen.spammiposti at gmail.com> wrote:
>> I also found out using wireshark what Internet Explorer does when it
>> fails to authenticate using Kerberos. It asks a ticket from the Active
>> Directory server for HTTP/virtualhost.domain.com instead of
>> HTTP/realname.domain.com. For me this seems like a bug in IE7, has
>> anyone found solutions for this?
> 
> That's not a bug. You will need to add SPNs to the desired account
> (using setspn) for each virtual hostname.

I see, just can't understand why this is happening occasionally. At 
least it makes things harder.

Anyway, I set up "setspn -a HTTP/virtualhost.domain.com", things still 
didn't work as they should. Now i apache's error.log I get:
gss_accept_sec_context() failed: Unspecified GSS failure.  Minor code 
may provide more information (Key table entry not found)

I understand that I should have also virtualhost.domain.com defined in 
my keytab, just don't have any idea how to do that.

Thanks for all the help!
-Tuomas