I am configuring an apache/SSO authentication with an AD with Kerberos.
My http server is a Debian Wheezy and the AD is a Windows Server 2012.

I generated keytabs files on WS2012 with `kpass` command for each encryption type available on WS2012.

When I try to open a session with a user `test@DOMAIN.COM` with `kinit`, it works.

When I try to open a session with my `HTTP/web.domain.com@DOMAIN.COM`, I get the message:

```
kvno HTTP/web.domain.com@DOMAIN.COM
kvno: KDC has no support for encryption type while getting credentials for HTTP/web.domain.com@DOMAIN.COM

```

Also, when I check encryption used for `test@DOMAIN.COM`, I have:

```
root@SERVER:~# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: test@DOMAIN.COM

Valid starting       Expires              Service principal
03/04/2015 12:48:21  03/04/2015 22:48:17  krbtgt/DOMAIN.COM@DOMAIN.COM
        renew until 04/04/2015 12:48:21, Etype (skey, tkt): arcfour-hmac, arcfour-hmac

```

I tried to customize my `/etc/krb5.conf` with:

```
  default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
  default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5

```

And by using the keytab file encrypted with `arcfour-hmac` without success.

I don't understand how to change encryption type used to communicate, why it always wants arcfour-hmac and why when I give it arcfour-hmac encryption, nothing change...

How to be sure that /etc/krb5.conf changes are effective and how to make the Kerberos ticket generation work too?