title: Issues getting kerberos/Windows AD login work for a web service
body: <p>I have been struggling with this for quite a while now, and I can't get it to work.</p>
  <p>Here is the setup:
  I have a nginx webserver serving a django app at <code>mywebapp.k8s.dal1.mycompany.io</code></p>
  <p>It has the SPNEGO plugin compiled in and I have the following endpoint in my config:</p>
  <pre><code>location /ad-login {
      uwsgi_pass django;
      include /usr/lib/mycompany/lib/wsgi/uwsgi_params;
      auth_gss on;
      auth_gss_realm BURNERDEV1.DAL1.MYCOMPANY.IO;
      auth_gss_service_name HTTP/mywebapp.k8s.dal1.mycompany.io;
      auth_gss_allow_basic_fallback off;
  }
  </code></pre>
  <p>My AD Domain controller is at burnerdev1.dal1.mycompany.io and I have the following users configured:</p>
  <pre><code>rep_movsd
  portal
  </code></pre>
  <p>I run the following commands on the DC server in an Admin prompt:</p>
  <pre><code>ktpass -out krb5.keytab -mapUser portal@BURNERDEV1.DAL1.MYCOMPANY.IO +rndPass -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO
  setspn -A HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO portal
  
  
  C:\Users\myself\Documents\keytab&gt;ktpass -out krb5.keytab -mapUser portal@BURNERDEV1.DAL1.MYCOMPANY.IO +rndPass -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO
  
  Targeting domain controller: dal1devdc1.burnerdev1.dal1.mycompany.io
  Using legacy password setting method
  Failed to set property 'servicePrincipalName' to 'HTTP/mywebapp.k8s.dal1.mycompany.io' on Dn 'CN=portal,CN=Users,DC=burnerdev1,DC=dal1,
  DC=mycompany,DC=io': 0x13.
  WARNING: Unable to set SPN mapping data.
  If portal already has an SPN mapping installed for HTTP/mywebapp.k8s.dal1.mycompany.io, this is no cause for concern.
  Building salt with principalname HTTP/mywebapp.k8s.dal1.mycompany.io and domain BURNERDEV1.DAL1.MYCOMPANY.IO (encryption type 18)...
  Hashing password with salt &quot;BURNERDEV1.DAL1.MYCOMPANY.IOHTTPmywebapp.k8s.dal1.mycompany.io&quot;.
  Key created.
  Output keytab to krb5.keytab:
  Keytab version: 0x502
  keysize 110 HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x12 (AES256-SHA1) k
  eylength 32 (0x632d9ca3356374e9de490ec2f7718f9fb652b20da40bd212a808db4c46a72bc5)
  
  C:\Users\myself\Documents\keytab&gt;setspn -A HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO portal
  Checking domain DC=burnerdev1,DC=dal1,DC=mycompany,DC=io
  
  Registering ServicePrincipalNames for CN=portal,CN=Users,DC=burnerdev1,DC=dal1,DC=mycompany,DC=io
          HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO
  Updated object
  
  C:\Users\myself\Documents\keytab&gt;
  </code></pre>
  <p>Now in the &quot;Active Directory Users and Computers&quot; section, I rightclicked the user and selected &quot;Properties&quot;
  Then on the &quot;Delegation&quot; tab I set &quot;Trust this user for delegation to any service (Kerberos only)&quot;</p>
  <p>Next I copy the krb5.keytab file to my webserver and restart the nginx container</p>
  <p>On the Windows workstation which is part of the domain, I log on as rep_movsd - when I run klist:</p>
  <pre><code>C:\Users\rep_movsd&gt;klist
  
  Current LogonId is 0:0x208d7
  
  Cached Tickets: (2)
  
  #0&gt;     Client: rep_movsd @ BURNERDEV1.DAL1.MYCOMPANY.IO
          Server: krbtgt/BURNERDEV1.DAL1.MYCOMPANY.IO @ BURNERDEV1.DAL1.MYCOMPANY.IO
          KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
          Ticket Flags 0x40e10000 -&gt; forwardable renewable initial pre_authent name_canonicalize
          Start Time: 7/16/2020 2:05:51 (local)
          End Time:   7/16/2020 12:05:51 (local)
          Renew Time: 7/23/2020 2:05:51 (local)
          Session Key Type: AES-256-CTS-HMAC-SHA1-96
  
  
  #1&gt;     Client: rep_movsd @ BURNERDEV1.DAL1.MYCOMPANY.IO
          Server: HTTP/mywebapp.k8s.dal1.mycompany.io @ BURNERDEV1.DAL1.MYCOMPANY.IO
          KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
          Ticket Flags 0x40a10000 -&gt; forwardable renewable pre_authent name_canonicalize
          Start Time: 7/16/2020 2:06:01 (local)
          End Time:   7/16/2020 12:05:51 (local)
          Renew Time: 7/23/2020 2:05:51 (local)
          Session Key Type: AES-256-CTS-HMAC-SHA1-96
  </code></pre>
  <p>I setup Firefox to do SPENGO authentication
  Then I hit mywebapp.k8s.dal1.mycompany.io/ad-login and I get a <code>403 Forbidden</code> error</p>
  <p>The nginx server debug log shows:</p>
  <pre><code>[debug] 16#16: *195 Client sent a reasonable Negotiate header 
  [debug] 16#16: *195 GSSAPI authorizing 
  [debug] 16#16: *195 Use keytab /etc/krb5.keytab 
  [debug] 16#16: *195 Using service principal: HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO 
  [debug] 16#16: *195 my_gss_name HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO 
  [debug] 16#16: *195 gss_accept_sec_context() failed: Cannot decrypt ticket for HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO using keytab key for HTTP/mywebapp.k8s.dal1.mycompany.io@BURNERDEV1.DAL1.MYCOMPANY.IO: 
  [debug] 16#16: *195 GSSAPI failed 
  [debug] 16#16: *195 http finalize request: 403, &quot;/ad-login?&quot; a:1, c:1 
  [debug] 16#16: *195 http special response: 403, &quot;/ad-login?&quot; 
  [debug] 16#16: *195 http set discard body 
  [debug] 16#16: *195 charset: &quot;&quot; &gt; &quot;utf-8&quot; 
  [debug] 16#16: *195 HTTP/1.1 403 Forbidden
   
  </code></pre>
  <p>BTW while messing around earlier - I found that if I had set a fixed password for the &quot;portal&quot; user with ktpass and logged in as that account on the workstation, the login would succeed.
  I was under the mistaken impression that I'd need to create a new keytab for every user and combine all of them.</p>
  <p>Any help is greatly appreciated - I read so many conflicting docs its only confused me further and I've been losing sleep over this.</p>
  <p>Thanks in advance!</p>