title: How to properly configure Kerberos principal name
body: <p>this is my <code>krb5.ini</code> file.</p>
  
  <pre><code>    [libdefaults]
          default_realm = TEST.EXAMPLE.COM
          .....
      [realms]
          TEST.EXAMPLE.COM = {
              kdc = test.example.com:88
              master_kdc = test.example.com:88
              default_domain = example.com
          }
      [domain_realm]
      .example.com = EXAMPLE.COM
      example.com = EXAMPLE.COM
  </code></pre>
  
  <p>I created a user <code>USERA</code> on the domain, created a credential using <code>kinit</code> and have my jaas.config file defined as </p>
  
  <pre><code>    example_config {
      com.ibm.security.auth.module.Krb5LoginModule required
          useDefaultCcache=false
          principal="userA@TEST.EXAMPLE.COM"  
          useCcache="file:///c:/Users/userA/krb5cc_userA"
          debug=true;
      };
  </code></pre>
  
  <p>everything seems ok as it gets authenticated.</p>
  
  <pre><code>    [JGSS_DBG_CRED] Retrieving Kerberos creds from cache for principal=userA@TEST.EXAMPLE.COM
      [JGSS_DBG_CRED] Non-interactive login; no callbacks necessary.
      [JGSS_DBG_CRED] Done retrieving Kerberos creds from cache
      [JGSS_DBG_CRED] Login successful
      [JGSS_DBG_CRED] userA@TEST.EXAMPLE.COM added to Subject
      [JGSS_DBG_CRED] Kerberos ticket for userA@TEST.EXAMPLE.COM added to Subject
      [JGSS_DBG_CRED] No keys to add to Subject for userA@TEST.EXAMPLE.COM
  </code></pre>
  
  <p>however now, I am trying to use a service principal name , instead of user principal. I used <code>ktpass</code> to create a keytab file</p>
  
  <p><code>ktpass -out "c:\mytab.keytab" -princ "Installation1/test.example.com@TEST.EXAMPLE.COM" -mapUser "TEST\userA" -mapOp set -pass password -crypto DES-CBC-MD5 -pType KRB5_NT_PRINCIPAL +DesOnly</code></p>
  
  <p>and then use <code>setspn</code> to check</p>
  
  <pre><code>  C:\&gt;setspn -l userA
  Registered ServicePrincipalNames for CN=userA,CN=Users,DC=test,DC=example,DC=com:
     Installation1/test.example.com
  </code></pre>
  
  <p>i change my config to </p>
  
  <pre><code>    example_config{
        com.ibm.security.auth.module.Krb5LoginModule required
                  credsType = both                
                 principal="userA/test.example.com"
                 useDefaultCcache = true     
                 useDefaultKeytab = false
                  useKeytab = "file:///c:/mytab.keytab"
                  debug=true;   
      };
  </code></pre>
  
  <p>now when i run my app, it gives</p>
  
  <pre><code>    [JGSS_DBG_CRED] Retrieving Kerberos creds from keytab for principal=Installation1/test.example.com
      [JGSS_DBG_CRED] Service name=Installation1/test.example.com@TEST.EXAMPLE.COM
      [JGSS_DBG_CRED] Check for Default keytab : 
      [JGSS_DBG_CRED] No Kerberos creds in keytab for principal Installation1/test.example.com
      [JGSS_DBG_CRED] No service key in keytab; login failed
  </code></pre>
  
  <p>What did i do wrong in the config file? or is there something i miss in the <code>ktpass</code> command? <code>Installation1</code> is the service name (of Websphere MQ) when I go to check Control Panel -> Services.  I want to autheticate userA to use Websphere MQ service. (like if i want to let user use HTTP I would put principal as <code>HTTP/.....TEST.EXAMPLE.COM</code></p>
  
  <p>thanks</p>