{"action":"opened","issue":{"url":"https://api.github.com/repos/stnoonan/spnego-http-auth-nginx-module/issues/61","repository_url":"https://api.github.com/repos/stnoonan/spnego-http-auth-nginx-module","labels_url":"https://api.github.com/repos/stnoonan/spnego-http-auth-nginx-module/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/stnoonan/spnego-http-auth-nginx-module/issues/61/comments","events_url":"https://api.github.com/repos/stnoonan/spnego-http-auth-nginx-module/issues/61/events","html_url":"https://github.com/stnoonan/spnego-http-auth-nginx-module/issues/61","id":146527106,"number":61,"title":"nginx 1.8 403 forbidden, gss_accept_sec_context() failed: :","user":{"login":"deejvince","id":2372146,"avatar_url":"https://avatars.githubusercontent.com/u/2372146?v=3","gravatar_id":"","url":"https://api.github.com/users/deejvince","html_url":"https://github.com/deejvince","followers_url":"https://api.github.com/users/deejvince/followers","following_url":"https://api.github.com/users/deejvince/following{/other_user}","gists_url":"https://api.github.com/users/deejvince/gists{/gist_id}","starred_url":"https://api.github.com/users/deejvince/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deejvince/subscriptions","organizations_url":"https://api.github.com/users/deejvince/orgs","repos_url":"https://api.github.com/users/deejvince/repos","events_url":"https://api.github.com/users/deejvince/events{/privacy}","received_events_url":"https://api.github.com/users/deejvince/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-07T07:05:49Z","updated_at":"2016-04-07T07:05:49Z","closed_at":null,"body":"Hello,\r\nkinit works ok with our context:\r\nroot@messaging02:~# kinit -5 -V -k -t /etc/krb5.keytab HTTP/<FQDN-Removed>\r\nUsing default cache: /tmp/krb5cc_0\r\nUsing principal: HTTP/<FQDN-Removed<@<REALM-Removed>\r\nUsing keytab: /etc/krb5.keytab\r\nAuthenticated to Kerberos v5\r\n\r\nHowever in nginx it fails, and gives the user 403.\r\nI have verified all configurations, generated new keytab file, checked permissions to keytab (tried 640 and even 777, owner root:www-data), made sure we followed the guide in the readme..\r\n\r\n/etc/krb5.conf:\r\n\r\n[libdefaults]\r\n    default_tkt_enctypes = rc4-hmac\r\n    default_tgs_enctypes = rc4-hmac\r\n    default_keytab_name  = FILE:/etc/krb5.keytab\r\n    default_realm        = <REALM-Removed>\r\n    ticket_lifetime      = 24h\r\n    kdc_timesync         = 1\r\n    ccache_type          = 4\r\n    forwardable          = false\r\n    proxiable            = false\r\n\r\n  [realms]\r\n    <REALM-Removed> = {\r\n        kdc            = <AD DC 1 - Removed>:88\r\n        kdc            = <AD DC 2 - Removed>:88\r\n        kdc            = <AD DC 3 - Removed>:88\r\n        admin_server   = <AD DC 1 - Removed>\r\n        default_domain = <Domain FQDN Removed>\r\n    }\r\n\r\n  [domain_realm]\r\n    .<domain-removed> = <REALM-Removed>\r\n    <domain-removed>  = <REALM-Removed>\r\n\r\n/etc/nginx/sites-enabled/myconf.conf:\r\n\r\n<truncated>\r\nlocation /client {\r\n        alias /usr/share/nginx/site;\r\n\r\n        auth_gss on;\r\n        auth_gss_realm <REALM-Removed>;\r\n        auth_gss_keytab /etc/krb5.keytab;\r\n        auth_gss_service_name HTTP/<FQDN-Removed>l;\r\n        auth_gss_allow_basic_fallback off;\r\n\r\n\r\n\r\nError.log (auth part):\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 Begin auth\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 Detect SPNEGO token\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 Token decoded: <Removed Data>\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 Client sent a reasonable Negotiate header\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 GSSAPI authorizing\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 Use keytab /etc/krb5.keytab\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 Using service principal: HTTP/<FQDN-REMOVED>@<REALM-REMOVED>\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 my_gss_name HTTP/<FQDN-REMOED>@<REALM-REMOVED>\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 gss_accept_sec_context() failed: :\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 GSSAPI failed\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 http finalize request: 403, \"/client?\" a:1, c:1\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 http special response: 403, \"/client?\"\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 http set discard body\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 xslt filter header\r\n2016/04/07 09:47:11 [debug] 3676#0: *24030 HTTP/1.1 403 Forbidden\r\nServer: nginx/1.8.0\r\n\r\nWhat am i missing?"}}