title: Configure Kerberos SSO on Moodle: KRB5KDC_ERR_PREAUTH_REQUIRED
body: <p>I'm trying to set up kerberos SSO in Moodle but I'm getting a error_code: KRB5KDC_ERR_PREAUTH_REQUIRED (25):</p>
  
  <p><strong>1) I've configured kerberos on Apache:</strong> installed kerberos, configured via /etc/krb5.cnf, and tested via kinit command getting right kerberos tickets. WORKS</p>
  
  <p><strong>2) I've created a virtual host in Apache with a folder with kerberos authentication for testing:</strong> create a keytab file, tested authentication through kerberos works in the testing virtual site. I get the LDAP REMOTE_USER info and passes the authentication, also kerberos traffic is generated (fetched kerberos traffic with wireshark). WORKS</p>
  
  <p><strong>3) Configured virtual host to use kerberos to authenticate to moodle:</strong> as shown in moodle documentation.</p>
  
  <p><a href="http://docs.moodle.org/22/en/NTLM_authentication#Using_the_Kerberos_Auth_Module_for_Apache_on_Linux.2FUNIX_.28mod_auth_kerb.29" rel="nofollow noreferrer">Moodle Kerberos SSO documentation</a></p>
  
  <p><strong>4) Configured moodle's LDAP auth plugin:</strong> login with an LDAP user works fine. WORKS</p>
  
  <p><strong>5) Configured NTLM options in moodle's ldap plugin:</strong> I've tested and it does generate kerberos authentication network traffic (fetched kerberos with wireshark). But I'm getting a <strong>KRB5KDC_ERR_PREAUTH_REQUIRED (25)</strong>. </p>
  
  <p>Moodle LDAP configuration (NTLM section):</p>
  
  <pre><code>Enable = yes
  Subnetwork = 192.168.0.0/16
  Authentication type = kerberos
  Username format = (none)
  </code></pre>
  
  <p><img src="https://i.stack.imgur.com/NS7MS.png" alt="moodle ldap config ntlm section"></p>
  
  <p>My virtual host configuration for both sites (test folder and moodle folder) is:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
          # General
          ServerAdmin myemail@domain.com
          DocumentRoot /home/moodle/moodle
          ServerName mymoodle.es  
          LogLevel debug
          ErrorLog logs/testing-error.log
          CustomLog logs/testing.log combined
  
          &lt;Location /krb_testing&gt;
            ## Redes para las que se ofrece SSO
            AuthType Kerberos
            AuthName "Kerberos Login"
  
            KrbMethodNegotiate On
            KrbMethodK5Passwd Off
            KrbServiceName HTTP/mymoodle.es@MYREALM.DOMAIN.ES
            KrbAuthRealms MYREALM.DOMAIN.ES  
            Krb5KeyTab      /etc/krb5.keytab
  
            ## Sin require valid-user no se produce la negociacion
            require valid-user
          &lt;/Location&gt;
  
          &lt;Directory /home/moodle/moodle/auth/ldap/&gt;
          &lt;Files ntlmsso_magic.php&gt;
              AuthName "Moodle"
              AuthType Kerberos
              KrbAuthRealms MYREALM.DOMAIN.ES
              KrbServiceName HTTP/mymoodle.es@MYREALM.DOMAIN.ES
              Krb5KeyTab      /etc/krb5.keytab
              KrbMethodNegotiate on
              KrbMethodK5Passwd on
              KrbAuthoritative on
              require valid-user
          &lt;/Files&gt;
          &lt;/Directory&gt;           
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p><strong>Apache version:</strong> Apache/2.2.15 (CentOS)</p>
  
  <p><strong>Moodle version:</strong> 2.4.7</p>