This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Proxy: Key table entry not found

For whatever reason, certain hosts can no longer access the web through the Astaro web proxy in SSO under Active Directory due to the following error:

[FONT="Courier New"]httpproxy[9752]: [ 0x88cd510] adir_auth_process_negotiate (auth_adir.c:311) gss_accept_sec_context: Key table entry not found [/FONT]

Anyone? I have put an authentication bypass in place for the affected hosts. I have reset the computer accounts in AD and re-joined them to the domain.

This thread was automatically locked due to age.

0 William Warren over 15 years ago

have you resynced the AD with the astaro?
Cancel
Vote Up 0 Vote Down

Cancel
0 pneumatic over 15 years ago in reply to William Warren

I've deleted the Astaro box from the AD servers list, renamed it and re-joined it to no avail.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 15 years ago

no..from the astaro end resync it to the AD.
Cancel
Vote Up 0 Vote Down

Cancel
0 pneumatic over 15 years ago in reply to William Warren

By "resync", I assume that you mean just re-do the Active Directory SSO setting and AD authentication server, yes?

This has been done already. I'm not so sure that this isn't a problem with the data integrity of this particular domain, unfortunately.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 15 years ago

if it comes to that..however you can go into the SSO section and manually pull down the groups and users via a button in the webadmin. Try that first before you break the ad inside the Astaro and then redo it.
Cancel
Vote Up 0 Vote Down

Cancel
0 pneumatic over 15 years ago in reply to William Warren

It really looks like Astaro is unable to associate an AD user account with the machine IP address. When I create a host exception to allow an affected host access to the internet, the "user" field is blank in the logs.

Very strange.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 15 years ago in reply to pneumatic

I've deleted the Astaro box from the AD servers list, renamed it and re-joined it to no avail.

Soemthing isn't right in the communication between the two then. in the advanced section of authentication hit the prefect now button and see if that succeeds. also check the enable backend sync on login option./
Cancel
Vote Up 0 Vote Down

Cancel
0 pneumatic over 15 years ago in reply to William Warren

Prefetching doesn't help. At this point, I'm at a loss... Rebuild?
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 15 years ago in reply to pneumatic

I have an open case with Astaro concerning a similar issue at one of my customer sites; there are a few hosts, out of about 40 or 50, that fail to authenticate using AD SSO; there appears to be something wierd happening with the proxy's hostname; it apparently is case sensitive when using Kerberos. The wierd thing in my case is that all clients use the same case for the entry, as it's being pushed out by Windows GPO.

Try using the IP for the proxy setting in IE; this forces the SSO authentication to use NTLM instead of Kerberos; in our case, while Astaro figures out the Kerberos issue, this made it work. If your problem sounds like ours, I highly recommend that you start a case with Astaro support so they can chase this problem down.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

Excellent work, Bruce... "Wizard" is no exaggeration!

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel