Apr. 25 2013
1

kinit: KDC reply did not match expectations

Right now, I’m setting up a Linux file server to join and service an all-Windows environment. Mainly to save a few thousand bucks for my client. One of the roadblocks I ran into was while attempting to get my ticket to join the domain using the kinit program. Since I knew SRV records were correct, Kerberos was setup very basically, without realm definitions, and to get domain controller information from DNS.

I kept attempting to run kinit administrator@example.com. And it kept failing with kinit: KDC reply did not match expectations while getting initial credentials.

Since I would get an incorrect password failure message, I knew things were being authenticated correctly against the DC…

But then, I found this helpful blog post when told me I needed to capitalize my domain, in less words than I’ve done here. If you have realms defined in the configuration, you’d use that name and it’s case sensitive. Since I don’t (and domains are supposed to be capitalized), using kinit administrator@EXAMPLE.COM fixed my issue.

(I realize this isn’t exactly the greatest “HEY, I HAVEN’T HEARD FROM YOU IN A YEAR” post, but you’ll be fine.)

1 comment

  1. Koko
    November 20, 2013 at 7:55 am

    Opera is not a “modern web browser”? :-) Opera is the best web browser! ;-)

Leave a Reply

Previous post:

Next post:

Last.fm interface from fmTuner (modified by me).

Twitter interface from HL Twitter.

Dedicated to my mom, Sharon. May she rest peacefully.
Love you always. (March 23, 1965 - November 12, 2011)

Unsupported Browser!

My site is designed for and currently displays best with modern browsers (and it looks like you don't have one!).

Everything should still function properly, but you won't be able to see all the fancy effects, text, or the way I intended my design to look.

Consider trying the latest version of either Firefox or Chrome... I think you'll like it!

Logan Bibby

P.S.: You can continue viewing my site by clicking the "close" link and you'll never see this again. :)