KRB_AP_ERR_MODIFIED me too!!!

[Jéjé]

Hi,

I'm back with a kerberos issue....

Some client received a KRB_AP_ERR_MODIFIED error. when I try to access my
web site. (direct access not through another web site)
Its a reportserver web site.
My server is an x64 server with SQL 2005 x64 installed.
My domain is a Win 2003 domain.
My IIS virtual server is setup to support both NTLM and Negotiate
The APP pool run under the network service account
I have executed these setspn commands:
setspn -a HTTP/<server>.<domain> <server>
setspn -a HTTP/<server> <server>
setspn -a HOST/<server>.<domain> <server>
setspn -a HOST/<server> <server>

I have double check my DNS names and there is no duplicate.
same for my WINS
I have removed the server from the domain and add it again.

There is no duplicated servicepricipalname entry:
ldifde -f SPNdump.txt -s myDC -t 3268 -l servicePrincipalName

External clients connected through a VPN can access my web site while
internal users cannot!!!
The system ask for a login/password; if I type the local administrator
account / pwd, then I can access the site. (local behavior only)

The kerbtray utility display my ticket:
HTTP/<server>.<domain>
with the right start time.

The kerberos error logged in the event log appear only at the client side,
nothing in the server himself.

on other servers similar configuration works fine.

now I'm out of ideas!!!
there is any DNS issue?
name resolution issue?
if yes, where??? how to identify it? and how to resolve it?

there is any issue between 32bits and x64 servers?
generally I have more problems with external users behind using a VPN due to
possible NAT and IP adress problems; but its the opposite here!!!

thanks for your help!!!

Jerome.

[John Fullbright]

I remember a problem like this. It had to do with UDP packets and MTU size
and the number of groups the user belonged to (token size).

Try:

http://support.microsoft.com/kb/244474/en-us
http://support.microsoft.com/kb/280830/en-us

Post by Jéjé
Hi,
I'm back with a kerberos issue....
Some client received a KRB_AP_ERR_MODIFIED error. when I try to access my
web site. (direct access not through another web site)
Its a reportserver web site.
My server is an x64 server with SQL 2005 x64 installed.
My domain is a Win 2003 domain.
My IIS virtual server is setup to support both NTLM and Negotiate
The APP pool run under the network service account
setspn -a HTTP/<server>.<domain> <server>
setspn -a HTTP/<server> <server>
setspn -a HOST/<server>.<domain> <server>
setspn -a HOST/<server> <server>
I have double check my DNS names and there is no duplicate.
same for my WINS
I have removed the server from the domain and add it again.
ldifde -f SPNdump.txt -s myDC -t 3268 -l servicePrincipalName
External clients connected through a VPN can access my web site while
internal users cannot!!!
The system ask for a login/password; if I type the local administrator
account / pwd, then I can access the site. (local behavior only)
HTTP/<server>.<domain>
with the right start time.
The kerberos error logged in the event log appear only at the client side,
nothing in the server himself.
on other servers similar configuration works fine.
now I'm out of ideas!!!
there is any DNS issue?
name resolution issue?
if yes, where??? how to identify it? and how to resolve it?
there is any issue between 32bits and x64 servers?
generally I have more problems with external users behind using a VPN due
to possible NAT and IP adress problems; but its the opposite here!!!
thanks for your help!!!
Jerome.

[Jéjé]

no changes!

the maxpacketsize is allready defined.

the second parameter don't change anything.

any other idea?

Post by John Fullbright
I remember a problem like this. It had to do with UDP packets and MTU size
and the number of groups the user belonged to (token size).
http://support.microsoft.com/kb/244474/en-us
http://support.microsoft.com/kb/280830/en-us

Post by Jéjé
Hi,
I'm back with a kerberos issue....
Some client received a KRB_AP_ERR_MODIFIED error. when I try to access my
web site. (direct access not through another web site)
Its a reportserver web site.
My server is an x64 server with SQL 2005 x64 installed.
My domain is a Win 2003 domain.
My IIS virtual server is setup to support both NTLM and Negotiate
The APP pool run under the network service account
setspn -a HTTP/<server>.<domain> <server>
setspn -a HTTP/<server> <server>
setspn -a HOST/<server>.<domain> <server>
setspn -a HOST/<server> <server>
I have double check my DNS names and there is no duplicate.
same for my WINS
I have removed the server from the domain and add it again.
ldifde -f SPNdump.txt -s myDC -t 3268 -l servicePrincipalName
External clients connected through a VPN can access my web site while
internal users cannot!!!
The system ask for a login/password; if I type the local administrator
account / pwd, then I can access the site. (local behavior only)
HTTP/<server>.<domain>
with the right start time.
The kerberos error logged in the event log appear only at the client
side, nothing in the server himself.
on other servers similar configuration works fine.
now I'm out of ideas!!!
there is any DNS issue?
name resolution issue?
if yes, where??? how to identify it? and how to resolve it?
there is any issue between 32bits and x64 servers?
generally I have more problems with external users behind using a VPN due
to possible NAT and IP adress problems; but its the opposite here!!!
thanks for your help!!!
Jerome.

[John Fullbright]

0x29 or a steam modified error basically means that the KDC couldn't decrypt
the data. I have ssen this because of MTU size/token size. I have also
seen this in cases where the secure channel between the client and dc is
broken. This typically happens with remote clients connecting via VPN
because the have been offline for a while and the password of the computer
account has changed. Try using netdom or nltest to reset it for a problem
client.

http://support.microsoft.com/kb/216393/en-us

Post by Jéjé
no changes!
the maxpacketsize is allready defined.
the second parameter don't change anything.
any other idea?

Post by John Fullbright
I remember a problem like this. It had to do with UDP packets and MTU
size and the number of groups the user belonged to (token size).
http://support.microsoft.com/kb/244474/en-us
http://support.microsoft.com/kb/280830/en-us

Post by Jéjé
Hi,
I'm back with a kerberos issue....
Some client received a KRB_AP_ERR_MODIFIED error. when I try to access
my web site. (direct access not through another web site)
Its a reportserver web site.
My server is an x64 server with SQL 2005 x64 installed.
My domain is a Win 2003 domain.
My IIS virtual server is setup to support both NTLM and Negotiate
The APP pool run under the network service account
setspn -a HTTP/<server>.<domain> <server>
setspn -a HTTP/<server> <server>
setspn -a HOST/<server>.<domain> <server>
setspn -a HOST/<server> <server>
I have double check my DNS names and there is no duplicate.
same for my WINS
I have removed the server from the domain and add it again.
ldifde -f SPNdump.txt -s myDC -t 3268 -l servicePrincipalName
External clients connected through a VPN can access my web site while
internal users cannot!!!
The system ask for a login/password; if I type the local administrator
account / pwd, then I can access the site. (local behavior only)
HTTP/<server>.<domain>
with the right start time.
The kerberos error logged in the event log appear only at the client
side, nothing in the server himself.
on other servers similar configuration works fine.
now I'm out of ideas!!!
there is any DNS issue?
name resolution issue?
if yes, where??? how to identify it? and how to resolve it?
there is any issue between 32bits and x64 servers?
generally I have more problems with external users behind using a VPN
due to possible NAT and IP adress problems; but its the opposite here!!!
thanks for your help!!!
Jerome.

[Jéjé]

well...

due to other configuration issue (hardware config) we have decide to
reinstall the system
in this new and clean setup we have changed the server name etc...

and everything works fine after this.

but before this there is only small difference between previous
configuration and the new one (the server was first install this week
end...)

Post by John Fullbright
0x29 or a steam modified error basically means that the KDC couldn't
decrypt the data. I have ssen this because of MTU size/token size. I
have also seen this in cases where the secure channel between the client
and dc is broken. This typically happens with remote clients connecting
via VPN because the have been offline for a while and the password of the
computer account has changed. Try using netdom or nltest to reset it for
a problem client.
http://support.microsoft.com/kb/216393/en-us

Post by Jéjé
no changes!
the maxpacketsize is allready defined.
the second parameter don't change anything.
any other idea?

Post by John Fullbright
I remember a problem like this. It had to do with UDP packets and MTU
size and the number of groups the user belonged to (token size).
http://support.microsoft.com/kb/244474/en-us
http://support.microsoft.com/kb/280830/en-us

Post by Jéjé
Hi,
I'm back with a kerberos issue....
Some client received a KRB_AP_ERR_MODIFIED error. when I try to access
my web site. (direct access not through another web site)
Its a reportserver web site.
My server is an x64 server with SQL 2005 x64 installed.
My domain is a Win 2003 domain.
My IIS virtual server is setup to support both NTLM and Negotiate
The APP pool run under the network service account
setspn -a HTTP/<server>.<domain> <server>
setspn -a HTTP/<server> <server>
setspn -a HOST/<server>.<domain> <server>
setspn -a HOST/<server> <server>
I have double check my DNS names and there is no duplicate.
same for my WINS
I have removed the server from the domain and add it again.
ldifde -f SPNdump.txt -s myDC -t 3268 -l servicePrincipalName
External clients connected through a VPN can access my web site while
internal users cannot!!!
The system ask for a login/password; if I type the local administrator
account / pwd, then I can access the site. (local behavior only)
HTTP/<server>.<domain>
with the right start time.
The kerberos error logged in the event log appear only at the client
side, nothing in the server himself.
on other servers similar configuration works fine.
now I'm out of ideas!!!
there is any DNS issue?
name resolution issue?
if yes, where??? how to identify it? and how to resolve it?
there is any issue between 32bits and x64 servers?
generally I have more problems with external users behind using a VPN
due to possible NAT and IP adress problems; but its the opposite here!!!
thanks for your help!!!
Jerome.