Pasted

1. setspn -D HTTP/tomcatserver.global.lpl.top tomcatuser
Updated object
 2. setspn -l tomcatuser
list empty
 3. ktpass /out c:\tomcat2.keytab /mapuser [email protected] /mapOp set /princ HTTP/[email protected] /pass tomcatuserpassword /ptype KRB5_NT_PRINCIPAL /crypto AES256-SHA1
 Targeting domain controller: cdc.global.lpl.top
Successfully mapped HTTP/tomcatserver.global.lpl.top to tomcatuser.
Password successfully set!
Key created.
Output keytab to : c:\tomcat2.keytab:
Keytab version: 0x502
keysize 96 HTTP/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 6 etype 0x12 (AES256-SHA1) keylength 32 (0x0a976...bd7)
 4. setspn -l tomcatuser
Registered ServicePrincipalNames for CN=tomcatuser,OU=Services,OU=Accounts,OU=...,OU=Delegated,DC=global,DC=lpl,DC=top: HTTP/tomcatserver.global.lpl.top
 5. jdk1.7.0_79\bin> klist -k -t C:\tomcat2.keytab
 Key tab: C:\tomcat2.keytab, 1 entry found.
 [1] Service principal: HTTP/[email protected]
         KVNO: 6
         Time stamp: Jan 01, 1970 03:00
 6. tomcatuser AD account properties shows User Logon Name "HTTP/tomcatserver.global.lpl.top" followed by "@global.lpl.top" value in dropdown list.
128 and 256 ecnryption are checked.
 7. jdk1.7.0_79\bin>kinit tomcatuser tomcatuserpassword
empty reply
 8. jdk1.7.0_79\bin>kinit HTTP/[email protected] -k -t C:\tomcat2.keytab
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
available; only have keys of following type:  No error
KrbException: Do not have keys of types listed in default_tkt_enctypes available
; only have keys of following type:
        at sun.security.krb5.internal.crypto.EType.getDefaults(EType.java:273)
        at sun.security.krb5.KrbAsReqBuilder.build(KrbAsReqBuilder.java:264)
        at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:318)
        at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:364)
        at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:221)
        at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)
 9. Noticed that kinit doesn't really seem to care about my C:\Windows\krb5.ini (I even tried deleting it) nor actual command values:
jdk1.7.0_79\bin>kinit nosuchuser -k -t c:\nosuchfile.keytab
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
available; ...
 10. jdk1.7.0_79\bin>ktab -l -e -t -k C:\tomcat2.keytab
Keytab name: C:\tomcat2.keytab
KVNO Timestamp     Principal
 ---- ------------- -------------------------------------------------------------
-----------------------
   6 01.01.70 3:00 HTTP/[email protected] (18:AES256 CTS
mode with HMAC SHA1-96)
 Addendum
C:\Windows\krb5.ini:
[libdefaults]
default_realm = GLOBAL.LPL.TOP
default_keytab_name = FILE:C:\tomcat2.keytab
default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
forwardable=true
 [realms]
GLOBAL.LPL.TOP = {
        kdc = cdc.global.lpl.top:88
}
 [domain_realm]
global.lpl.top=GLOBAL.LPL.TOP
.global.lpl.top=GLOBAL.LPL.TOP