Yep, I do klist -ke and see three for http... Triple DES cbc mode with
HMAC/sha1, ArcFour with HMAC/md5, and DES cbc mode with CRC-32. There
wouldn't need to be separate entries for https, would there? I assume
not since Kerberos requires https anyway.
It seems like the problem is in the realm. Kerb is working for
everything else. I have a realm set up to authenticate by Kerb and to
only allow members of a particular OD group. But when a member of that
group tries to hit that realm, Apache says they have the wrong
credentials.
After you attempt to connect to you have a service ticket for http,
even though you weren't allowed in?
Is anyone successfully controlling Apache realms through Kerberos?