[Samba] Unknown code krb5 156

[Jens Kammann]

Hi,

I am having trouble joining an AD Domain with samba3.0.10:

All checks mentioned in the Samba-Guides (regarding LDAP & Kerberos) passed,
but when I use

>netra:~/samba-3.0.10/source/bin# ./net ads join -Utestuser
>testuser's password: 
>[2005/01/27 10:41:11, 0] libads/kerberos.c:ads_kinit_password(146)
>  kerberos_kinit_password testuser at INTRA.DOMAIN.DE failed: Unknown code
krb5 156

It takes over an minute from entering the password until the error message
appears.

Debug output doesn't help much:

[2005/01/27 10:42:48, 5] libads/ldap.c:ads_try_connect(85)
  ads_try_connect: trying ldap server '138.245.163.136' port 389
[2005/01/27 10:42:49, 3] libads/ldap.c:ads_connect(247)
  Connected to LDAP server 138.245.163.136
[2005/01/27 10:42:49, 3] libads/ldap.c:ads_server_info(2432)
  got ldap server name dc01 at INTRA.DOMAIN.DE, using bind path:
dc=INTRA,dc=DOMAIN,dc=DE
[2005/01/27 10:42:49, 4] libads/ldap.c:ads_server_info(2438)
  time offset is 0 seconds
[2005/01/27 10:42:49, 4] libads/sasl.c:ads_sasl_bind(447)
  Found SASL mechanism GSS-SPNEGO
[2005/01/27 10:42:49, 3] libads/sasl.c:ads_sasl_spnego_bind(204)
  ads_sasl_spnego_bind: got OID=1 2 840 48018 1 2 2
[2005/01/27 10:42:49, 3] libads/sasl.c:ads_sasl_spnego_bind(204)
  ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2
[2005/01/27 10:42:49, 3] libads/sasl.c:ads_sasl_spnego_bind(204)
  ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2 3
[2005/01/27 10:42:49, 3] libads/sasl.c:ads_sasl_spnego_bind(204)
  ads_sasl_spnego_bind: got OID=1 3 6 1 4 1 311 2 2 10
[2005/01/27 10:42:49, 3] libads/sasl.c:ads_sasl_spnego_bind(211)
  ads_sasl_spnego_bind: got server principal name =dc01$@INTRA.DOMAIN.DE
[2005/01/27 10:42:49, 3] libsmb/clikrb5.c:ads_krb5_mk_req(382)
  ads_krb5_mk_req: krb5_cc_get_principal failed (No such file or directory)
[2005/01/27 10:45:49, 0] libads/kerberos.c:ads_kinit_password(146)
  kerberos_kinit_password kammann at INTRA.DLR.DE failed: Unknown code krb5 156
[2005/01/27 10:45:49, 0] utils/net_ads.c:ads_startup(186)
  ads_connect: Unknown code krb5 156
[2005/01/27 10:45:49, 2] utils/net.c:main(859)
  return code = -1

The OS is Debian Sarge with "heimdal-dev 0.6.3-6"

Has anyone seen this before ?
Is there anything particular on the Domain-Controller that needs to be
enabled ?

regards,
   Jens Kammann