{"id":1255,"date":"2011-04-18T14:49:40","date_gmt":"2011-04-18T13:49:40","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=1255"},"modified":"2011-04-18T14:49:40","modified_gmt":"2011-04-18T13:49:40","slug":"kerberos-rfc1510-failure-codes","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=1255","title":{"rendered":"Kerberos (RFC1510) Failure Codes"},"content":{"rendered":"

These failure codes are the original error codes from the Kerberos RFC 1510<\/a> <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Error codes<\/h3>\n<\/td>\n<\/tr>\n

Kerberos
\nError Label<\/strong><\/td>\n		Hex<\/strong><\/td>\nDec<\/strong><\/td>\nMeaning or MIT code<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
KDC_ERR_NONE<\/td>\n0x0<\/td>\n0<\/td>\nNo error<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_NAME_EXP<\/td>\n0x1<\/td>\n1<\/td>\nClient’s entry in database has expired<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_SERVICE_EXP<\/td>\n0x2<\/td>\n2<\/td>\nServer’s entry in database has expired<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_BAD_PVNO<\/td>\n0x3<\/td>\n3<\/td>\nRequested protocol version number not supported<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_C_
\nOLD_MAST_KVNO<\/td>\n		0x4<\/td>\n4<\/td>\nClient’s key encrypted in oldmaster key<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_S_
\nOLD_MAST_KVNO<\/td>\n		0x5<\/td>\n5<\/td>\nServer’s key encrypted in old master key<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_C_
\nPRINCIPAL_UNKNOWN<\/td>\n		0x6<\/td>\n6<\/td>\nClient not found in Kerberos database<\/td>\n\n
    \n
  • We have seen this code when Active Directory replication does not work correctly. In this case, it is possible that e.g. a computer account joins the domain using one DC. Then, this information is not replicated within AD. If the computer then tries to authenticate to another DC, it is not found there, resulting in this error code.<\/li>\n
  • Also, make sure time synchronization between DCs is working well.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
KDC_ERR_S_
\nPRINCIPAL_UNKNOWN<\/td>\n		0x7<\/td>\n7<\/td>\nServer not found in Kerberos database<\/td>\nCould be the same cause as error 6 above.<\/td>\n<\/tr>\n
KDC_ERR_
\nPRINCIPAL_NOT_UNIQUE<\/td>\n		0x8<\/td>\n8<\/td>\nMultiple principal entries in database<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_NULL_KEY<\/td>\n0x9<\/td>\n9<\/td>\nThe client or server has a null key<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_CANNOT_
\nPOSTDATE<\/td>\n		0xa<\/td>\n10<\/td>\nTicket not eligible for postdating<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_NEVER_VALID<\/td>\n0xb<\/td>\n11<\/td>\nRequested start time is later than end time<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_POLICY<\/td>\n0xc<\/td>\n12<\/td>\nKDC policy rejects request<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_BADOPTION<\/td>\n0xd<\/td>\n13<\/td>\nKDC cannot accommodate requested option<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_
\nETYPE_NOSUPP<\/td>\n		0xe<\/td>\n14<\/td>\nKDC has no support for encryption type<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_SUMTYPE_NOSUPP<\/td>\n0xf<\/td>\n15<\/td>\nKDC has no support for checksum type<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_
\nPADATA_TYPE_NOSUPP<\/td>\n		0x10<\/td>\n16<\/td>\nKDC has no support for padata type<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_TRTYPE_NOSUPP<\/td>\n0x11<\/td>\n17<\/td>\nKDC has no support for transited type<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_
\nCLIENT_REVOKED<\/td>\n		0x12<\/td>\n18<\/td>\nClients credentials have been revoked<\/td>\nThis is due to a workstation restriction on the account, or a logon time restriction, or logon attempt outside logon hours, or accout disabled, expired, or locked out.<\/td>\n<\/tr>\n
KDC_ERR_
\nSERVICE_REVOKED<\/td>\n		0x13<\/td>\n19<\/td>\nCredentials for server have been revoked<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_TGT_REVOKED<\/td>\n0x14<\/td>\n20<\/td>\nTGT has been revoked<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_CLIENT_NOTYET<\/td>\n0x15<\/td>\n21<\/td>\nClient not yet valid – try again later<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_
\nSERVICE_NOTYET<\/td>\n		0x16<\/td>\n22<\/td>\nServer not yet valid – try again later<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_KEY_
\nEXPIRED<\/td>\n		0x17<\/td>\n23<\/td>\nPassword has expired – change password to reset<\/td>\n<\/td>\n<\/tr>\n
KDC_ERR_
\nPREAUTH_FAILED<\/td>\n		0x18<\/td>\n24<\/td>\nPre-authentication information was invalid<\/td>\nBe sure to check time synchronization within your tree.<\/td>\n<\/tr>\n
KDC_ERR_
\nPREAUTH_REQUIRED<\/td>\n		0x19<\/td>\n25<\/td>\nAdditional pre-authentication required<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_
\nBAD_INTEGRITY<\/td>\n		0x1f<\/td>\n31<\/td>\nIntegrity check on decrypted field failed<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_TKT_
\nEXPIRED<\/td>\n		0x20<\/td>\n32<\/td>\nTicket expired<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_TKT_NYV<\/td>\n0x21<\/td>\n33<\/td>\nTicket not yet valid<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_REPEAT<\/td>\n0x22<\/td>\n34<\/td>\nRequest is a replay<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_NOT_US<\/td>\n0x23<\/td>\n35<\/td>\nThe ticket isn’t for us<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_BADMATCH<\/td>\n0x24<\/td>\n36<\/td>\nTicket and authenticator don’t match<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_SKEW<\/td>\n0x25<\/td>\n37<\/td>\nClock skew too great<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_BADADDR<\/td>\n0x26<\/td>\n38<\/td>\nIncorrect net address<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_
\nBADVERSION<\/td>\n		0x27<\/td>\n39<\/td>\nProtocol version mismatch<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_MSG_TYPE<\/td>\n0x28<\/td>\n40<\/td>\nInvalid msg type<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_MODIFIED<\/td>\n0x29<\/td>\n41<\/td>\nMessage stream modified<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_
\nBADORDER<\/td>\n		0x2a<\/td>\n42<\/td>\nMessage out of order<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_
\nBADKEYVER<\/td>\n		0x2c<\/td>\n44<\/td>\nSpecified version of key is not available<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_NOKEY<\/td>\n0x2d<\/td>\n45<\/td>\nService key not available<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_MUT_FAIL<\/td>\n0x2e<\/td>\n46<\/td>\nMutual authentication failed<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_
\nBADDIRECTION<\/td>\n		0x2f<\/td>\n47<\/td>\nIncorrect message direction<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_METHOD<\/td>\n0x60<\/td>\n48<\/td>\nAlternative authentication method required*<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_BADSEQ<\/td>\n0x31<\/td>\n49<\/td>\nIncorrect sequence number in message<\/td>\n<\/td>\n<\/tr>\n
KRB_AP_ERR_
\nINAPP_CKSUM<\/td>\n		0x32<\/td>\n50<\/td>\nInappropriate type of checksum in message<\/td>\n<\/td>\n<\/tr>\n
KRB_ERR_GENERIC<\/td>\n0x3C<\/td>\n60<\/td>\nGeneric error (description in e-text<\/td>\n<\/td>\n<\/tr>\n
KRB_ERR_FIELD
\n_TOOLONG<\/td>\n		0x3D<\/td>\n61<\/td>\nField is too long for this implementation<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

<\/strong><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

These failure codes are the original error codes from the Kerberos RFC 1510<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[10],"tags":[54],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1255"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1255"}],"version-history":[{"count":2,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1255\/revisions"}],"predecessor-version":[{"id":1257,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1255\/revisions\/1257"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1255"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1255"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1255"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}