OK.
The only other common failure that early in the process is incorrect
acceptor name.
The module prints the name that it is acquiring credentials for.
Please confirm that's the same as the name in the URI on the client
exactly.
As you may be aware from our service priorities discussion, error
handling is one of the things most in need of improvement.
We're proposing that by service launch we have a way to get tracing logs
out of mech_eap that will log errors and timestamps even when SPNEGO is
used and suppresses the errors.
On the Kerberos side, I believe that the SPNEGO errors may be better on
RHEL 7 than on RHEl 6, but I'm not 100% sure that work ever got done.
--Sam
|