我可以成功运行kinit以获得以下klist输出：
Ticket cache: FILE:/tmp/krb5cc_1001
Default principal: [email protected]
Valid starting Expires Service principal
01.03.2022 17:24:01 02.03.2022 17:23:58 krbtgt/[email protected]
并且以下 cURL 命令也有效：
curl --negotiate -u: http://test.kerim.io:8081/skin?test=foo
具有以下输出：
* Connected to test.kerim.io (192.168.1.100) port 8081 (#0)
* Server auth using Negotiate with user '';
> GET /skin?test=foo HTTP/1.1
> Host: test.kerim.io:8081
> Authorization: Negotiate YIICWQYGKwYBBQUCoIIC[redacted]
> User-Agent: curl/7.74.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Tue, 01 Mar 2022 16:29:15 GMT
< Server: Apache
< WWW-Authenticate: Negotiate oYG3MIG0oAMKAQChCwYJKoZIgvcSA[redacted]
< Cache-Control: no-cache, no-store
< Access-Control-Allow-Origin: localhost
< Access-Control-Allow-Methods: GET, POST, OPTIONS
< Access-Control-Max-Age: 1000
< Access-Control-Allow-Headers: X-Requested-With, Content-Type, Origin, Authorization, Accept
< Transfer-Encoding: chunked
< Content-Type: text/html; charset=UTF-8
我尝试在 firefox 中设置各种浏览器设置（通过 about:config，遵循本指南）和 chrome 的命令行参数（--auth-server-whitelist="*.kerim.io"），但似乎浏览器只是拒绝协商上述 URL。
客户端操作系统是 Ubuntu。网络服务器确实以WWW-Authenticate: Negotiate.
使用以下环境变量调用 Firefox：
export NSPR_LOG_MODULES="negotiateauth:5,NTLM:5" KRB5_TRACE="/dev/stderr"
显示此错误：
[Parent 21580: Main Thread]: D/negotiateauth service = test.kerim.io
[Parent 21580: Main Thread]: D/negotiateauth using negotiate-gss
[Parent 21580: Main Thread]: D/negotiateauth entering nsAuthGSSAPI::nsAuthGSSAPI()
[Parent 21580: Main Thread]: D/negotiateauth Attempting to load gss functions
[Parent 21580: Main Thread]: D/negotiateauth entering nsAuthGSSAPI::Init()
[Parent 21580: BgIOThreadPool #1]: D/negotiateauth nsHttpNegotiateAuth::GenerateCredentials() [challenge=Negotiate]
[Parent 21580: BgIOThreadPool #1]: D/negotiateauth entering nsAuthGSSAPI::GetNextToken()
[Parent 21580: BgIOThreadPool #1]: D/negotiateauth gss_init_sec_context() failed: Unspecified GSS failure. Minor code may provide more information
SPNEGO cannot find mechanisms to negotiate
[Parent 21580: BgIOThreadPool #1]: D/negotiateauth leaving nsAuthGSSAPI::GetNextToken [rv=80004005]
这可能是 KDC 名称解析的问题吗？我目前只有我的主机名/etc/hosts，没有在 DNS 中注册。