Requesting a TGT using a servicename

Sushant Mathur <[email protected]> Mon, 21 May 2018 17:10:24 +0530
Newsgroups gmane.comp.encryption.kerberos.heimdal.general
Message-ID <CAN5=gs-jAGOh2JmzmjReGw7w6HupOuyQ5+6=D6O5ekE2Um6yhg@mail.gmail.com>
Whilst using the Heimdal GSS API, I have run into a problem when calling
gss_accept_sec_context.
I do not fully understand how the digest API works, but in this case an
AS-REQ is sent to the DC with the principal as cifs/smvm1.kerb1.dom and the
response states the error:

KRB Error: KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN

I added the service principal name under the user [email protected] but
still encountered the error. So my questions are:

1. Can a service principal name request for a TGT? If not then what method
should I use to query the DC(KDC) from another account ( most likely an
user account) from the same domain?

2. I tried doing a kinit -S cifs/smvm1.kerb1.dom [email protected] and did
get the ticket in the credential cache file with the principal being
cifs/[email protected] but still didn't work and heimdal still
tries to get the TGT during use.

-- 
*Sushant Mathur*