GSSAPI and Outlook

amaccuish

Has anyone got the newly announced kerberos support working for outlook? The logon succeeds on the gromox side and the correct username is printed, but Outlook displays an error

Is there any other SPN that needs to be added? I receive the same result with both HTTP/hostname and HOST/hostname. I see no other errors, HTTP logs just show some exchange_nsp lookups after auth.

jengelh

There was something missing. Perhaps you could give the newer gromox version (gromox-2.17-128-g035a839e9) from download.grommunio.com/devel/ a try.

amaccuish

gromox-2.17.128.035a839-lp155.3.1.x86_64.rpm didn't work unfortunately. (edited)

There is an "unbind" after this request, not sure if this helps

Nov 24 17:23:32 mx01 http[12306]: Entering nsp_interface_get_props: {container=0h record=2ch delta=0 fpos=0/0} Nov 24 17:23:32 mx01 http[12306]: Leaving nsp_interface_get_props: {container=0h record=2ch delta=0 fpos=0/0} {#outrows=1} Nov 24 17:23:32 mx01 http[12306]: #0 (1 props) Nov 24 17:23:32 mx01 http[12306]: >> 17:23:32.891874 [::1]:10443->[::1]:48132 658 bytes Nov 24 17:23:32 mx01 http[12306]: HTTP/1.1 200 OK Nov 24 17:23:32 mx01 http[12306]: Cache-Control: private Nov 24 17:23:32 mx01 http[12306]: Content-Type: application/mapi-http Nov 24 17:23:32 mx01 http[12306]: X-RequestType: getprops Nov 24 17:23:32 mx01 http[12306]: X-RequestId: {A5247A62-798A-420A-A94E-A74EDECBA90B}:5 Nov 24 17:23:32 mx01 http[12306]: X-ClientInfo: {77077A8E-BDD8-4F7C-AE9A-7C39AA31C6E0}:65400005 Nov 24 17:23:32 mx01 http[12306]: X-ResponseCode: 0 Nov 24 17:23:32 mx01 http[12306]: X-PendingPeriod: 30000 Nov 24 17:23:32 mx01 http[12306]: X-ExpirationInfo: 900000 Nov 24 17:23:32 mx01 http[12306]: X-ServerApplication: Exchange/15.00.0847.4040 Nov 24 17:23:32 mx01 http[12306]: Date: Fri, 24 Nov 2023 16:23:32 GMT Nov 24 17:23:32 mx01 http[12306]: Set-Cookie: sid=REDACED Nov 24 17:23:32 mx01 http[12306]: Transfer-Encoding: chunked Nov 24 17:23:32 mx01 http[12306]: Set-Cookie: sequence=REDACTED Nov 24 17:23:32 mx01 http[12306]: Nov 24 17:23:32 mx01 http[12306]: 52 Nov 24 17:23:32 mx01 http[12306]: PROCESSING Nov 24 17:23:32 mx01 http[12306]: DONE Nov 24 17:23:32 mx01 http[12306]: X-ElapsedTime: 0 Nov 24 17:23:32 mx01 http[12306]: X-StartTime: Fri, 24 Nov 2023 16:23:32 GMT Nov 24 17:23:32 mx01 http[12306]: Nov 24 17:23:32 mx01 http[12306]: Nov 24 17:23:32 mx01 http[12306]: 2e Nov 24 17:23:32 mx01 http[12306]: Dumping 53 bytes Nov 24 17:23:32 mx01 http[12306]: 0000 | 00 00 00 00 00 00 00 00-b0 04 00 00 ff 01 00 00 | ................ Nov 24 17:23:32 mx01 http[12306]: 0010 | 00 02 01 6d 8c ff 10 00-00 00 01 00 00 01 1c 00 | ...m............ Nov 24 17:23:32 mx01 http[12306]: 0020 | 00 00 62 38 d5 c6 b1 0a-3b 18 00 00 00 00 0d 0a | ..b8....;....... Nov 24 17:23:32 mx01 http[12306]: 0030 | 30 0d 0a 0d 0a | 0.... Nov 24 17:23:32 mx01 http[12306]: >>-EOP

amaccuish

The whole exchange

Nov 24 19:03:42 mx01 http[12306]: << 19:03:42.105815 [::1]:48946->[::1]:10443 859 bytes
Nov 24 19:03:42 mx01 http[12306]: POST /mapi/nspi/?MailboxId=616c6578-6164-6d69-6e40-6d611c000000@XXX.XXX.XX HTTP/1.1
Nov 24 19:03:42 mx01 http[12306]: Connection: Keep-Alive
Nov 24 19:03:42 mx01 http[12306]: Host: gromoxhttp
Nov 24 19:03:42 mx01 http[12306]: Content-Length: 45
Nov 24 19:03:42 mx01 http[12306]: cache-control: no-cache
Nov 24 19:03:42 mx01 http[12306]: pragma: no-cache
Nov 24 19:03:42 mx01 http[12306]: content-type: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: accept: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: authorization: Bearer
Nov 24 19:03:42 mx01 http[12306]: user-agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.16924; Pro)
Nov 24 19:03:42 mx01 http[12306]: x-ms-cookieuri-requested: t
Nov 24 19:03:42 mx01 http[12306]: x-featureversion: 1
Nov 24 19:03:42 mx01 http[12306]: accept-auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2,PoP
Nov 24 19:03:42 mx01 http[12306]: client-request-id: {32BB89AF-49C8-4448-B5A5-5480B56D10F1}
Nov 24 19:03:42 mx01 http[12306]: x-user-identity: XXX@XXX.XXX.XX
Nov 24 19:03:42 mx01 http[12306]: x-ms-account-type: Organization
Nov 24 19:03:42 mx01 http[12306]: x-accept: application/json
Nov 24 19:03:42 mx01 http[12306]: x-clientapplication: Outlook/16.0.16924.20054
Nov 24 19:03:42 mx01 http[12306]: x-clientinfo: {77077A8E-BDD8-4F7C-AE9A-7C39AA31C6E0}:67720005
Nov 24 19:03:42 mx01 http[12306]: x-requestid: {DFA2E5F2-691C-466A-9256-800ACEE8B423}:1
Nov 24 19:03:42 mx01 http[12306]: x-requesttype: Bind
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: <<-EOH
Nov 24 19:03:42 mx01 http[12306]: << 19:03:42.107345 [::1]:48946->[::1]:10443 45 bytes
Nov 24 19:03:42 mx01 http[12306]: Dumping 45 bytes
Nov 24 19:03:42 mx01 http[12306]: 0000 | 00 00 00 00 ff 00 00 00-00 00 00 00 00 00 00 00 | ................
Nov 24 19:03:42 mx01 http[12306]: 0010 | 00 00 00 00 00 00 00 00-00 00 00 00 00 e4 04 00 | ................
Nov 24 19:03:42 mx01 http[12306]: 0020 | 00 09 04 00 00 07 04 00-00 00 00 00 00 | .............
Nov 24 19:03:42 mx01 http[12306]: <<-EOB
Nov 24 19:03:42 mx01 http[12306]: >> 19:03:42.109366 [::1]:10443->[::1]:48946 281 bytes
Nov 24 19:03:42 mx01 http[12306]: HTTP/1.1 401 Unauthorized
Nov 24 19:03:42 mx01 http[12306]: Date: Fri, 24 Nov 2023 18:03:42 GMT
Nov 24 19:03:42 mx01 http[12306]: Content-Length: 14
Nov 24 19:03:42 mx01 http[12306]: Content-Type: text/plain; charset=utf-8
Nov 24 19:03:42 mx01 http[12306]: Connection: keep-alive
Nov 24 19:03:42 mx01 http[12306]: Keep-Alive: timeout=180
Nov 24 19:03:42 mx01 http[12306]: WWW-Authenticate: Basic realm="msrpc realm", charset="utf-8"
Nov 24 19:03:42 mx01 http[12306]: WWW-Authenticate: Negotiate
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: Unauthorized
Nov 24 19:03:42 mx01 http[12306]: >>-EOP
Nov 24 19:03:42 mx01 http[12306]: ctxid=128, host=[::1]:48946 connection lost
Nov 24 19:03:42 mx01 http[12306]: << 19:03:42.175678 [::ffff:127.0.0.1]:39116->[::ffff:127.0.0.1]:10443 850 bytes
Nov 24 19:03:42 mx01 http[12306]: POST /mapi/nspi/?MailboxId=616c6578-6164-6d69-6e40-6d611c000000@XXX.XXX.XX HTTP/1.1
Nov 24 19:03:42 mx01 http[12306]: Connection: Keep-Alive
Nov 24 19:03:42 mx01 http[12306]: Host: gromoxhttp
Nov 24 19:03:42 mx01 http[12306]: Content-Length: 45
Nov 24 19:03:42 mx01 http[12306]: cache-control: no-cache
Nov 24 19:03:42 mx01 http[12306]: pragma: no-cache
Nov 24 19:03:42 mx01 http[12306]: content-type: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: accept: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: authorization: Bearer
Nov 24 19:03:42 mx01 http[12306]: user-agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.16924; Pro)
Nov 24 19:03:42 mx01 http[12306]: x-ms-cookieuri-requested: t
Nov 24 19:03:42 mx01 http[12306]: x-featureversion: 1
Nov 24 19:03:42 mx01 http[12306]: accept-auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2,PoP
Nov 24 19:03:42 mx01 http[12306]: client-request-id: {AE1970CE-FBC7-40F3-93E3-429775F90F55}
Nov 24 19:03:42 mx01 http[12306]: x-user-identity: XXX@XXX.XXX.XX
Nov 24 19:03:42 mx01 http[12306]: x-ms-negotiate: Server
Nov 24 19:03:42 mx01 http[12306]: x-accept: application/json
Nov 24 19:03:42 mx01 http[12306]: x-clientapplication: Outlook/16.0.16924.20054
Nov 24 19:03:42 mx01 http[12306]: x-clientinfo: {77077A8E-BDD8-4F7C-AE9A-7C39AA31C6E0}:67720005
Nov 24 19:03:42 mx01 http[12306]: x-requestid: {DFA2E5F2-691C-466A-9256-800ACEE8B423}:2
Nov 24 19:03:42 mx01 http[12306]: x-requesttype: Bind
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: <<-EOH
Nov 24 19:03:42 mx01 http[12306]: << 19:03:42.175856 [::ffff:127.0.0.1]:39116->[::ffff:127.0.0.1]:10443 45 bytes
Nov 24 19:03:42 mx01 http[12306]: Dumping 45 bytes
Nov 24 19:03:42 mx01 http[12306]: 0000 | 00 00 00 00 ff 00 00 00-00 00 00 00 00 00 00 00 | ................
Nov 24 19:03:42 mx01 http[12306]: 0010 | 00 00 00 00 00 00 00 00-00 00 00 00 00 e4 04 00 | ................
Nov 24 19:03:42 mx01 http[12306]: 0020 | 00 09 04 00 00 07 04 00-00 00 00 00 00 | .............
Nov 24 19:03:42 mx01 http[12306]: <<-EOB
Nov 24 19:03:42 mx01 http[12306]: >> 19:03:42.176592 [::ffff:127.0.0.1]:10443->[::ffff:127.0.0.1]:39116 281 bytes
Nov 24 19:03:42 mx01 http[12306]: HTTP/1.1 401 Unauthorized
Nov 24 19:03:42 mx01 http[12306]: Date: Fri, 24 Nov 2023 18:03:42 GMT
Nov 24 19:03:42 mx01 http[12306]: Content-Length: 14
Nov 24 19:03:42 mx01 http[12306]: Content-Type: text/plain; charset=utf-8
Nov 24 19:03:42 mx01 http[12306]: Connection: keep-alive
Nov 24 19:03:42 mx01 http[12306]: Keep-Alive: timeout=180
Nov 24 19:03:42 mx01 http[12306]: WWW-Authenticate: Basic realm="msrpc realm", charset="utf-8"
Nov 24 19:03:42 mx01 http[12306]: WWW-Authenticate: Negotiate
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: Unauthorized
Nov 24 19:03:42 mx01 http[12306]: >>-EOP
Nov 24 19:03:42 mx01 http[12306]: ctxid=129, host=[::ffff:127.0.0.1]:39116 connection lost
Nov 24 19:03:42 mx01 http[12306]: << 19:03:42.866191 [::1]:48958->[::1]:10443 6137 bytes
Nov 24 19:03:42 mx01 http[12306]: POST /mapi/nspi/?MailboxId=616c6578-6164-6d69-6e40-6d611c000000@XXX.XXX.XX HTTP/1.1
Nov 24 19:03:42 mx01 http[12306]: Connection: Keep-Alive
Nov 24 19:03:42 mx01 http[12306]: Host: gromoxhttp
Nov 24 19:03:42 mx01 http[12306]: Content-Length: 45
Nov 24 19:03:42 mx01 http[12306]: Cache-Control: no-cache
Nov 24 19:03:42 mx01 http[12306]: Pragma: no-cache
Nov 24 19:03:42 mx01 http[12306]: Content-Type: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: Accept: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.16924; Pro)
Nov 24 19:03:42 mx01 http[12306]: Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2,PoP
Nov 24 19:03:42 mx01 http[12306]: Client-Request-Id: {D2E6D108-CB90-4C2B-A1EF-2ACAB9A67318}
Nov 24 19:03:42 mx01 http[12306]: X-User-Identity: XXX@XXX.XXX.XX
Nov 24 19:03:42 mx01 http[12306]: X-MS-Negotiate: Server
Nov 24 19:03:42 mx01 http[12306]: X-Accept: application/json
Nov 24 19:03:42 mx01 http[12306]: X-ClientApplication: Outlook/16.0.16924.20054
Nov 24 19:03:42 mx01 http[12306]: X-ClientInfo: {77077A8E-BDD8-4F7C-AE9A-7C39AA31C6E0}:67720005
Nov 24 19:03:42 mx01 http[12306]: X-RequestId: {DFA2E5F2-691C-466A-9256-800ACEE8B423}:3
Nov 24 19:03:42 mx01 http[12306]: X-RequestType: Bind
Nov 24 19:03:42 mx01 http[12306]: Authorization: Negotiate REDACTED
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: Dumping 45 bytes
Nov 24 19:03:42 mx01 http[12306]: 0000 | 00 00 00 00 ff 00 00 00-00 00 00 00 00 00 00 00 | ................
Nov 24 19:03:42 mx01 http[12306]: 0010 | 00 00 00 00 00 00 00 00-00 00 00 00 00 e4 04 00 | ................
Nov 24 19:03:42 mx01 http[12306]: 0020 | 00 09 04 00 00 07 04 00-00 00 00 00 00 | .............
Nov 24 19:03:42 mx01 http[12306]: <<-EOH
Nov 24 19:03:42 mx01 http[12306]: krb service principal = "HTTP@XXX.XXX.XXX.XXX"
Nov 24 19:03:42 mx01 http[12306]: Kerberos username: XXX@XXX.XXX.XX
Nov 24 19:03:42 mx01 http[12306]: Entering nsp_interface_bind: {container=0h record=0h delta=0 fpos=0/0}
Nov 24 19:03:42 mx01 http[12306]: Leaving nsp_interface_bind: {container=0h record=0h delta=0 fpos=0/0}
Nov 24 19:03:42 mx01 http[12306]: >> 19:03:42.879114 [::1]:10443->[::1]:48958 636 bytes
Nov 24 19:03:42 mx01 http[12306]: HTTP/1.1 200 OK
Nov 24 19:03:42 mx01 http[12306]: Cache-Control: private
Nov 24 19:03:42 mx01 http[12306]: Content-Type: application/mapi-http
Nov 24 19:03:42 mx01 http[12306]: X-RequestType: bind
Nov 24 19:03:42 mx01 http[12306]: X-RequestId: {DFA2E5F2-691C-466A-9256-800ACEE8B423}:3
Nov 24 19:03:42 mx01 http[12306]: X-ClientInfo: {77077A8E-BDD8-4F7C-AE9A-7C39AA31C6E0}:67720005
Nov 24 19:03:42 mx01 http[12306]: X-ResponseCode: 0
Nov 24 19:03:42 mx01 http[12306]: X-PendingPeriod: 30000
Nov 24 19:03:42 mx01 http[12306]: X-ExpirationInfo: 900000
Nov 24 19:03:42 mx01 http[12306]: X-ServerApplication: Exchange/15.00.0847.4040
Nov 24 19:03:42 mx01 http[12306]: Date: Fri, 24 Nov 2023 18:03:42 GMT
Nov 24 19:03:42 mx01 http[12306]: Set-Cookie: sid=XXX
Nov 24 19:03:42 mx01 http[12306]: Transfer-Encoding: chunked
Nov 24 19:03:42 mx01 http[12306]: Set-Cookie: sequence=XXX
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: 52
Nov 24 19:03:42 mx01 http[12306]: PROCESSING
Nov 24 19:03:42 mx01 http[12306]: DONE
Nov 24 19:03:42 mx01 http[12306]: X-ElapsedTime: 0
Nov 24 19:03:42 mx01 http[12306]: X-StartTime: Fri, 24 Nov 2023 18:03:42 GMT
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]:
Nov 24 19:03:42 mx01 http[12306]: 1c
Nov 24 19:03:42 mx01 http[12306]: Dumping 35 bytes
Nov 24 19:03:42 mx01 http[12306]: 0000 | 00 00 00 00 00 00 00 00-9c 54 df 4d e3 21 46 43 | .........T.M.!FC
Nov 24 19:03:42 mx01 http[12306]: 0010 | 8e 2c d9 bc b9 73 58 1f-00 00 00 00 0d 0a 30 0d | .,...sX.......0.
Nov 24 19:03:42 mx01 http[12306]: 0020 | 0a 0d 0a | ...
Nov 24 19:03:42 mx01 http[12306]: >>-EOP
Nov 24 19:03:42 mx01 http[12306]: user=XXX@XXX.XXX.XX, host=[::1]:48958 connection lost