SSO + wna falls into KDC_ERR_S_PRINCIPAL_UNKNOWN

Thanks much for your reply,
I'm using OAS/OC4J v 10.1.2.0.2 (oc4j build number 050812.1879)
You are true, I executed kinit successfully. My conclusion "kerberos ticket is not used" is based on 362313.1 :"...The above value starts "NTLMSSP..." whitch means that the browser is returning the user NTLM authentication. A kerberos ticket is a lot larger...." as well as on win kerberos error event mentioned above.
I try login to oiddas through SSO. I set up a logging (-Dsun.security.krb5.debug=true, -Djazn.debug.log.enable=true,...). j2ee-logging turn on TRACE doesn't bring me more info (or i'm not sure what looking for).
It looks more like win2k/AD/IE issue than RHEL/oas.

There is one thing I'm not sure about. Win2k+AD+IE and RHEL+OAS are accessible on domain "domain", but Win2k+AD+IE also has it own domain called "TEST" (because I cannot use production right domain AD), IE user is loged in TEST domain :

D:\>ipconfig /all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : AD
Primary DNS Suffix . . . . . . . : TEST
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : TEST

But SSO withou WNA (directly entered login/password TEST$user) works fine.

Any help will be appritiated.

William

Some additional OAS logs:
---------------
07/03/08 12:41:14 DAS servlet init exit
07/03/08 12:41:15 Initiating the Kerberos authenticator.
07/03/08 12:41:15 Kerberos service name: HTTP@host.domain
07/03/08 12:41:15 Fallback support: true
07/03/08 12:41:15 Windows domain separator char: $
07/03/08 12:41:15 JAZN Config object: [JAZNConfig file:/oracle/asdb/j2ee/OC4J_SECURITY/application-deployments/sso/]
07/03/08 12:41:15 Getting creds for HTTP/host.domain@TEST...
07/03/08 12:41:15 JAAS: LoginConfigProvider: JAZNConfig=[JAZNConfig file:/oracle/asdb/j2ee/OC4J_SECURITY/config/jazn.xml]
07/03/08 12:41:15 JAAS: LoginConfigProvider=oracle.security.jazn.spi.xml.XMLLoginModuleManager@2c17f7
07/03/08 12:41:15 Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null KeyTab is /oracle/asdb/
j2ee/OC4J_SECURITY/config/ws19163.keytab refreshKrb5Config is false principal is HTTP/host.domain tryFirstPass is false useFirstPass is fa
lse storePass is false clearPass is false

KeyTab: load() entry length: 54

07/03/08 12:41:15 >>> KeyTabInputStream, readName(): TEST
07/03/08 12:41:15 >>> KeyTabInputStream, readName(): HTTP
07/03/08 12:41:15 >>> KeyTabInputStream, readName(): host.domain
07/03/08 12:41:15 principal's key obtained from the keytab
07/03/08 12:41:15 principal is HTTP/host.domain@TEST
07/03/08 12:41:15 >>> EType: sun.security.krb5.internal.crypto.DesCbcCrcEType
07/03/08 12:41:15 >>>crc32: 92da59ea
07/03/08 12:41:15 >>>crc32: 10010010110110100101100111101010
07/03/08 12:41:15 >>> KrbAsReq calling createMessage
07/03/08 12:41:15 >>> KrbAsReq in createMessage
07/03/08 12:41:15 >>> KrbAsReq etypes are: 3 1

KrbKdcReq send: kdc=ad.domain UDP:88, timeout=30000, number of retries =3, #bytes=219

07/03/08 12:41:15 >>> KDCCommunication: kdc=ad.domain UDP:88, timeout=30000,Attempt =1, #bytes=219
07/03/08 12:41:16 >>> KrbKdcReq send: #bytes read=1273
07/03/08 12:41:16 >>> KrbKdcReq send: #bytes read=1273
07/03/08 12:41:16 >>> EType: sun.security.krb5.internal.crypto.DesCbcMd5EType
07/03/08 12:41:16 >>> KrbAsRep cons in KrbAsReq.getReply HTTP/host.domain
07/03/08 12:41:16 Added server's keyKerberos Principal HTTP/host.domain@TESTKey Version 1key EncryptionKey: keyType=1 keyBytes (hex dump)
=
0000: DF CD FB E6 54 64 F2 FD

07/03/08 12:41:16 [Krb5LoginModule] added Krb5Principal HTTP/host.domain@TEST to Subject
07/03/08 12:41:16 Commit Succeeded

07/03/08 12:41:16 Found key for HTTP/host.domain@TEST
07/03/08 12:41:16 Getting creds for HTTP/host.domain@TEST done
07/03/08 12:41:16 SSOLoginServlet.init: Starting up SSO server ...
07/03/08 12:41:16 Initilize NLS utility...
07/03/08 12:41:16 Reading SSO server policy....
07/03/08 12:41:16 SSO: Entered FilePolicyManager constructor ...
07/03/08 12:41:16 SSO: FilePolicyManager: done loading the /oracle/asdb/sso/conf/policy.properties file
07/03/08 12:41:16 SSO: Leaving FilePolicyManager constructor ...
07/03/08 12:41:16 SSODebug: Done loading the debug file, /oracle/asdb/sso/log/ssoServer.log
07/03/08 12:41:18 SSOLoginServlet.init: SSO server started
07/03/08 12:41:19 Oracle Application Server Containers for J2EE 10g (10.1.2.0.2) initialized
----end of init
----IE request
07/03/08 12:59:07 Browser type: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 2.0.50727)
07/03/08 12:59:07 Browser OS supports Kerberos WNA.
07/03/08 12:59:07 Browser is IE
07/03/08 12:59:07 IE browser version = 5.5
07/03/08 12:59:07 Browser supports Kerberos WNA.
07/03/08 12:59:07 Doing SPNEGO negotiation with the browser ...
07/03/08 12:59:07 Authorization header was not sent from the browser.
07/03/08 12:59:07 Sending WWW-Authenticate request ...
07/03/08 12:59:07 Sending SPNEGO request.
07/03/08 12:59:07 Browser type: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 2.0.50727)
07/03/08 12:59:07 Browser OS supports Kerberos WNA.
07/03/08 12:59:07 Browser is IE
07/03/08 12:59:07 IE browser version = 5.5
07/03/08 12:59:07 Browser supports Kerberos WNA.
07/03/08 12:59:07 Doing SPNEGO negotiation with the browser ...
07/03/08 12:59:07 Authorization header sent from the browser: Negotiate TlRMTVNTUAABAAAAB7IAogUABQAwAAAACAAIACgAAAAFAJMIAAAAD1NXQ1owMDExS0NFTlQ
=
07/03/08 12:59:07 Fallback Authentication enabled. Retrieving basic auth header.
07/03/08 12:59:07 Received NTLM token. Sending request for fallback authentication.
07/03/08 12:59:07 kerberos principal retrieved: {{UNAUTH_USER}}
07/03/08 12:59:07 KERBE_DUMMY_USER retrieved. Trying Fallback Authentication.
---------------

Hi

it seems to be problem with "$" in service (or target) principal

ssoHost.domain$@REALM

but I have no idea why "$" is there. I think this string is composed in IE, not in OAS, based on requesting URL and current web client domain(?).

When I try execute kinit with service name (with $ at the end) missing domain specification, domain is added :

c:\share>kinit HTTP/ssoHost.domain$
Password for HTTP/ssoHost.domain$@REALM:

I get same wrong service name and kinit failed.

In kerberos error log (windows event viewer) is record:
Target Name: ssoHost.domain$@REALM
this should be the SPN registered through "setspn" or "ktpass" commands. I'm able register SPN with additional dollar sign, but there is also missing "service-class" part, like:

HTTP/ssoHost.domain$@REALM

(wiht or without $). I don't know why IE doesn't use HTTP/ (or HOST/) prefix.

I'm using kerbtray, there is no ticket form ssoHost because i have never obtain any. There are TGT and some other tickets like "krbtgt/DOMAIN", "ldap/HOST.DOMAIN/DOMAIN" or "HOST$".