我们有一个 Windows 11 LTSC 客户端，使用 Apache2 / Kerberos / GSSAPI 进行身份验证失败。

此配置适用于我们所有的客户端，Windows 10、Windows 10 LTSC、Windows 11，但不适用于 Windows 11 LTSC。

apache2日志中的错误：

[Wed Oct 30 13:36:14.996279 2024] [auth_gssapi:error] [pid 585:tid 585] [client 192.168.202.150:50755] GSS

ERROR In Negotiate Auth: gss_accept_sec_context() failed: [An unsupported mechanism was requested (Unknown error)]

密钥表文件：

ktpass -princ HTTP/xxx.xxx.fr@XXX.FR -mapuser ssowpintranet@XXX.FR -pass StrongPassword123** -crypto All -kvno 8 -ptype KRB5_NT_PRINCIPAL -out c:\wpintranet.keytab

krb5.conf：

[libdefaults]
   default_realm = XXX.FR
   kdc_timesync = 1
   ccache_type = 4
   forwardable = false
   proxiable = false
   fcc-mit-ticketflags = false

   default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac
   default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac
   permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac
   preferred_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac


[realms]
   XXX.FR = {
     kdc = dc1.xxx.fr:88
     admin_server = dc1.xxx.fr:88
     default_domain = XXX.FR
   }
[domain_realm]
   .xxx.fr = XXX.FR
   xxx.fr = XXX.FR

apache2 配置：

.....
<IfModule !mod_auth_gssapi.c>
   LoadModule auth_gssapi_module /usr/lib64/httpd/modules/mod_auth_gssapi.so
</IfModule>
<Directory /var/www/wordpress>
   AuthType GSSAPI
   AuthName "Kerberos auth"
   GssapiCredStore keytab:/etc/apache2/wpintranet.keytab
   Require valid-user
</Directory>
.....

如果有人能帮助我。

谢谢