Marek Mahut

I’ve been fighting with this problem for two days. At work, we use kerberos to access most of our resources including internal websites with mod_auth_kerb. Using GSSAPI, your configured firefox should show the website if you’re owner of a valid ticket and prompt for a password one and only one time when you’re not. We had it working perfectly with a valid kerberos ticket, but each visitor without a ticket got prompted repeatedly for a password even after his first authentication. This also resulted in Request is a replay errors in Apache logs. The fix is quite easy, just explicitly set kdc_timesync in /etc/krb5.conf on the server:

[libdefaults]
kdc_timesync = 0

This value turns off the time calibration which ensures different ticket time for all threads.