i. Right-click the user in the Users tree and select Properties. The User Properties form will open.

ii. Navigate to the Account tab. Under the Account options section, ensure the followings are selected: User cannot change password, Password never expires, Do not require Kerberos preauthentication.

i. Uncomment these lines. If the value of these parameters is "des3-hmac-sha1", change it into rc4-hmac.

default_tgs_enctypes = rc4-hmac
default_tkt_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac

ii. Add EXAMPLE.COM as a default realm, then add EXAMPLE.COM to the list of realms (and remove the remains of realms - not mandatory). The content looks like:

[libdefaults]
	default_realm = EXAMPLE.COM

	# The following krb5.conf variables are only for MIT Kerberos.
		krb4_config = /etc/krb.conf
		krb4_realms = /etc/krb.realms
		kdc_timesync = 1
		ccache_type = 4
		forwardable = true
		proxiable = true

	# The following encryption type specification will be used by MIT Kerberos
	# if uncommented.  In general, the defaults in the MIT Kerberos code are
	# correct and overriding these specifications only serves to disable new
	# encryption types as they are added, creating interoperability problems.
	#
	# The only time when you might need to uncomment these lines and change
	# the enctypes is if you have local software that will break on ticket
	# caches containing ticket encryption types it doesn't know about (such as
	# old versions of Sun Java).

		default_tgs_enctypes = rc4-hmac
		default_tkt_enctypes = rc4-hmac
		permitted_enctypes = rc4-hmac

	# The following libdefaults parameters are only for Heimdal Kerberos.
		v4_instance_resolve = false
		v4_name_convert = {
			host = {
			rcmd = host
			ftp = ftp
			}
			plain = {
			something = something-else
			}
		}
		fcc-mit-ticketflags = true

	[realms]
		EXAMPLE.COM = {
		kdc = server.example.com
		admin_server = server.example.com
		}

	[domain_realm]
		.example.com = EXAMPLE.COM
		 example.com = EXAMPLE.COM

	[login]
		krb4_convert = true
		krb4_get_tickets = false

sudo /etc/init.d/krb5-kdc restart

sudo /etc/init.d/krb5-admin-server restart

i. Start an interactive 'kadmin' session and create the necessary Principals.

sudo kadmin.local

ii. Add the eXo Platform machine and keytab file that need to be authenticated.

iii. Add the default eXo Platform user account(s).

addprinc root

You will be asked to enter a password for the user account(s) that you need to remember to use later.

If the setup works well, you are asked to enter the password created for the 'root' user in Step 7. Without -A, the Kerberos ticket validation involves reverse DNS lookups, which may cause trouble to your debug (if your network's DNS setup is not great). Thus, the -A option is recommended in the development setup, but should be avoided in the production environment.

After successful login to Kerberos, you can see your Kerberos ticket when using the klist command.

If you want to log out and destroy your ticket, use the kdestroy command.