# \[KERBEROS\]\[SSO\]\[WINDOWS AD\] KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException

**URL:** <https://forum.keycloak.org/t/kerberos-sso-windows-ad-kc-services0013-failed-authentication-org-keycloak-authentication-authenticationflowexception/8150>\
**Category:** Configuring the server\
**Tags:** ldap\
**Created:** [March 25, 2021, 8:22pm UTC](https://forum.keycloak.org/t/kerberos-sso-windows-ad-kc-services0013-failed-authentication-org-keycloak-authentication-authenticationflowexception/8150 "2021-03-25T20:22:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bvivi57](https://avatars.discourse-cdn.com/v4/letter/b/839c29/32.png) [@bvivi57](https://forum.keycloak.org/u/bvivi57)\
**Post date:** [March 25, 2021, 8:22pm UTC](https://forum.keycloak.org/t/kerberos-sso-windows-ad-kc-services0013-failed-authentication-org-keycloak-authentication-authenticationflowexception/8150/1 "2021-03-25T20:22:35Z")

</div>

Hi

I’m trying to implement keycloak:12.0.4 under kubernetes to be able to authenticate to an application from my windows session on an AD domain member PC. I would like to leverage kerberos to have an SSO login.

My AD domain is **coolcorp.priv**

I have created a **svc-key-sso** service account in the directory

I have created a keytab via the following command

**ktpass -out keycloak.keytab -princ HTTP/keycloak.coolcorp.priv@COOLCORP.PRIV -mapUser svc-key-sso@coolcorp.priv -pass mypassword -ptype KRB5\_NT\_PRINCIPAL -crypto AES256-SHA1**

My keycloak server responds to the URL **[https://keycloak.coolcorp.priv](https://keycloak.coolcorp.priv)**

I was able to successfully configure an LDAP provider and import my users.  
I have activated the Kerberos integration

**Kerberos Realm: COOLCORP.PRIV**

**Server Principal: HTTP/keycloak.coolcorp.priv@COOLCORP.PRIV**

**KeyTab: /etc/config/keycloak.keytab**

**Use Kerberos For Password**

In the authentication menu, if I leave kerberos and cookie as alternatives, I can authenticate with my AD account.

However, if I force kerberos and cookie, I get the following error message when I try to authenticate.

> 20:07:00,466 WARN [org.keycloak.events] (default task-21) type=LOGIN\_ERROR, realmId=coolcorp, clientId=account-console, userId=null, ipAddress=192.168.10.45, error=invalid\_user\_credentials, auth\_method=openid-connect, auth\_type=code, response\_type=code, redirect\_uri=[https://keycloak.coolcorp.priv/auth/realms/coolcorp/account/#/](https://keycloak.coolcorp.priv/auth/realms/coolcorp/account/#/), code\_id=ef18b002-b691-4b34-aa42-40fa3cf8279d, response\_mode=fragment, authSessionParentId=ef18b002-b691-4b34-aa42-40fa3cf8279d, authSessionTabId=9QddNNi2b2U  
> 20:07:05,149 WARN [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-26) REQUIRED and ALTERNATIVE elements at same level! Those alternative executions will be ignored: [identity-provider-redirector]  
> 20:07:05,150 WARN [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-26) REQUIRED and ALTERNATIVE elements at same level! Those alternative executions will be ignored: [identity-provider-redirector]  
> 20:07:05,150 WARN [org.keycloak.services] (default task-26) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException

I tried a lot of settings. I can’t get kerberos/SSO to work

Could you help me or tell me what I could have missed.

Thanks

---

<div class="post-metadata">

**Author:** ![sirribakirtan](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@sirribakirtan](https://forum.keycloak.org/u/sirribakirtan)\
**Post date:** [February 21, 2023, 7:22am UTC](https://forum.keycloak.org/t/kerberos-sso-windows-ad-kc-services0013-failed-authentication-org-keycloak-authentication-authenticationflowexception/8150/2 "2023-02-21T07:22:29Z")

</div>

Dİd you find anything?