Thanks, I was getting the error... > Key version number for principal in key table is incorrect Apparently, when generating the keytab, specifying the kvno number does not work. It must auto increment regardless of what you specify. I generated and uploaded a new keytab, and the 500 errors are gone. The certificate also works, its showing the correct username under getClientPrincipalName I just need to figure out why its trying to login to the server using the TMs principle name, rather then the client. Cheers ... View more

I have request logging enabled, but its not much help.  This is an example of the output, I changed it to stingray extended format. -|10.25.6.238|GET /|-|500|-|630|-|-|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) -|10.25.6.238|GET /alfresco/|-|500|-|630|JSESSIONID=1E02ADBF9F015C728749F2BB2E75B0C0|-|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) -|10.25.6.238|GET /share/|-|500|-|630|JSESSIONID=7490CC6D7E17B504DFE98F60902EC013; _alfTest=_alfTest; alfLogin=1410773796|-|Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3) The Client certificate is a standard User certificate from AD Certificate Services.  I will need to look a bit deeper to see if it uses the correct OIDs etc. I've also added a traffic script to dump all the headers, and the User Principle Name is not part of it. This must be where its going wrong.  Cheers ... View more