ldap authentication: Using mod_auth_kerb with CentOS to accomplish Active Directory SSO

I have a setup with an Active Directory KDC, Windows 7 client workstations, and a Linux server (CentOS and Apache) outside the network with which I am trying to configure single sign on functionality. I'm having trouble getting the handshake to work between the client workstation and the Apache webserver. When I go to https://cname.mysite.com/user/login/sso, I get a 500 internal server error. I configured Firefox by going to "about:config" and adding "cname.mysite.com" to "network.negotiate-auth.trusted-uris" and "network.negotiate-auth.delegation-uris". I figured I would have to configure the browser with the A Record instead of the CName, but when I do this I just get a 401 authorization required error and not much else happens (same as if I didn't configure browser for kerberos at all). When the browser is configured with the CName, I get the 500 error and couple of interesting things happen:

1) If I'm on a workstation within the network, I get a ticket for the service that appears to be correct. A klist looks like this:

Cached Ticket (#2 of 7)
Client: active_directory_user@EXAMPLE.ORG
Server: HTTP/arecord.mysite.com@EXAMPLE.ORG
KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
Ticket Flags 0x40a00000 -> forwardable renewable pre_authent
Start Time: 10/24/2013 15:16:14 (local)
End Time: 10/25/2013 0:11:33 (local)
Renew Time: 10/31/2013 14:11:33 (local)
Session Key Type: RSADSI RC4-HMAC(NT)

2) I see the following in the Apache error logs:

"GSS-API major_status:000d0000, minor_status:000186a4" which I understand to simply mean that Apache can't read the keytab file.

"gss_acquire_cred() failed: Unspecified GSS failure. Minor code may provide more information (, )" which could mean the keytab has the wrong key version #, or machine password. It could also be a problem with the ticket cache on the workstation.

I've tried to make it so Apache can read the keytab file by changing its ownership to the user that owns the httpd Apache process (chown root) and making sure that it is readable by that user (chmod 400). However when I do this, the command to test if the keytab works on the webserver (kinit -k -t /etc/krb5.keytab HTTP/arecord.mysite.com) no longer finishes without error. Instead I receive "kinit: Generic preauthentication failure while getting initial credentials".

Here is some additional info about our setup:

If I do "kinit active_directory_user" from the webserver, I get prompted for a password and when entered correctly it completes without error. I can then use "klist" to view what appears to be a proper ticket granting ticket (service principal = krbtgt/EXAMPE.ORG@EXAMPLE.ORG).

I can then do "kvno HTTP/arecord.mysite.com" and I receive "HTTP/arecord.mysite.com@EXAMPLE.ORG: kvno = 6". I then check this against the keytab via "klist -k" and the kvno and principal match exactly. This also caches a service ticket so "klist" reveals a second ticket with HTTP/arecord.mysite.com@EXAMPLE.ORG as the service principal.

Finally I test if the keytab works on the server using: "kinit -k -t /etc/krb5.keytab HTTP/arecord.mysite.com" and it completes without error (unless the keytab user is changed to root as mentioned above).

Here is the configuration of our /etc/krb5.conf file (I recently stripped this down in hopes to fix the issue):

[libdefaults]
 default_realm = EXAMPLE.ORG

[domain_realm]
 arecord.mysite.com = EXAMPLE.ORG

[realms]
 EXAMPLE.ORG = {
  admin_server = ip address of dc/kdc
  kdc = ip address of dc/kdc
 }

Our webserver uses virtual hosts to host multiple websites. So the httpd.conf file uses "include" to reference to another site specific .conf file where I added this mod_auth_kerb logic:

 LoadModule auth_kerb_module /path/to/modules/mod_auth_kerb.so
 <Location /user/login/sso>
    AuthType Kerberos
    KrbAuthRealms EXAMPLE.ORG
    KrbMethodNegotiate on
    KrbMethodK5Passwd off
    KrbServiceName HTTP/arecord.mysite.com@EXAMPLE.ORG
    Krb5Keytab /etc/krb5.keytab
    require valid-user
  </Location>

I worked with the IT staff that maintains the Active Directory Domain Controller (the KDC in this case) to create a keytab file using ktpass:

ktpass /pass <password for account> /mapuser <username for account> /out c:\location\of\file\output\krb5.keytab /princ HTTP/arecord.mysite.com@EXAMPLE.ORG /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT /Target EXAMPLE.ORG

I also asked them to use "setspn -q HTTP/arecord.mysite.com" on the Active Directory DC to check for duplicate SPNs and it returns "Existing SPN Found!" which I believe means that it is okay. There are two SPN's listed however: HTTP/arecord.mysite.com@EXAMPLE.ORG and HTTPS/arecord.mysite.com@EXAMPLE.ORG because the first time we created the keytab, we didn't realize the host (HTTP in this case) referred to a service class that encompasses both the HTTP and HTTPS protocols.

Things that are done:
-synched clocks between AD server and Apache server via NTP (Luigi The Cat's post was helpful: http://community.spiceworks.com/topic/143891-possible-to-synchronize-ntp...)
-had our IP provider set up a PTR record that points the webserver's IP to the A Record for the site.

Things I've tried:
-moving the keytab record higher up in the directory structure
-reinstalling mod_auth_kerb from source: http://sourceforge.net/projects/modauthkerb/files/ and according to instructions: http://modauthkerb.sourceforge.net/install.html
-increasing the permissions for keytab file
-disabling SElinux

My setup closely resembles this closed issue: https://drupal.org/node/1777528#comment-form

I have been following advice from these guides:
http://www.grolmsnet.de/kerbtut/
http://acksyn.org/?p=460

These have been helpful for debugging errors:
http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%...
http://blog.stefan-macke.com/2011/04/19/single-sign-on-with-kerberos-usi...

Any advice is appreciated, please let me know if I need to provide additional information or test anything. Thanks so much!