1

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so far:

  1. I have basic network connectivity - I can ping all of my DCs
  2. DNS is working - I am able to resolve LDAP and Kerberos SRV records
  3. I am able to connect to LDAP and LDAPS ports on my DC (tested using telnet - connection opens). I have even tried disabling the firewall completely on a DC to try and rule out the traffic being blocked
  4. when I do the command realm discover domain.com it outputs my domain information
  5. When I attempt to join the domain, I get an error:

    kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm
    

I'd appreciate any help that can be offered. I have no idea what is going on, and I've searched everywhere and damn near have read the entire realmd and sssd webpages to try and figure out what is wrong. Thanks!

EDIT

So I checked my Active Directory, and it adds the computer to the domain, yet it tells me that it fails? There is a computer object there now, but I can't do anything in terms of authentication.

I am running CentOS 7 Minimal Install

  • Things to check: 1. DNS and connectivity make sure your new server can resolve and reach the AD/KDC server(s) and vice versa. 2. Make sure AD is setup to trust your new machine and allow it to make query. 3. Make sure you are using accurate and correct name for the realm you are trying to join, and make sure the identity you are using for kinit is allowed to do the join. – Baazigar Aug 28 '15 at 17:28
  • Baazigar, 1 is good to go, I can query the name server, as well as the SRV records for all of them for ldap and kerberos. Not sure what you mean by step 2, if you don't mind elaborating. For step 3, I am able to successfully do a kinit with my Enterprise Admin account, and that account is definitely able to add computers to the domain. – jjmil03 Aug 28 '15 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.