1

Small issue with realmd,
I use realm join with a kerberos token generated before the join,
it's working fine on a simple Active Directory Configuration
My issue is when realm join must join a domain with a kerberos token from a cross domain authentication mechanism

Let's say I have two domains:
A.grp and B.com
there is a trust relationship between A and B (the users in A can be authenticated within the B domain)
which would be in krb5.conf something like this:

[realms]
A.GRP ={
        kdc = DC01.A.GRP
        kdc = DC02.A.GRP
        default_domain = a.grp
        admin_server = DC01.A.GRP
}
B.COM = {
  kdc = DC01.B.COM
  default_domain = B.COM
  admin_server = DC01.B.COM
}
[capaths]
A.GRP = {
  B.COM
}

The kerberos token is created for a user admin@a.grp
And the join is on B.COM like :

 join b.com  

but realm create it's own krb5.conf that only point out to B.COM that trigger this kind of error :

Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-g6wFw4/krb5.d/adcli-krb5-conf-kJS7Pm
! Couldn't authenticate as machine account: MACHINE01: Client 'MACHINE01$@B.COM' not found in Kerberos database

How could I tell realm to use a cross domain authentication?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.