You might not be able to auto-discover the realm (dns_lookup_realm = true).

Have you tried manually configuring DOMAIN.NET?




[libdefaults]
  default_realm = DOMAIN.NET
  dns_lookup_realm = true
  dns_lookup_kdc = true
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 DOMAIN.NET = {
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
  }

[domain_realm]
  .domain.net = DOMAIN.NET
  domain.net = DOMAIN.NET
  client1.domain.net = DOMAIN.NET




On 2/16/22 10:09 AM, David Galarreta via FreeIPA-users wrote:
Hello!
we get the next error when we try to create a kerberos ticket:
kinit: Cannot find KDC for realm "TEST.INTERN" while getting initial credentials

/etc/krb5.conf:
[libdefaults]
  default_realm = TEST.INTERN
  dns_lookup_realm = true
  dns_lookup_kdc = true
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0
  default_ccache_name = KEYRING:persistent:%{uid}


[realms]
 TEST.INTERN = {
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
    pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
  }
[domain_realm]
  .domain.net = TEST.INTERN
  domain.net = TEST.INTERN
  client1.domain.net = TEST.INTERN

The DNS Record from FreeIPA for Autodiscover are working. if I add kdc = ipaserver.domain.net  > I get the kerberos Ticket. But we want to use autodiscovery for failover. So we do not want to add the sever address on every client.

Do you have some Idea? Thanks
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure