Long story short, we had to redeploy part of our FreeIPA cluster. As far as I know I followed all of the proper procedures and everything seems to be working from the client side however we are getting a TON of these messages in krb5kdc.log

ipa3.example.com krb5kdc[31232](info): TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.6.21.19: LOOKING_UP_SERVER: authtime 0,  host/client100.example.com@EXAMPLE.COM for nfs/nfs1.example.com@EXAMPLE.COM, Server not found in Kerberos database

client100.example.com has working forward and reverse DNS entries that resolve from all FreeIPA servers and from itself.

nfs1.example.com has working forward and reverse entries that resolve from all FreeIPA servers and from itself, it is not part of the FreeIPA domain at all, it is still using the authentication we are replacing with FreeIPA. It is used for automount homedirs in FreeIPA but is not kerberized

All of the clients reporting this error still properly automount homedirs and that is the only thing on nfs1.example.com. There is another mountpoint, also not kerberized, in the automount setup that is not throwing any errors and access extremely frequently.

I am happy to provide any logs necessary to track this down.
 
--

Mark Potter