OK, I finally took time to figure out what is going on with kinit -n. This is an issue for
us because we use one-time passwords, and kinit -n is useful for bootstrapping kinit.
* concatenate /var/kerberos/krb5kdc/kdc.crt from all of the KDC’s, and put the resulting
file someplace on the clients. I’m using /etc/kdc.crt.
* make sure krb5_pkinit is installed. It wasn’t on our systems, as none of the
instructions for installing ipa client mentioned it.
* in /etc/krb5.conf change the pkinit_anchors line
pkinit_anchors = FILE:/etc/kdc.crt
Of course you could avoid changing pkinit_anchors by putting the file in whatever location
it currently points to.
Is this somehow automated in ipa-client-install? We recently upgraded the servers to 4.5
but haven’t done ipa-client-install since.