Jean Figarella via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Hello all,
In a IdM + AD trust setup; has anyone ever had the need to restrict
IPA client logins to a specific Active Directory server when using
their AD credentials?
The problem I am having is that the one of my clients has a AD cluster
and some of the kdc servers in that cluster have clocks that are not
synchronized. Whenever someone tries to log in using their AD account,
if they hit a un-synchronized server then they get hit with the
"kinit: clock skew too great ..." error.
Since we don't control the AD server and since they refused to fix
their time sync issues, I have been trying to restrict AD logins to a
specific kdc server, but have been unable to do it. I have tried to
edit the sssd.conf and krb5.conf configuration files, but nothing
seems to work.
What do the Windows-AD users do? Same problem?
One possibility might be to edit the `clockskew` variable in libdefaults
of krb5.conf. I usually recommend against this because it makes things
more confusing, but it may help.
In this case, I believe SSSD is providing the AD addresses, which will
be used in preference to any `kdc = ...` lines in krb5.conf. Perhaps
one of the SSSD folk can comment on the problem you're having?
Thanks,
--Robbie