Hi,
Thank you Fabian, your suggested commands lead me to the answer and a solution!
```
[root@se-rhidm01x ~]# ldapsearch -Y GSSAPI -H
ldap://usidc1-rhidm01x.idc1.us.example.com
-b "" -s base
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.
Minor code may provide more information (Server krbtgt/EXAMPLE.COM(a)LNX.EXAMPLE.COM not
found in Kerberos database)
```
We are using
lnx.example.com as the IPA domain and not
example.com since
example.com is
already an AD domain. We did not define a Kerberos realm for the
idc1.us.example.com
domain so Kerberos defaulted to
example.com and translated it into the
EXAMPLE.COM
Kerberos realm which does exist and is reachable but it is the incorrect one for the IPA
hosts since they are using the
LNX.EXAMPLE.COM Kerberos realm.
This could be seen by using Kerberos commands on the masters.
```
[root@se-rhidm01x ~]# ldapsearch -Y GSSAPI -H
ldap://usidc1-rhidm01x.idc1.us.example.com
-b "" -s base
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.
Minor code may provide more information (Server krbtgt/EXAMPLE.COM(a)LNX.EXAMPLE.COM not
found in Kerberos database)
```
Here krbtgt/EXAMPLE.COM(a)LNX.EXAMPLE.COM should be krbtgt/LNX.EXAMPLE.COM(a)LNX.EXAMPLE.COM.
To fix this I added the following to the /etc/krb5.conf file on all the masters:
```
...
[domain_realm]
...
.idc1.us.example.com =
LNX.EXAMPLE.COM
idc1.us.example.com =
LNX.EXAMPLE.COM
...
```
Ultimately we should probably define it as such to "catch all":
```
...
[domain_realm]
.example.com =
LNX.EXAMPLE.COM
example.com =
LNX.EXAMPLE.COM
...
```
--
Markus