I checked the /etc/krb5.conf on both a working and non-working machine, no differences at all. Also checked the files in /var/lib/sss/pubconf/krb5-include.d that are included by krb5.conf, and no differences there. All Kerberos packages on both machines are same versions.
klist -e Output on Jump Host (C7.4, after 2FA):
Ticket cache: FILE:/tmp/krb5cc_1001
Valid starting Expires Service principal
Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
klist -e Output on working destination host (C6.9) after login via kerberos:
Ticket cache: FILE:/tmp/krb5cc_1001
Valid starting Expires Service principal
Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
klist -e Output on failing destination host (C6.9) after failing to login with Kerberos and providing password:
Ticket cache: FILE:/tmp/krb5cc_1001_krZ6B5
Valid starting Expires Service principal
Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
Thanks for any help you can give me!
Jeremy Utley