We have an IPA client in the NWRA.COM realm and are trying to do a krb5 nfs mount from a Windows server in the AD.NWRA.COM realm. The two realms are connected by a two way trust. Mounting of CIFS shares works fine.
# mount -t nfs -v -o sec=krb5,vers=4.1 SERVER.ad.nwra.com:test_nfs /mnt
mount.nfs: timeout set for Mon Aug 18 16:11:46 2025
mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=10.X.X.X,clientaddr=10.X.X.X'
mount.nfs: mount(2): Permission denied
mount.nfs: access denied by server while mounting SERVER.ad.nwra.com:test_nfs
I think this is the issue:
Aug 18 16:09:48 gssproxy[1121023]: [CID 11][2025/08/18 23:09:48]: gp_rpc_execute: executing 8 (GSSX_INIT_SEC_CONTEXT) for ser
vice "nfs-client", euid: 0,socket: (null)
Aug 18 16:09:48 gssproxy[1121023]: GSSX_ARG_INIT_SEC_CONTEXT( call_ctx: { "" [ ] } context_handle: <Null> cred_handle: {
"host/CLIENT.mry.nwra.com(a)NWRA.COM" [ { "host/CLIENT.mry.nwra.com(a)NWRA.COM" { 1 2 840 113554 1 2 2 } INITIATE 84879 0 [ { [
krb5.set.allowed... ] [ ................... ] } ] } ] [ .............2..... ] 0 } target_name: "nfs(a)SERVER.ad.nwra.com"
mech_type: { 1 2 840 113554 1 2 2 } req_flags: 2 time_req: 0 input_cb: <Null> input_token: <Null> [ { [ sync.modified.cr...
] [ 64656661756c740 ] } ] )
Aug 18 16:09:48 gssproxy[1121023]: [CID 11][2025/08/18 23:09:48]: Credentials allowed by configuration
Aug 18 16:09:48 gssproxy[1121023]: GSSX_RES_INIT_SEC_CONTEXT( status: { 851968 { 1 2 840 113554 1 2 2 } 2529638919 "Unspe
cified GSS failure. Minor code may provide more information" "Server krbtgt/AD.NWRA.COM(a)NWRA.COM not found in Kerberos datab
ase" [ ] } context_handle: <Null> output_token: <Null> )
Aug 18 16:09:48 rpc.gssd[1120142]: WARNING: Failed to create krb5 context for user with uid 0 for server nfs(a)SERVER.ad.
nwra.com
Aug 18 16:09:48 rpc.gssd[1120142]: WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_NWR
A.COM for server SERVER.ad.nwra.com
Aug 18 16:09:48 rpc.gssd[1120142]: ERROR: Failed to create machine krb5 context with any credentials cache for server SERVER.ad.nwra.com
Aug 18 16:09:48 rpc.gssd[1120142]: do_error_downcall(0x7f69a33a7700): uid 0 err -13
Aug 18 16:09:48 rpc.gssd[1120142]: destroying client nfs/clnt59
Aug 18 16:09:48 rpc.gssd[1120142]: freeing client nfs/clnt59
Aug 18 16:09:48 rpc.gssd[1120142]: destroying client nfs/clnt58
Shouldn't krbtgt/AD.NWRA.COM(a)NWRA.COM be krbtgt/AD.NWRA.COM(a)AD.NWRA.COM?