On Mon, 2011-10-03 at 16:57 -0400, Stephen Gallagher wrote:
On Mon, 2011-10-03 at 22:47 +0200, Andy Kannberg wrote:
> Hi again,
>
>
> After a few hours of trial and error, I've figured it out and got it
> working. Well, partly that is.
> We use LDAP(Novell eDirectory) primary as identity vault and
> Kerberos(AD) for primary authentication source and LDAP as fallback
> authentication source.
> So, I've disabled Kerberos in SSSD, as our develop and test systems
> are not known by the KDC (no keytab file)
This should be irrelevant. You shouldn't need a keytab file to talk to
kerberos for user authentication (though without one you won't gain
GSSAPI single-sign-on for SSH).
We do validation by default, so a keytab is needed.
Simo.
--
Simo Sorce * Red Hat, Inc * New York