On Tue, Dec 17, 2013 at 12:50:47PM -0500, J. Alexander Jacocks wrote:
>
>
> "Realm not local to KDC" should be accompanied with a Kerberos client
> referral telling the client which would be the right KDC to get a
> suitable ticket. Can you send the output of
>
> KRB5_TRACE=/dev/stdout ldapsearch -H
ldap://example.org -Y GSSAPI ...
>
> to see where the request fails?
>
> Sure, here is the output:
# KRB5_TRACE=/dev/stdout ldapsearch -H
ldap://dc001.example.org -Y GSSAPI
-N -b dc=example,dc=org "(&(objectClass=user)(sAMAccountName=username))"
SASL/GSSAPI authentication started
[15321] 1387302064.607342: ccselect can't find appropriate cache for server
principal ldap/dc001.example.org(a)EXAMPLE.ORG
[15321] 1387302064.607479: Retrieving host/
scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found
[15321] 1387302064.607522: Getting credentials host/
scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG -> ldap/
dc001.example.org(a)EXAMPLE.ORG using ccache FILE:/tmp/krb5cc_0
[15321] 1387302064.607644: Retrieving host/
scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG -> ldap/
dc001.example.org(a)EXAMPLE.ORG from FILE:/tmp/krb5cc_0 with result:
-1765328243/Matching credential not found
[15321] 1387302064.607874: Retrieving host/
scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG -> krbtgt/
EXAMPLE.ORG(a)PROJECT1.EXAMPLE.ORG from FILE:/tmp/krb5cc_0 with result:
0/Success
[15321] 1387302064.607893: Found cached TGT for service realm: host/
scm.project1.example.org(a)PROJECT1.EXAMPLE.ORG -> krbtgt/
EXAMPLE.ORG(a)PROJECT1.EXAMPLE.ORG
[15321] 1387302064.607904: Requesting tickets for ldap/
dc001.example.org(a)EXAMPLE.ORG, referrals on
[15321] 1387302064.607973: Generated subkey for TGS request: rc4-hmac/E967
[15321] 1387302064.607993: etypes requested in TGS request: aes256-cts,
aes128-cts, des3-cbc-sha1, rc4-hmac
[15321] 1387302064.608245: Sending request (1650 bytes) to
EXAMPLE.ORG
[15321] 1387302064.608565: Initiating TCP connection to stream
172.16.50.2:88
[15321] 1387302064.609355: Sending TCP request to stream 172.16.50.2:88
[15321] 1387302064.610199: Received answer from stream 172.16.50.2:88
[15321] 1387302064.610398: Response was from master KDC
[15321] 1387302064.610432: TGS request result: -1765328316/Realm not local
to KDC
[15321] 1387302064.610443: Requesting tickets for ldap/
dc001.example.org(a)EXAMPLE.ORG, referrals off
[15321] 1387302064.610479: Generated subkey for TGS request: rc4-hmac/3291
[15321] 1387302064.610498: etypes requested in TGS request: aes256-cts,
aes128-cts, des3-cbc-sha1, rc4-hmac
[15321] 1387302064.610636: Sending request (1650 bytes) to
EXAMPLE.ORG
[15321] 1387302064.610987: Initiating TCP connection to stream
172.16.50.2:88
[15321] 1387302064.611340: Sending TCP request to stream 172.16.50.2:88
[15321] 1387302064.611909: Received answer from stream 172.16.50.2:88
[15321] 1387302064.612016: Response was from master KDC
[15321] 1387302064.612042: TGS request result: -1765328316/Realm not local
to KDC
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Realm
not local to KDC)
The odd thing that I see here is that
EXAMPLE.ORG is not IP address
172.16.50.2. That IP address belongs to
dc001.project1.example.org. Any
thoughts on that?
yes, that's odd and would explain the issue. Please check /etc/hosts if
all entries for
are correct. If this is the case, please
check you DNS servers.
HTH
bye,
Sumit
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users