Hi Josh,

Thanks for your reply.  It sounds like I should use Samba to do this step.  I did give it a try and posted my results, see my reply to Jakub.
Bryan

On Dec 18, 2013, at 03:41 AM, John Hodrien <J.H.Hodrien@leeds.ac.uk> wrote:

On Wed, 18 Dec 2013, Jakub Hrozek wrote:

btw keytabs that are generated with Samba or realmd should already
contain this principal. In general, I think using Samba or realmd is
even easier and should be recommended.

I couldn't agree more with this. Unless you're making keytabs that are
sufficiently interesting that samba or realmd can't make them, you really
don't want to complicate matters by getting your hands dirty.

It's much easier using samba to do it, significantly faster, and it's less
prone to error. They also work exactly the same if you have domain join but
not domain administrator rights. Done with samba or realmd, it's a single
line in my kickstart to join the machine to the domain and generate the
keytab, and I know it's right everytime it happens.

jh
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users