NFs mount works :-) if I change hostname-> shortname('client').
Now I would try to obtain service principal 'nfs/client.domain.org(a)DOMAIN.ORG'
and try it again with hostname->fqdn(client.domain.org).
It is quite logic not have FQDN$ principals in Kerberos (+ long names limit problem)
Thanks again for all the enlightment!
Best
Longina
-----Original Message-----
From: sssd-users-bounces(a)lists.fedorahosted.org
[mailto:sssd-users-bounces@lists.fedorahosted.org] On Behalf Of John Hodrien
Sent: 12. februar 2014 11:02
To: End-user discussions about the System Security Services Daemon
Subject: Re: [SSSD-users] sssd-1.11.1 Saucy automount(nfs4+krb problem)
On Wed, 12 Feb 2014, Longina Przybyszewska wrote:
Do I miss something in getting point here:
If there is a key for the principal
'host/client.domain.org(a)DOMAIN.ORG' in local /etc/krb5.keytab -
why there are no credentials in Kerberos database?
ServicePrincipal vs UserPrincipal. In AD, you can add as many service principals as you
like (net ads keytab add blah), but these are only useful for services, as they can't
get a Ticket Granting Ticket. NFS is unusual in needing a tgt. So you have ones like
host/fqdn which can be used by ssh. You get one user principal for free with AD, which is
'shorthostname$'. That can generate a TGT (i.e. you can use kinit with it).
You're allowed one other, which you can generate with samba via 'net ads join
createupn='something/fqdn'. This can be useful for services that need it, that
don't know to use the other one. So you can use that with nfs to make it all happy
that way, by making the nfs/fqdn principal able to request a tgt.
Is this because for NFS4 service machine asks, there is need for
credentials for machine principal, the one ending with “$”, and
rpc.gssd
asks about CLIENT.DOMAIN.ORG$(a)DOMAIN.ORG instead of
CLIENT$(a)DOMAIN.ORG
and that question depends on what ‘hostname’ returns?
hostname should always return the full hostname, and hostname -s should return the short
host name. I'd really not change that to fix this problem.
jh