Hi Jakub,

On Dec 18, 2013, at 03:35 AM, Jakub Hrozek <jhrozek@redhat.com> wrote:

On Wed, Dec 18, 2013 at 09:42:48AM +0100, Sumit Bose wrote:
On Wed, Dec 18, 2013 at 12:54:37AM +0000, Bryan Harris wrote:
> Here is my output from klist -ke :
> root@client:~# klist -ke
> Keytab name: WRFILE:/etc/krb5.keytab
> KVNO Principal
> ---- --------------------------------------------------------------------------
>    5 host/server.domain.local@DOMAIN.LOCAL (DES cbc mode with CRC-32)
>    5 host/server.domain.local@DOMAIN.LOCAL (DES cbc mode with RSA-MD5)
>    5 host/server.domain.local@DOMAIN.LOCAL (ArcFour with HMAC/md5)
>    5 host/server.domain.local@DOMAIN.LOCAL (AES-256 CTS mode with 96-bit SHA-1 HMAC)
>    5 host/server.domain.local@DOMAIN.LOCAL (AES-128 CTS mode with 96-bit SHA-1 HMAC)
You need CLIENT$@AD.EXAMPLE.COM in the keytab as well. Any chance you
used -setupn with the ktpass command? If yes, please try without.

btw keytabs that are generated with Samba or realmd should already
contain this principal. In general, I think using Samba or realmd is
even easier and should be recommended.
 
When I try using the commands from the guide for using Samba, this is the output I receive for doing with -U Administrator (see below for -k method).

net ads join -U Administrator
Enter Administrator's password:
[2013/12/18 16:35:48.221674,  0] libads/sasl.c:821(ads_sasl_spnego_bind)
  kinit succeeded but ads_sasl_spnego_krb5_bind failed: Invalid credentials
Failed to join domain: failed to connect to AD: Invalid credentials

When I try using the -k method, this is the output.

kinit administrator
Password for administrator@DOMAIN.LOCAL:
root@client:/var/log/sssd# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@DOMAIN.LOCAL

Valid starting     Expires            Service principal
12/18/13 16:34:33  12/19/13 02:34:34  krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
        renew until 12/25/13 16:34:33
root@client:/var/log/sssd# net ads join -k
Failed to join domain: failed to lookup DC info for domain 'DOMAIN.LOCAL' over rpc: Logon failure


Any ideas?  Do you think it means I have a firewall problem?  It lets me have a kerberos ticket at least, I guess that's good?

Bryan