Hello Ondrej,

Can you let me know if the below commands are correct regarding the UPN?  I don't see the UPN in there anywhere but perhaps it's related to one of the other arguments?

client = linux Debian
server = AD windows

setspn -A host/client.domain.local@DOMAIN.LOCAL client
setspn -L client
ktpass /princ host/client.domain.local@DOMAIN.LOCAL /out c:\client-host.keytab /crypto all /ptype KRB5_NT_PRINCIPAL -desonly /mapuser DOMAIN\client$ /pass *

I will try to explain the DNS as exactly as I can.  The AD server has NIC1 as a public IP and NIC2 as management IP.  We are required to use NIC1 for all communication because it goes through a vGW firewall, and NIC2 is not supposed to be used except from inside the company for management.  In my resolv.conf I have placed the NIC1 public ip address, and resolution is working AFAICS.

Here is a sanitized example of a service record lookup.  I can do public name resolution such as "host google.com" and get an answer.

root@client:/var/log/sssd# host -t srv _kerberos._tcp.domain.local
_kerberos._tcp.domain.local has SRV record 0 100 88 server.domain.local.

On Dec 18, 2013, at 03:45 AM, Ondrej Valousek <ovalousek@vendavo.com> wrote:

You also do not need to have UPN set up for this to work. Save UPN for some service which really needs it (like rpc.gssd).
This kind of error usually signals problem in DNS/reverse dns resolution of the client.
Ondrej
 

Bryan