On Mon, Dec 12, 2016 at 11:21:31AM -0800, Omen Wild wrote:
> Quoting Sumit Bose <sbose(a)redhat.com> on Sat, Dec 10 17:56:
> >
> > It it (again) about Kerberos ticket validation. If you set
> > 'krb5_validate = False' in the [domain/...] section of sssd.conf
> > authentication should work (with the correct password :-).
>
> Awesome, this worked!
>
> > It looks like realmd's backend (adcli or net ads) has put the
> > RestrictedKrbHost/phys-adtest(a)TOU.T3.UCDAVIS.EDU at the end of
> > /etc/krb5.keytab but the DC of
TOU.T3.UCDAVIS.EDU does not know this
> > principal. Can you check if the host entry for your host in AD has
> > servicePrincipalName entries for all entries in /etc/krb5.keytab (klist
> > -k) except for the one with the '$' at the end of the hostname?
>
> Hmmm, the host entry in AD actually has nothing in servicePrincipalName: <not
set>.
>
hmm, in theory the attribute should be filled during the join with
values matching the keytab entry. You can try to add the entries
manually. Here at least 'RestrictedKrbHost/phys-adtest' and
'RestrictedKrbHost/phys-adtest.tou.t3.ucdavis.edu' should be added.
You can check if it is working or not without SSSD by calling:
kinit aduser(a)T3.UCDAVIS.EDU
kvno RestrictedKrbHost/phys-adtest(a)TOU.T3.UCDAVIS.EDU
or
kvno 'RestrictedKrbHost/phys-adtest.tou.t3.ucdavis.edu(a)TOU.T3.UCDAVIS.EDU'
Maybe it might be better to provide content of keytab "klist -kt"
IIRC older version of sssd did not pick up right principal "SOMETHING$"
And it was fixed in newver version of sssd.
LS