<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000066">
Got it finally working by re-creating /etc/krb5.keytab file from the
scratch.<br>
It turned out, that I did not use Samba to join the machine to AD,
but I used Centrify.<br>
<br>
There is nothing wrong with that, the only thing is, that unlike
Samba & SSSD, Centrify does refresh principals in
/etc/krb5.keytab creating multiple principals in keytab that differ
only by the KVNO number.<br>
<br>
This is nice, but both sshd & pam_krb5.so seem to totally ignore
KVNOs, picking the first principal they find in keytab.<br>
<br>
So I am going to file RH bugzilla report<br>
<br>
Ondrej<br>
</body>
</html>