Cross-Realm Admins

Greg Hudson ghudson at mit.edu
Mon Dec 19 23:54:25 EST 2016


On 12/19/2016 03:50 PM, Kemper, Stephan wrote:
> The problem is with our admin principals.  I can’t seem to get our KDC to hand me the service ticket that I want.  Each time I run a `kinit -S kadmin/admin at B.VIASAT.COM -c ccache skemper/admin at VIASAT.COM` I get back a service of kadmin/admin at VIASAT.COM, the root realm.

kinit performs an AS request.  AS requests cannot be cross-realm, and
the kinit -S flag can only specifies the name part of the service
principal, not the realm.

Because kadmin tickets must be obtained via AS request, there isn't
currently any way to do cross-realm administration; each realm must have
its own administrative principals.


More information about the Kerberos mailing list