Local realm referral failed; trying fallback realm HADOOP.COM

pratyush parimal pratyush.parimal at gmail.com
Sat Jun 17 14:26:25 EDT 2017

Hi everyone,

I'm trying to set up cross-realm authentication so that a user in realm
EXAMPLE.COM can access a service in HADOOP.COM. I've added a capaths
section to my krb5.conf for the same:

 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

  kdc = examplekdc.example.com
  admin_server = examplekdc.example.com

  kdc = hadoopkdc.hadoop.com
  admin_server = hadoopkdc.hadoop.com

 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM


I've also added the required principal krbtgt/HADOOP.COM at EXAMPLE.COM to
both the KDC's. So far, everything is working and my application is able to
do what it needs to.

What I'm concerned about is the following line in my trace log on

[158447] 1497720267.441664: TGS request result: -1765328377/Server
myservice/hadoopkdc.hadoop.com at EXAMPLE.COM not found in Kerberos database
[158447] 1497720267.441680: Local realm referral failed; trying fallback

My questions are the following:
(1) what exactly is this local realm referral? Is this kerberos jargon for
cross realm requests?
(2) why would the local realm referral fail ? How do I explicitly specify
how I want the local realm referral to occur?
(3) What is the meaning of a fallback realm? And how do I specify one?

As you can see from my krb5.conf, I haven't specified the fallback realm or
referrals explicitly, so I think kerberos is picking up default values for
them. I want to know how I can specify them explicitly.

Thanks in advance !

More information about the Kerberos mailing list