Issues getting Kerberos to work with realmd and Active Directory

Simo Sorce simo at redhat.com
Thu Jul 30 14:33:14 EDT 2020


Wesley,
when joining hosts to AD a computer account is created and a UPN and
SPNs are set on it.
Unlike MIT kerberos in AD heavy use of aliases is employed so each host
have a "host password/key" that is shared with all the aliases created.
Most notably there are the UPN, generally of the form 
computername$@REALM and the SPNs which are a large number of 
service/fqdn at REALM principal names.

The important part here is that while you can get tickets for any of
those names (the KDC has many canonicalization rules that will also
match in a case-insensitive way) when you ask for a TGT (the kinit
operation) AD normally will accept a request only if the UPN form is
used as the client principal and will refuse other forms (even though
the key is the same).

realmd has an option to specify what to set the UPN to to change the
default AD behavior. (See the --user-principal option in realm.8
manpage). You can use it to control what to use at join time, then you
should be able to use exactly that name to kinit from the generated
keytan.

HTH,
Simo.

On Thu, 2020-07-30 at 17:00 +0000, Wesley Taylor wrote:
> Hi All,
> 
> I am trying to get HTCondor with Kerberos authentication (
> https://htcondor.readthedocs.io/en/stable/admin-manual/security.html?highlight=Kerberos#kerberos-authentication
> ) to work on some linux machines I have which I joined to Windows
> Active Directory with realmd. HTCondor tries to authenticate with the
> machine principal, but I am having a hard time figuring out what that
> is. When I run 'klist -k' I see a bunch of entries from
> /etc/krb5.keytab along the lines of host/fqdn at REALM. However, when I
> run 'kinit -k' I get "kinit: Client $(hostname) not found in Kerberos
> database".
> 
> I then interrogated the realm with adcli, using 'adcli testjoin --
> verbose' and it outputs the computer account name as 
> HOST/HOSTNAME at REALM. When I run 'kinit -k HOST/HOSTNAME at REALM' I get
> back the error "kinit: Keytab contains no suitible keys for 
> HOST/HOSTNAME at REALM".
> 
> I am confused because when I run 'adcli update --verbose' it says it
> updated the keytab at /etc/krb5.keytab and outputs the same account
> name (which I am assuming is the principal for the computer) as adcli
> testjoin. I am really scratching my head about this, what am I doing
> wrong here?
> 
> Thanks,
> Wes
> 
> 
> Public Content
> ________________________________
> The information contained in this e-mail and any attachments from
> Numerica Corporation may contain confidential and/or proprietary
> information, and is intended only for the named recipient to whom it
> was originally addressed. If you are not the intended recipient, any
> disclosure, distribution, or copying of this e-mail or its
> attachments is strictly prohibited. If you have received this e-mail
> in error, please notify the sender immediately by return e-mail and
> permanently delete the e-mail and any attachments.
> 
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
> 

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc






More information about the Kerberos mailing list