Приветствую!
Настраиваем доменную авторизацию для CentOS 6.10.
Наш домен имеет вид: very.long.domain.name. Для простоты, для пользователей настроена авторизация вида username@company.name.
Авторизация прекрасно работает для very.long.domain.name:
#kinit UserName@VERY.LONG.DOMAIN.NAME
или проще
#kinit UserName
Однако
#kinit username@company.name
возвращает
kinit: Realm not local to KDC while getting initial credentials.
keytab создаем командой:
ktpass -out file.keytab -princ HTTP/company.name@VERY.LONG.DOMAIN.NAME -mapuser UDUSER@VERY.LONG.DOMAIN.NAME -mapOp set -pass ******* -ptype KRB5_NT_PRINCIPAL -crypto AES256-SHA1
Наш конфиг
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = VERY.LONG.DOMAIN.NAME
default_keytab_name = FILE:/opt/config/file.keytab
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
VERY.LONG.DOMAIN.NAME = {
default_domain = company.name
kdc = kdc01.very.long.domain.name
kdc = kdc02.very.long.domain.name
kdc = kdc03.very.long.domain.name
admin_server = adminserver.very.long.domain.name
}
[domain_realm]
.VERY.LONG.DOMAIN.NAME = VERY.LONG.DOMAIN.NAME
VERY.LONG.DOMAIN.NAME = VERY.LONG.DOMAIN.NAME
.very.long.domain.name = VERY.LONG.DOMAIN.NAME
very.long.domain.name = VERY.LONG.DOMAIN.NAME
.company.name = VERY.LONG.DOMAIN.NAME
company.name = VERY.LONG.DOMAIN.NAME
