Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server.

I am following the official Ubuntu guide to set up a Kerberos client here:, but I have encountered a problem when running the kinit command to connect to the domain server.

The command I am running is: kinit Administrator@DS.DOMAIN.COM. This command returns the following error:

Realm not local to KDC while getting initial credentials. Unfortunately, I cannot find any one else via Google searches that have experienced this exact error, so I have no idea what it means.

The client is able to ping the server's hostname, so the DNS server is pointing to the domain server.

Below is my krb5.conf file:

default = DS.DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc true

        kdc =
        admin_server =
        default_domain =

[domain_realm] = DS.DOMAIN.COM = DS.DOMAIN.COM

How can I correct these errors? I would greatly appreciate all help I can get!

share|improve this question
up vote 11 down vote accepted

Is your domain name DS.DOMAIN.COM or just DOMAIN.COM ?

In your realms you need to have them match, so assuming that DS.DOMAIN.COM is your domain you need to change:

[domain_realm] = DS.DOMAIN.COM = DS.DOMAIN.COM


[domain_realm] = DS.DOMAIN.COM = DS.DOMAIN.COM

However, if you domain is really DOMAIN.COM you would need to change your krb5.conf to look like:

default = DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true

    DOMAIN.COM = {
        kdc =
        #You can have more than one kds, just keep adding more kdc =
        #kdc =
        #Uncomment if you have a krb admin server
        #admin_server =
        default_domain =

[domain_realm] = DOMAIN.COM = DOMAIN.COM

And then you would kinit like so: kinit Administrator@DOMAIN.COM

share|improve this answer
headdesk There it was, staring at me like an obvious thing. Of COURSE = AD.DOMAIN.COM should be in there. Gaah. – sysadmin1138 Aug 3 '10 at 19:57
@sysadmin: No worries ... i just happen to actively be building an AD integrated SMB server and have been staring at my krb5.conf trying to figure out an issue that ended up being a bug in Samba 3.0. :-D – Zypher Aug 3 '10 at 20:00
I will need to try this. However, the domain name: DS.DOMAIN.COM is my Windows Server's Hostname + DOMAIN.COM – Phanto Aug 3 '10 at 20:00
@Phanto then you need to use my lower suggestion. you are specifying a host name as a domain which is what is giving you your errors. the kdc and/or admin server is where you would put the host name. – Zypher Aug 3 '10 at 20:03

Peaking into the source code, it looks like that error is thrown when the negotiation process receives a referral to another domain and that domain is not 'local', or in your krb5.conf config.

00219     /*
00220      * If the backend returned a principal that is not in the local
00221      * realm, then we need to refer the client to that realm.
00222      */
00223     if (!is_local_principal(client.princ)) {
00224       /* Entry is a referral to another realm */
00225       status = "REFERRAL";
00226       errcode = KRB5KDC_ERR_WRONG_REALM;
00227       goto errout;
00228     }

What that could be, I couldn't tell you. That probably depends on your Active Directory environment, and whether or not there are multiple domains in the tree. You probably need more domain_realm aliases, but exactly what that is we can't tell from here.

share|improve this answer

I had the same message using the same krb5.conf as provided by Zypher:

   default = MYDOMAIN.COM
   dns_lookup_realm = true
   dns_lookup_kdc = true
   ticket_lifetime = 24h
   renew_lifetime = 7d
   forwardable = true

   kdc =
   admin_server =
   default_domain =

[domain_realm] = MYDOMAIN.COM = MYDOMAIN.COM

(sorry it seems I can't get proper formatting :/ )

In my case, I needed to kinit to MYDOMAIN.LOCAL rather than MYDOMAIN.COM. Not sure if this is due to an authentication setting in AD in general or just for my AD domain. My domain has 2 DCs, one is W2k3 R2 and the other (the one specified as in krb5.conf) is W2k8 R2. But this is another possible cause for the "Realm not local to KDC while getting initial credentials" message

share|improve this answer
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

default_realm = DOMAIN.LOCAL
dns_lookup_kdc = true
dns_lookup_realm = true
ticket_lifetime = 24h
#default_keytab_name = /etc/squid3/PROXY.keytab

; for Windows 2003
; default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
; default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
; permitted_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
; for Windows 2008 with AES
default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5

kdc = dc.domain.local
admin_server = dc.domain.local
default_domain = domain.local
kpasswd_server = dc.domain.local


keep a register

share|improve this answer
Please add relevant texts to explain how this is going to solve the problem. – bangal Dec 15 '15 at 15:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.