Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I run the command kadmin.local -q "addprinc admin/admin" it adds the realm to the end of user. So admin/admin becomes admin/admin@LBOX.COM

This is what I ran. Any suggestions would be awesome.

root@directory:~# kadmin.local -q "addprinc admin/admin"
Authenticating as principal root/admin@LBOX.COM with password.
WARNING: no policy specified for admin/admin@LBOX.COM; defaulting to no policy
Enter password for principal "admin/admin@LBOX.COM": 
Re-enter password for principal "admin/admin@LBOX.COM": 
Principal "admin/admin@LBOX.COM" created.
root@directory:~# kadmin.local -q "addprinc -randkey kadmin/directory.lbox.com"
Authenticating as principal root/admin@LBOX.COM with password.
WARNING: no policy specified for kadmin/directory.lbox.com@LBOX.COM; defaulting to no policy
add_principal: Principal or policy already exists while creating "kadmin/directory.lbox.com@LBOX.COM".
root@directory:~# /etc/init.d/krb5-admin-server restart
share|improve this question

1 Answer 1

This is expected behavior and is necessary. Kerberos principals don't exist in the void but always have a realm. It is conventional that Kerberos realms be uppercase versions of the domain they correspond with, but is not required. You may include whatever realms you wish to in your kdc's database(s). The trick is making sure the authentication requests make it to the appropriate location(s).

(A ticket may be anonymous, but that's a whole different topic.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.