I'm unable to make working a simple configuration written in Samba Wiki. NSLCD worked fine, when authentized by name and password. But I have no idea, what can I do wrong when following that simple how-to. It always fails, when using Kerberos, saying: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not fou... (That mean Server not found in Kerberos database, it thing). I though, that there must be somthing wrong in some machine name. This experiment I'm doing on the same machine the Samba runs on. So probably the machine is identified as
localhost. I added several SPNs, but it does not work.
$ samba-tool spn list ldap-connect User CN=ldap-connect,CN=Users,DC=barbucha,DC=local has the following servicePrincipalName: nslcd/localhost nslcd/bolbro host/localhost nslcd/bolbro.barbucha.local
My problem is, that I don't know actually, what I'm exactly doing. I need some explanation, how these things works. (And they do work. I found several post, where people had this thing functional.) Why several post suggest to use
HOST/machine principal, some of them
host/machine and the Samba Wiki
nslcd/machine? Why are these SPN always bound to exactly one user principal? Is there somebody, who knows, what exactly do and why? How do I get the right machine name?
The main problem is, that if I'm unable to make this work, then I'm unable to kerberize any service and Kerberos is good just to distribute some useless tickets.