Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have successfully implemented SSO on apache for windows users in the same AD domain that the apache server is in: AD domain = example.com Linux server = linux.example.com KDC = ad.example.com

I set the KrbLocalUserMapping to ON in httpd.conf, as the application the users are logging into needs the @example.com part of the username to be stripped.

Now I want to enable the users from the branch offices to login to the application as well but they come from a different domain = branches.example.com. Both domains are in a trusted relationship.

When users from branches.example.com try to login they get "Internal Server Error" and apache error log says "Krb5_aname_to_localname() found no mapping for principal user@branches.example.com"

My guess is that users coming from the subdomain branches.example.com are not getting the domain part of the username stripped.

What do i need to change and where (probably krb5.conf?). Do I need to generate a separate keytab for the branches subdomain?

Also, since it is a production server which I cannot arbitrarily restart, what services do i need to restart after changing things in the krb5.conf?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.