I have successfully implemented SSO on apache for windows users in the same AD domain that the apache server is in: AD domain = example.com Linux server = linux.example.com KDC = ad.example.com
I set the KrbLocalUserMapping to ON in httpd.conf, as the application the users are logging into needs the @example.com part of the username to be stripped.
Now I want to enable the users from the branch offices to login to the application as well but they come from a different domain = branches.example.com. Both domains are in a trusted relationship.
When users from branches.example.com try to login they get "Internal Server Error" and apache error log says "Krb5_aname_to_localname() found no mapping for principal firstname.lastname@example.org"
My guess is that users coming from the subdomain branches.example.com are not getting the domain part of the username stripped.
What do i need to change and where (probably krb5.conf?). Do I need to generate a separate keytab for the branches subdomain?
Also, since it is a production server which I cannot arbitrarily restart, what services do i need to restart after changing things in the krb5.conf?