Hot answers tagged kerberos
Two-parter: Yes. First step is identity of the receiving process, so you'll need to use a common identity for the service on both (which functionally means a domain user account, or better, a GMSA.) That'll let you interchangeably connect to either server by name (assuming an SPN is registered for each) but you did mention agnosticism towards which server ...
In the windows environment , you have to run the command as the user specified in the ktpass command. runas /user:domain\username cmd.exe The user also has to have administrative privileges.
This was kind of confusing to figure out for me because there was no reference to the term login-formats anywhere in any documentation. In /etc/sssd/sssd.conf add a line in the domain section to include this: [domain/contoso.com] ... use_fully_qualified_names = False ... then restart sssd.
Check selinux. This looks like it might interfere. (This is in fact the problem, as discussed in the deleted comments).
The short of it is that NFSv4 protocol relies a username being shared between the server and client, and not the UID/GID numbers (which were used in the earlier versions) and the UID <==> username mapping can actually be different on the client and the server. As part of the NFSv4 protocol both the server need to map the common security ...
Only top voted, non community-wiki answers of a minimum length are eligible