Hot answers tagged kerberos
Not sure how much Apple has changed things from a typical LDAP/Kerberos setup. In LDAP, a password change would involve TCP client:highport -> server:389 (or the LDAPS equivalent port, or possibly UDP if they've adopted the LDAP-via-UDP thing like ActiveDirectory does). In Kerberos the password change should be made to the kpasswd (464) port on the ...
I believe I've worked out what was going on here. It looks like extra information being kept in the keytab file after the host was joined with/without . on the end of the domain and that was where the odd behaviour was coming from. Once I deleted /etc/krb5.keytab and reran the join to domain that created a new keytab that had only ever been setup ...
Short answer: no. kadmin can only talk with an actual MIT Kerberos server/database. However, you should still be able to add/remove/change SPNs in Active Directory via standard LDAP tools. The SPN's associated with an object are in a multi-valued attribute called "servicePrincipalName".
The issue is the fact that the DNS entry is a CNAME record not an A record combined with fact that the SPNs are set up for the host name MyApp and not the machine name MachineB. The solution is to either change the DNS entry for MyApp to an A record that points directly to the IP address of MachineB or to add the SPNs HTTP/MachineB and ...
Only top voted, non community-wiki answers of a minimum length are eligible