Kerberos Authentication in a Mixed (Windows and LINUX) Environment

Question

I need to map the Service principal name for the user in an Active Directory from Linux environment, where my KDC is located, to Windows.

Is there a way to map the AD user from Linux rather than mapping them using setSPN in the Windows environment?

Solution tried:

Configured Krb5-conf in Linux machine and installed krb5-usr as a client in Linux machine.

While issuing the command to add a principal name for the user using the admin user, I get this error:

testuser@linux106:~$ kadmin -p adminuser/[email protected] -q "addprinc user1/[email protected]"
Authenticating as principal adminuser/[email protected] with password.
kadmin: Client not found in Kerberos database while initializing kadmin interface

Please provide input to achieve it or tell me if I misunderstood.

Answer 1

Client not found in Kerberos database while initializing kadmin interface means that the principal adminuser/[email protected] you are triying to authenticate with doesn't exists.

You can avoid authenticating by executing kadmin.local on KDC server

$ sudo kadmin.local

Then, use listprincs, addprinc, delprinc ... to manage your Kerberos database principals.

Is there a way to map the AD user from Linux?

There is no way to map an AD user from linux, as the mapping AD_user <--> AD_principal has only sense on AD servers. (*)

(*) Note that there are no Kerberos_users in a Kerberos database, just Kerberos_principals. (Or Kerberos_user = Kerberos_principal if you prefer, anyway you can't map principals to users)