1

I have an environment in Active Directory that is composed of a root and a child domain, let's call them my.root.domain.com and root.domain.com

I have a RHEL7 server I've spun up which has no problem at all authenticating against the "my.root.domain.com" domain. I cannot, however, authenticate using an account in the "root.domain.com" domain. I can look up accounts using id in both domains:

id -a [email protected]

and

id -a [email protected]

both show my AD groups. As the root user, I can even "su - " to any user in either domain (doesn't require authentication). The problem arises when authentication happens. Trying to authenticate to [email protected] fails.

in smb.conf I have:

...
workgroup = MY
realm = MY.ROOT.DOMAIN.COM
security = ads
...

in /etc/krb5.conf I have:

[libdefaults]
dns_lookup_realm = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
proxiable = true
rdns = false
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = MY.ROOT.DOMAIN.COM
dns_lookup_kdc = true
[realms]
MY.ROOT.DOMAIN.COM = {
}
ROOT.DOMAIN.COM = {
}

[domain_realm]
my.root.domain.com = MY.ROOT.DOMAIN.COM
.my.root.domain.com = MY.ROOT.DOMAIN.COM
root.domain.com = ROOT.DOMAIN.COM
.root.domain.com = ROOT.DOMAIN.COM

A packet trace does reveal that when trying to authenticate as [email protected], it sends a KRB query of:

CNameString: ROOT.DOMAIN.COMuser2
realm: MY.ROOT.DOMIAN.COM

I know I'm the village idiot when it comes to the AD stuff, but hoping someone has a good suggestion. I'm fairly certain my krb config is not quite what it should be.

Does anyone have any suggestions to utilize accounts from the domain "root.domain.com" domain to authenticate against?

1 Answer 1

1

Under [realms] section in /etc/krb5.conf you must declare at least one KDC for every realm:

[realms]
MY.ROOT.DOMAIN.COM = {
kdc = <FQDN_KDC_MY.ROOT.DOMAIN.COM>
}

ROOT.DOMAIN.COM = {
kdc = <FQDN_KDC.ROOT.DOMAIN.COM>
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .