sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code
a4b1845f4c
samba-mirror/source4/setup/krb5.conf

13 lines
185 B
Plaintext
Raw Normal View History

provision: Generate krb5.conf template separate from named.conf template. (This used to be commit ebf130e9e57b640129cf0d05dbd7d210b71ea371)
2008-05-22 03:12:36 +04:00
[libdefaults]
default_realm = ${REALM}
s4-provision: simplify our generated krb5.conf we don't want to force the KDC to be ourselves, we should be using DNS to find a live KDC. Also remove some other options and allow the krb5 lib to use defaults. Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-29 06:11:34 +04:00
dns_lookup_realm = false
s4-setup Make krb5.conf use DNS by default We set up our DNS pretty well these days, and I think the previous setting was only there because Andrew Kroeger copied this out of our selftest code in bf3f3af92677bce8f03b0dd2be552d6c8c730ca1. Andrew Bartlett
2010-09-09 08:58:06 +04:00
dns_lookup_kdc = true
samba-tool: create working private krb5.conf DNS update tool uses private krb5.conf which should have enough details to authenticate with GSS-TSIG when running nsupdate. Unfortunately, the configuration we provide is not enough. We set defaults to not lookup REALM via DNS but at the same time we don't provide any realm definition. As result, MIT Kerberos cannot actually find a working realm for Samba AD deployment because it cannot query DNS for a realm discovery or pick it up from the configuration. Extend private krb5.conf with a realm definition that will allow MIT Kerberos to look up KDC over DNS. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-10-07 18:24:28 +03:00
[realms]
${REALM} = {
default_domain = ${DNSDOMAIN}
}
[domain_realm]
${HOSTNAME} = ${REALM}
Copy Permalink