sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

samba-tool: create working private krb5.conf

Browse Source 
DNS update tool uses private krb5.conf which should have enough details
to authenticate with GSS-TSIG when running nsupdate.

Unfortunately, the configuration we provide is not enough. We set
defaults to not lookup REALM via DNS but at the same time we don't
provide any realm definition. As result, MIT Kerberos cannot actually
find a working realm for Samba AD deployment because it cannot query DNS
for a realm discovery or pick it up from the configuration.

Extend private krb5.conf with a realm definition that will allow MIT
Kerberos to look up KDC over DNS.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
Alexander Bokovoy 2019-10-07 18:24:28 +03:00 committed by Andreas Schneider
parent 0abd1189a6
commit 5a08499414
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source4/setup/krb5.conf
View File

@ -2,3 +2,11 @@
default_realm = ${REALM}
dns_lookup_realm = false
dns_lookup_kdc = true
[realms]
${REALM} = {
default_domain = ${DNSDOMAIN}
}
[domain_realm]
${HOSTNAME} = ${REALM}