mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
5a08499414
DNS update tool uses private krb5.conf which should have enough details to authenticate with GSS-TSIG when running nsupdate. Unfortunately, the configuration we provide is not enough. We set defaults to not lookup REALM via DNS but at the same time we don't provide any realm definition. As result, MIT Kerberos cannot actually find a working realm for Samba AD deployment because it cannot query DNS for a realm discovery or pick it up from the configuration. Extend private krb5.conf with a realm definition that will allow MIT Kerberos to look up KDC over DNS. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
13 lines
185 B
Plaintext
13 lines
185 B
Plaintext
[libdefaults]
|
|
default_realm = ${REALM}
|
|
dns_lookup_realm = false
|
|
dns_lookup_kdc = true
|
|
|
|
[realms]
|
|
${REALM} = {
|
|
default_domain = ${DNSDOMAIN}
|
|
}
|
|
|
|
[domain_realm]
|
|
${HOSTNAME} = ${REALM}
|