samba-tool: create working private krb5.conf
authorAlexander Bokovoy <ab@samba.org>
Mon, 7 Oct 2019 15:24:28 +0000 (18:24 +0300)
committerAndreas Schneider <asn@cryptomilk.org>
Tue, 8 Oct 2019 12:50:38 +0000 (12:50 +0000)
DNS update tool uses private krb5.conf which should have enough details
to authenticate with GSS-TSIG when running nsupdate.

Unfortunately, the configuration we provide is not enough. We set
defaults to not lookup REALM via DNS but at the same time we don't
provide any realm definition. As result, MIT Kerberos cannot actually
find a working realm for Samba AD deployment because it cannot query DNS
for a realm discovery or pick it up from the configuration.

Extend private krb5.conf with a realm definition that will allow MIT
Kerberos to look up KDC over DNS.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
source4/setup/krb5.conf

index b1bf6cf907d3fda76a805be0f6154f5f59a67899..ad6f2818fb5f8b822b230a60cdba3b29e95b25e0 100644 (file)
@@ -2,3 +2,11 @@
        default_realm = ${REALM}
        dns_lookup_realm = false
        dns_lookup_kdc = true
+
+[realms]
+${REALM} = {
+       default_domain = ${DNSDOMAIN}
+}
+
+[domain_realm]
+       ${HOSTNAME} = ${REALM}