This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 860707 - RFE: net ads join should create krb5.conf with a single KDC defined when used with -S server
RFE: net ads join should create krb5.conf with a single KDC defined when used...
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: samba (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Guenther Deschner
qe-baseos-daemons
: FutureFeature
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-26 10:21 EDT by Marko Myllynen
Modified: 2014-07-07 09:20 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-07-07 09:20:27 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marko Myllynen 2012-09-26 10:21:22 EDT
Description of problem:
When "create krb5 conf = no" is not set in smb.conf, net ads join -S server creates a krb5.conf for the domain containing something like:

...
[realms]
REALM = {
 kdc = kdc1-ip
 kdc = kdc2-ip
}

It would be better that when specifying the server with -S it would be the only KDC included in the created krb5.conf to make sure all communication happens with the specified server/KDC only.

Please note that if one wants to force using a certain KDC then also master_kdc must be set, see https://bugzilla.redhat.com/show_bug.cgi?id=859961.

Version-Release number of selected component (if applicable):
RHEL 6.3
Comment 1 Marko Myllynen 2012-09-26 10:24:40 EDT
FWIW, this is related to bug 748831 where net ads join occasionally fails due to fact that different (K)DCs are being contacted during join and they haven't had the time to sync while joining.
Comment 3 Andreas Schneider 2012-10-23 11:44:33 EDT
Günther, what do you think. Is this worth implementing upstream. -S is probably the wrong option but a new one could be added.
Comment 5 Sumit Bose 2014-07-07 09:20:27 EDT
Samba's private krb5.conf is regular overriden, so it does not make sense to to write is once in a special way. If the system really should only connect to one DC then /etc/krb5.conf would be the better way to configure this. To make sure samba talks to a single DC as long as possible the locator plugin should be installed and winbind should run.

Note You need to log in before you can comment on or make changes to this bug.