I'm using Ansible to administer a group of Windows servers, with my control machine running CentOS 7.1. I've set up my /etc/krb5.conf file to authenticate to a domain controller so I can use one domain account to authenticate to all of my hosts. This works fine - as long as I manually run kinit user@DOMAIN.COM
first.
The problem is, as soon as I reboot my control machine, the Kerberos ticket expires, and any attempt to run Ansible against the Windows servers results in the standard "no Kerberos credentials" error, until I run kinit
again.
Is there a recommended practice for either:
Persisting Kerberos tickets in the event of a system reboot
Authenticating against a specific domain on boot?
EDIT: here's my (modified) output to realm discover
:
[root@server ~]# realm discover
my.domain.com
type: kerberos
realm-name: MY.DOMAIN.COM
domain-name: my.domain.com
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common
login-formats: %U@my.domain.com
login-policy: allow-realm-logins