1

I am joining an Ubuntu workstation to an MS AD. I had 1 or 2 config issues when I first tried to run net ads join which resulted in an error message and the workstation not being added correctly I assume (I can see the machine in the AD though). Error message: 

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

I've tried to run net ads leave but that's not working either, and after a restart of winbind, the service fails to come up. Is there a way I can manually reset the domain status? I tried using the solution from Samba Winbind User Resolution but winbind is still not starting up after clearing the tdb files.

I'm going to try removing avahi-daemon (from winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm).

When starting winbind, I get the following errors repeated about 20 times in the log, before the respawning process is killed:

[2015/10/14 12:57:05,  0] ../source3/winbindd/winbindd.c:1453(main)
  winbindd version 4.1.6-Ubuntu started.
  Copyright Andrew Tridgell and the Samba Team 1992-2013
[2015/10/14 12:57:05.909568,  0] ../source3/winbindd/winbindd_cache.c:3196(initialize_winbindd_cache)
  initialize_winbindd_cache: clearing cache and re-creating with version number 2
[2015/10/14 12:57:05.912530,  0] ../source3/winbindd/winbindd_util.c:634(init_domain_list)
  Could not fetch our SID - did we join?
[2015/10/14 12:57:05.912672,  0] ../source3/winbindd/winbindd.c:1204(winbindd_register_handlers)
  unable to initialize domain list
Community
  • 1
Brett
  • 221
  • 3
  • 11

2 Answers2

0

Didn't think that the solution would be in my question! But the next item on my "to try" list ended up resolving it.

I removed the avahi-daemon package. winbind started up. Guess that's an indication of DNS issues or a dns cache?

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

Community
  • 1
Brett
  • 221
  • 3
  • 11
  • Avahi implements multicast DNS as part of the Zeroconf protocol. Apparently, winbind does the same, so they are fighting over the port number for mDNS. It may be possible to configure winbind to use avahi instead of replacing it, that would allow clients using the Avahi client library to use the cache in the Avahi daemon instead of repeating lookups. – Simon Richter Feb 26 '21 at 10:17
0

I had this error on only one node.

Check if the responding domain controler match one entry in the /etc/hosts file.

If the IP address or hostname differs the command will fail.

(The topic is old but it was in the top results on google search)

anael
  • 1
  • 3