0
(Obligatory newbie prefix: never played much with Kerberos so treat me gently here!)
We have two domains foo.local
and .test
.
.test
was cloned from foo.local
and, once logged on to a server inside .test
the domain thinks it is the foo.local
domain.
e.g. myserver.foo.local
has an IP address of 10.250.20.10 and myserver.test
has an IP address of 10.253.20.10 when inside the foo.local
domain, but sees itself as 10.250.20.10 when inside the .test
domain.
In addition myserver.foo.local
can reach out to myserver.test
but the opposite is not true.
Also, myserver.foo.local
when reaching out to myothersever.foo.local
does indeed hit a server that is inside the foo.local
domain, however when myserver.test
connects to myotherserver.foo.local
then it remains stuck inside the .test
domain.
This all said, here's my /etc/krb5.conf
file (which I'm more than happy to learn is badly configured):
[libdefaults]
default_realm = FOO.LOCAL
[realms]
FOO.LOCAL = {
kdc = foo-dc01.foo.local
}
TEST = {
kdc = foo-dc02.test
}
Life is good when connecting to servers inside foo.local
and indeed my kinit
works a treat. Test
not so much.
myLogin$ kinit -V mylogin@test
mylogin@test's password:
kinit: krb5_get_init_creds: unable to reach any KDC in realm test, tried 0 KDCs
So, questions:
1) What steps am I missing to authenticate against the test domain - how do I configure kinit
to use the foo-dc02.test
domain server to authenticate (or even, do I given that my Windows LoginId and password are the same)?
2) Once done, how do I ensure that when connecting to myserver.test
it uses the token derived from the kinit mylogin@test
when attempting a connection?
System Info: All AD servers are Windows, right now my POC tests are from my MacBook but clients running on Windows, Macs and Linux will all need to work eventually.
All the servers are virtual, we copied all the servers and fired them up inside different physical hosts and provided routing to go from .foo.local to .test. My question doesn't so much pertain to the cloning but "how do we get tokens from the .test domain" – Rachel Ambler – 2018-10-02T12:30:44.917
I made the above comment because a user asked how the environments were cloned. Sadly that person then subsequently deleted their question thus leading mine dangling. Keeping it there to provide context. – Rachel Ambler – 2018-10-02T12:41:52.757