Forum Replies Created
-
Posts
-
Sorry for the late answer, i’ve been on home with the cold.
The mac think it’s name is mac.clients.example.org as i should. Its just that the AD plugin seems to register it in AD as hostname (mac) + AD domain (example.com).
Since we don’t run MS DNS (or any other dynamic dns) the AD plugin cant change the macs name in DNS which leads to a mismatch between DNS and the AD record. In my opinion the AD plugin should not make the assumption that the dns name of the client is shortname + domainname since that will prove to be false in a number of organizations.
> From what system are you attempting to access the Mac from?
Im trying to connect from a Debian machine running lenny with ssh. This host has a fully functional kerberos setup (AD integrated using samb/winbind).
If i bypass DNS on the linux client by adding the machost to the hosts file. I get a ticket for host/mac.example.com@EXAMPLE.COM, the mac rejects this ticket even though the ticket exists in /etc/krb5.keytab. This is a bit weird, i would have expected that to work. I’m going to try to set the machine up as mac.example.com in dns just to verify that SSO works in that case.
> If it’s a Mac you can look into creating Kerberos DNS mappings which /should/ allow the Mac to understand the disjointed namespace.
How do you mean? I have Resource records in my DNS for kerberos so i have no trouble finding the kerberosserver. I dont think i have any resourcerecords in clients.example.com only in example.com, i’ll check that with our AD gurus.
> From a PC you should be able to edit the SPN.
> It sounds like you done the second… so maybe you’re attempting to SSO in from a Mac.Yeah, i can edit SPN in AD but i cant get the new keytab to the mac, i could theoretically use ktutil.exe on one of the domaincontrollers but i hope it can be done in another way.
EDIT: i have verified that if i change dns name of the host to mac.example.org and rejoin AD SSO is working as intended. That however is not really an option in my production environment.
