How to kerberize services on Mac bound to Kerberos KDC on Linux? I'm trying to kerberize services on an iMac that is bound to an external Kerberos KDC on a Linux computer.

I assume that I have to use sso_util and do it like this:

    sso_util configure -v 7 -r EXAMPLE.COM -f /LDAPv3/kdc.example.com -a diradmin/admin all


where EXAMPLE.COM is the name of the realm and kdc.example.com is the Linux computer which hosts LDAP and Kerberos.

I get the following error message:

GetRealmFromDir: looking up the realm name in the KerberosKDC config record in node
/LDAPv3/ldap.keps.de
GetRealmFromDir: Couldn't get attributes of kerberoskdc record
GetRealmFromDir: didn't find a KerberosKDC record, looking in the KerberosClient record
GetConfigFromDir: failed to find the KerberosClient config record in the directory error = 4101
GetRealmFromDir: didn't find a KerberosClient record either, returning NULL
GetRealmFromDir: realm is :(null)
Invalid Realm Name


It looks like I must put some configuration data in the LDAP database but what data according to what schema?
You don’t need to bind a mac to use Kerberos. In fact, binding brings a whole host of issues, one of which is lack of clarity at which problem you are chasing down.

To test and validate Kerberos tickets and transactions are operational at the command line use kinit and klist (both of which have quite adequate manual pages that describe the detaults. You will want to point kinit at your service principal with the -S or --service argument the first time you initialize Kerberos.)

Perhaps I don’t fully understand what you are trying to accomplish - if so, please comment and/or ask a follow on question with those details. We’re using this to great benefit at work and haven’t needed to bind any macs and have ripped out the binding on all but a few that need to share out files as servers and they don’t need kinit or klist - just to be bound properly one time.