A.2. Investigating kinit Authentication Failures
A.2. Investigating kinit Authentication Failures General Troubleshooting On the IdM client, display the debug messages from the kinit process: Verify that: The client forward record is correct both on the server and on the affected client: The server forward record is correct both on the server and on the affected client: The host server_IP_address command must return a fully qualified host name with a trailing dot at the end, such as: Review the /etc/hosts file on the client, and make sure that: All server entries in the file are correct In all server entries, the first name is a fully qualified domain name See also the section called "The /etc/hosts File" . Make sure you meet the other conditions in Section 2.1.5, "Host Name and DNS Configuration" . On the IdM server, make sure that the krb5kdc and dirsrv services are running: Review the Kerberos key distribution center (KDC) log: /var/log/krb5kdc.log . If the KDCs are hard-coded in the /etc/krb5.conf file (the file explicitly sets KDC directives and uses the dns_lookup_kdc = false setting), use the ipactl status command on each master server. Check the status of the IdM services on each server listed as KDC by the command: Troubleshooting Errors Cannot find KDC for realm If kinit authentication fails with an error that says Cannot find KDC for realm "EXAMPLE.COM" while getting initial credentials , it indicates that KDC is not running on the server or that the client has misconfigured DNS. In this situation, try these steps: If the DNS discovery is enabled in the /etc/krb5.conf file (the dns_lookup_kdc = true setting), use the dig utility to check whether the following records are resolvable: In the following example, one of the dig commands above failed with this output: The output indicated that the named service was not running on the master server. If DNS lookup fails, continue with the steps in Section A.6, "Troubleshooting DNS" . Related Information See Section C.2, "Identity Management Log Files and Directories" for descriptions of various Identity Management log files.
KRB5_TRACE=/dev/stdout kinit admin host client_fully_qualified_domain_name host server_fully_qualified_domain_name host server_IP_address server.example.com. systemctl status krb5kdc # systemctl status dirsrv.target ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful dig -t TXT _kerberos. ipa.example.com USD dig -t SRV _kerberos._udp. ipa.example.com USD dig -t SRV _kerberos._tcp. ipa.example.com ; <<>> DiG 9.11.0-P2-RedHat-9.11.0-6.P2.fc25 <<>> -t SRV _kerberos._tcp.ipa.server.example ;; global options: +cmd ;; connection timed out; no servers could be reached