Chapter 21. Using the KDC Proxy in IdM

Procedure

1. Open the /etc/krb5.conf file for editing.

2. In the [realms] section, enter the URL of the KKDCP for the kdc, admin_server, and kpasswd_server options:

   [realms]
   EXAMPLE.COM = {
     kdc = https://kdc.example.com/KdcProxy
     admin_server = https://kdc.example.com/KdcProxy
     kpasswd_server = https://kdc.example.com/KdcProxy
     default_domain = example.com
   }

   For redundancy, you can add the parameters kdc, admin_server, and kpasswd_server multiple times to indicate different KKDCP servers.

3. Restart the sssd service to make the changes take effect:

   # systemctl restart sssd

Procedure

1. Remove the ipaConfigString=kdcProxyEnabled attribute and value pair from the directory:

   # ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif
   Update complete
   The ipa-ldap-updater command was successful

2. Restart the httpd service:

   # systemctl restart httpd.service

   KKDCP is now disabled on the current IdM server.

Procedure

1. Add the ipaConfigString=kdcProxyEnabled attribute and value pair to the directory:

   # ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif
   Update complete
   The ipa-ldap-updater command was successful

2. Restart the httpd service:

   # systemctl restart httpd.service

   KKDCP is now enabled on the current IdM server.

Procedure

1. Set the use_dns parameter in the [global] section of the /etc/ipa/kdcproxy/kdcproxy.conf file to false.

   [global]
   use_dns = false

2. Put the proxied realm information into the /etc/ipa/kdcproxy/kdcproxy.conf file. For example, for the [AD.EXAMPLE.COM] realm with proxy list the realm configuration parameters as follows:

   [AD.EXAMPLE.COM]
   kerberos = kerberos+tcp://1.2.3.4:88 kerberos+tcp://5.6.7.8:88
   kpasswd = kpasswd+tcp://1.2.3.4:464 kpasswd+tcp://5.6.7.8:464

   Important

   The realm configuration parameters must list multiple servers separated by a space, as opposed to /etc/krb5.conf and kdc.conf, in which certain options may be specified multiple times.

3. Restart Identity Management (IdM) services:

   # ipactl restart

Procedure

1. In the /etc/ipa/kdcproxy/kdcproxy.conf file, in the [global] section, set configs = mit and use_dns = true:

   [global]
   configs = mit
   use_dns = true

   The configs = mit setting imports the MIT Kerberos configuration into kdcproxy, making realms declared there available for DNS-based KDC discovery.

2. Optional: To re-enable DNS-based KDC discovery for all realms, add the dns_realm_discovery parameter to the [global] section.

   Warning

   Red Hat recommends against setting dns_realm_discovery = true. It restores the pre-CVE-2025-59088 behavior and enables any client to trigger DNS SRV record lookups for arbitrary realm names, which can be exploited to probe internal network addresses and exfiltrate data via server-side request forgery.

   [global]
   configs = mit
   use_dns = true
   dns_realm_discovery = true

3. Restart Identity Management (IdM) services:

   # ipactl restart

Procedure

1. In the /etc/ipa/kdcproxy/kdcproxy.conf file, in the [global] section, set the use_dns parameter to true:

   [global]
   use_dns = true

2. Add a dedicated section for each Active Directory realm that should use DNS-based KDC discovery. Empty sections are sufficient to add a realm to the allow-list. For example:

   [SUB1.AD.EXAMPLE.COM]
   [SUB2.AD.EXAMPLE.COM]

   To include all sub-realms within an AD forest without listing each one individually, use a wildcard section prefixed with *. For example, [*AD.EXAMPLE.COM] matches AD.EXAMPLE.COM, SUB.AD.EXAMPLE.COM, and any deeper subdomains within that forest, but does not match MYAD.EXAMPLE.COM:

   [*AD.EXAMPLE.COM]

3. Optional: If you cannot add dedicated realm sections, you can re-enable DNS-based KDC discovery for all realms by adding the dns_realm_discovery parameter to the [global] section.

   Warning

   Red Hat recommends against setting dns_realm_discovery = true. It restores the pre-CVE-2025-59088 behavior and enables any client to trigger DNS SRV record lookups for arbitrary realm names, which can be exploited to probe internal network addresses and exfiltrate data via server-side request forgery.

   [global]
   use_dns = true
   dns_realm_discovery = true

4. Restart Identity Management (IdM) services:

   # ipactl restart