Chapter 20. Using the KDC Proxy in IdM

Procedure

1. Open the /etc/krb5.conf file for editing.

2. In the [realms] section, enter the URL of the KKDCP for the kdc, admin_server, and kpasswd_server options:

   [realms]
   EXAMPLE.COM = {
     kdc = https://kdc.example.com/KdcProxy
     admin_server = https://kdc.example.com/KdcProxy
     kpasswd_server = https://kdc.example.com/KdcProxy
     default_domain = example.com
   }

   For redundancy, you can add the parameters kdc, admin_server, and kpasswd_server multiple times to indicate different KKDCP servers.

3. Restart the sssd service to make the changes take effect:

   ~]# systemctl restart sssd

Procedure

1. Remove the ipaConfigString=kdcProxyEnabled attribute and value pair from the directory:

   # ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif
   Update complete
   The ipa-ldap-updater command was successful

2. Restart the httpd service:

   # systemctl restart httpd.service

Procedure

1. Add the ipaConfigString=kdcProxyEnabled attribute and value pair to the directory:

   # ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif
   Update complete
   The ipa-ldap-updater command was successful

2. Restart the httpd service:

   # systemctl restart httpd.service

Procedure

1. Set the use_dns parameter in the [global] section of the /etc/ipa/kdcproxy/kdcproxy.conf file to false.

   [global]
   use_dns = false

2. Put the proxied realm information into the /etc/ipa/kdcproxy/kdcproxy.conf file. For example, for the [AD.EXAMPLE.COM] realm with proxy list the realm configuration parameters as follows:

   [AD.EXAMPLE.COM]
   kerberos = kerberos+tcp://1.2.3.4:88 kerberos+tcp://5.6.7.8:88
   kpasswd = kpasswd+tcp://1.2.3.4:464 kpasswd+tcp://5.6.7.8:464

   Important

   The realm configuration parameters must list multiple servers separated by a space, as opposed to /etc/krb5.conf and kdc.conf, in which certain options may be specified multiple times.

3. Restart Identity Management (IdM) services:

   # ipactl restart

Procedure

1. In the /etc/ipa/kdcproxy/kdcproxy.conf file, in the [global] section, set configs = mit and use_dns = true:

   [global]
   configs = mit
   use_dns = true

   The configs = mit setting imports the MIT Kerberos configuration into kdcproxy, making realms declared there available for DNS-based KDC discovery.

2. Optional: To re-enable DNS-based KDC discovery for all realms, add the dns_realm_discovery parameter to the [global] section.

   Warning

   Red Hat recommends against setting dns_realm_discovery = true. It restores the pre-CVE-2025-59088 behavior and enables any client to trigger DNS SRV record lookups for arbitrary realm names, which can be exploited to probe internal network addresses and exfiltrate data via server-side request forgery.

   [global]
   configs = mit
   use_dns = true
   dns_realm_discovery = true

3. Restart Identity Management (IdM) services:

   # ipactl restart

Procedure

1. In the /etc/ipa/kdcproxy/kdcproxy.conf file, the [global] section, set the use_dns parameter to true.

   [global]
   use_dns = true

2. Add a section for each AD realm to /etc/ipa/kdcproxy/kdcproxy.conf, specifying the KDC servers explicitly:

   [AD.EXAMPLE.COM]
   kerberos = kerberos+tcp://ad-dc1.ad.example.com:88 kerberos+tcp://ad-dc2.ad.example.com:88
   kpasswd = kpasswd+tcp://ad-dc1.ad.example.com:464 kpasswd+tcp://ad-dc2.ad.example.com:464

   Replace AD.EXAMPLE.COM with the name of your AD realm, and ad-dc1.ad.example.com and ad-dc2.ad.example.com with the hostnames or IP addresses of your AD domain controllers. You can list multiple servers space-separated on a single line.

   Important

   The realm configuration parameters must list multiple servers separated by a space, as opposed to /etc/krb5.conf and kdc.conf, in which certain options can be specified multiple times.

   Note

   When use_dns = true is set globally, empty realm sections are sufficient to add realms to the allow-list. You do not need to specify KDC servers explicitly. For example:

   [global]
   use_dns = true
   
   [SUB1.AD.EXAMPLE.COM]
   [SUB2.AD.EXAMPLE.COM]

   To cover an AD forest with multiple sub-realms, you can also use a wildcard section prefixed with *. For example, [*AD.EXAMPLE.COM] matches AD.EXAMPLE.COM and CHILD.AD.EXAMPLE.COM, but not MYADEXAMPLE.COM.

3. Optional: If you cannot add dedicated realm sections, you can re-enable DNS-based KDC discovery for all realms by adding the dns_realm_discovery parameter to the [global] section.

   Warning

   Red Hat recommends against setting dns_realm_discovery = true. It restores the pre-CVE-2025-59088 behavior and enables any client to trigger DNS SRV record lookups for arbitrary realm names, which can be exploited to probe internal network addresses and exfiltrate data via server-side request forgery.

   [global]
   use_dns = true
   dns_realm_discovery = true

4. Restart Identity Management (IdM) services:

   # ipactl restart