Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

A.2. Investigating kinit Authentication Failures

General Troubleshooting

  1. On the IdM client, display the debug messages from the kinit process:
    Copy to Clipboard Toggle word wrap 
    $ KRB5_TRACE=/dev/stdout kinit admin
  2. Verify that:
    • The client forward record is correct both on the server and on the affected client:
      Copy to Clipboard Toggle word wrap 
      # host client_fully_qualified_domain_name
    • The server forward record is correct both on the server and on the affected client:
      Copy to Clipboard Toggle word wrap 
      # host server_fully_qualified_domain_name
       Copy to Clipboard Toggle word wrap 
      # host server_IP_address
      The host server_IP_address command must return a fully qualified host name with a trailing dot at the end, such as:
      Copy to Clipboard Toggle word wrap 
      server.example.com.
  3. Review the /etc/hosts file on the client, and make sure that:
    • All server entries in the file are correct
    • In all server entries, the first name is a fully qualified domain name
    See also the section called “The /etc/hosts File”.
  4. Make sure you meet the other conditions in Section 2.1.5, “Host Name and DNS Configuration”.
  5. On the IdM server, make sure that the krb5kdc and dirsrv services are running:
    Copy to Clipboard Toggle word wrap 
    # systemctl status krb5kdc
# systemctl status dirsrv.target
  6. Review the Kerberos key distribution center (KDC) log: /var/log/krb5kdc.log.
  7. If the KDCs are hard-coded in the /etc/krb5.conf file (the file explicitly sets KDC directives and uses the dns_lookup_kdc = false setting), use the ipactl status command on each master server. Check the status of the IdM services on each server listed as KDC by the command:
    Copy to Clipboard Toggle word wrap 
    # ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful

Troubleshooting Errors Cannot find KDC for realm

If kinit authentication fails with an error that says Cannot find KDC for realm "EXAMPLE.COM" while getting initial credentials, it indicates that KDC is not running on the server or that the client has misconfigured DNS. In this situation, try these steps:
  1. If the DNS discovery is enabled in the /etc/krb5.conf file (the dns_lookup_kdc = true setting), use the dig utility to check whether the following records are resolvable:
    Copy to Clipboard Toggle word wrap 
    $ dig -t TXT _kerberos.ipa.example.com
$ dig -t SRV _kerberos._udp.ipa.example.com
$ dig -t SRV _kerberos._tcp.ipa.example.com
    In the following example, one of the dig commands above failed with this output:
    Copy to Clipboard Toggle word wrap 
    ; <<>> DiG 9.11.0-P2-RedHat-9.11.0-6.P2.fc25 <<>> -t SRV _kerberos._tcp.ipa.server.example
;; global options: +cmd
;; connection timed out; no servers could be reached
    The output indicated that the named service was not running on the master server.
  2. If DNS lookup fails, continue with the steps in Section A.6, “Troubleshooting DNS”.

Related Information

Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat, Inc.