9.6. Verifying the Kerberos configuration

Procedure

1. Request a ticket for an Active Directory (AD) user:

   [root@ipaserver ~]# kinit user@AD.EXAMPLE.COM

2. Request service tickets for a service within the IdM domain:

   [root@server ~]# kvno -S host server.idm.example.com

   If the AD service ticket is successfully granted, there is a cross-realm ticket-granting ticket (TGT) listed with all of the other requested tickets. The TGT is named krbtgt/IPA.DOMAIN@AD.DOMAIN.

   [root@server ]# klist
   Ticket cache: KEYRING:persistent:0:krb_ccache_hRtox00
   Default principal: user@AD.EXAMPLE.COM
   
   Valid starting       Expires              Service principal
   03.05.2016 18:31:06  04.05.2016 04:31:01  host/server.idm.example.com@IDM.EXAMPLE.COM
   	renew until 04.05.2016 18:31:00
   03.05.2016 18:31:06 04.05.2016 04:31:01 krbtgt/IDM.EXAMPLE.COM@AD.EXAMPLE.COM
   	renew until 04.05.2016 18:31:00
   03.05.2016 18:31:01  04.05.2016 04:31:01  krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM
   	renew until 04.05.2016 18:31:00

   The localauth plug-in maps Kerberos principals to local SSSD user names. This allows AD users to use Kerberos authentication and access Linux services, which support GSSAPI authentication directly.