Re: Compatibility problem?

["Brandon S. Allbery KF8NH" <allbery@ece.cmu.edu>]

On Apr 29, 2008, at 6:41 , <alexander.behrend@arcor.de>  
<alexander.behrend@arcor.de> wrote:

> krbtgt/SINGLESIGNON.EXAMPLE.COM@SINGLESIGNON.EXAMPLE.COM and
> krbtgt/EXAMPLE.COM@SINGLESIGNON.EXAMPLE.COM
>
> The logs "krb5kdc.log" told me that he is using both ticket  
> entries. So I
> deleted the second entry to force the use of only the first one  
> krbtgt entry.
>
> Now he shows me "Server not found in Kerberos database" (GSSAPI)
> and krbtgt/EXAMPLE.COM@SINGLESIGNON.EXAMPLE.COM: No such entry in  
> the database
> (krb5kdc.log)

Use of multiple krbtgt-s usually means crossrealm.  The realm is  
usually determined from the domain name via krb5.conf; if the wrong  
realm is being selected then you need to examine the [domain_realm]  
section of krb5.conf and/or get appropriate SRV records added to DNS  
for the domain(s).

-- 
brandon s. allbery [solaris,freebsd,perl,pugs,haskell] allbery@kf8nh.com
system administrator [openafs,heimdal,too many hats] allbery@ece.cmu.edu
electrical and computer engineering, carnegie mellon university    KF8NH