I’ve been testing FreeIPA on a small network of CentOS 7 hosts (all virtual machines running in VirtualBox on a host-only network). After installing the IPA server on one host and creating the realm (IPA.OSRIC.NET), I installed the IPA client on one of the other hosts and tried running kinit:
# kinit admin
kinit: Cannot contact any KDC for realm 'IPA.OSRIC.NET' while getting initial credentials
Searching for that error brought me to Kinit won’t connect to a domain server. Although that did not describe the same issue, it did point me to the /etc/krb5.conf file. The realms section looked like it was missing something:
[realms]
IPA.OSRIC.NET = {
pkinit_anchors = FILE:/etc/ipa/ca.crt
}I added a kdc attribute:
[realms]
IPA.OSRIC.NET = {
kdc = prospero.osric.net:88
pkinit_anchors = FILE:/etc/ipa/ca.crt
}No restart of any service was necessary. I ran kinit again and it worked:
# kinit admin
Password for admin@IPA.OSRIC.NET:
According to the krb5.conf documentation on realms:
kdc
The name or address of a host running a KDC for that realm. An optional port number, separated from the hostname by a colon, may be included.
I’m a Kerberos novice, but that seems like a necessary property. I’m not sure why the IPA client setup did not include it. I have a few more virtual machines to install the client on, so I’ll soon find if that behavior is consistent on subsequent installations.