<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Carlito">OK clear, many thanks!<br>
<br>
Winny<br>
</font><br>
<div class="moz-cite-prefix">Op 25-01-16 om 09:45 schreef Christian
Heimes:<br>
</div>
<blockquote cite="mid:56A5E0AA.3050206@redhat.com" type="cite">
<pre wrap="">On 2016-01-25 08:17, Winfried de Heiden wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Great,
Changing
/etc/ipa/kdcproxy/kdcproxy.conf
[global]
configs = mit
use_dns = false
to
# cat /etc/ipa/kdcproxy/kdcproxy.conf
[global]
configs = mit
use_dns = true
along with adding the windows realm to krb5.conf on the clients did the
trick; I am able to obtain aan AD TGT ticket by using the KDC proxy
Is there a special reason why "use_dns = false" was used in kdcproxy.conf?
</pre>
</blockquote>
<pre wrap="">
The current implementation of the DNS configuration feature is slow and
reduce performance of KDC proxy requests. Every request has to fetch
multiple SRV records and then resolve each entry in each record again.
There is neither caching nor async DNS support, too.
A co-worker has written a RFC to address the problem. The RFC hasn't
been approved yet.
<a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/draft-mccallum-kitten-krb-service-discovery-00">https://tools.ietf.org/html/draft-mccallum-kitten-krb-service-discovery-00</a>
Do you need dynamic configuration or can you get by with static
configuration in krb5.conf?
Christian
</pre>
</blockquote>
<br>
</body>
</html>