<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:14px"><div id="yui_3_16_0_ym19_1_1478706097118_4748"><span>Thanks Martin, and I always forget I can man a conf file. </span></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 14px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Tuesday, November 8, 2016 12:09 PM, Martin Babinsky <mbabinsk@redhat.com> wrote:<br></font></div> <br><br> <div class="y_msg_container">On 11/08/2016 05:13 PM, Ask Stack wrote:<div class="yqt6670768522" id="yqtfd33077"><br clear="none">> I thought /etc/krb5.conf controls which kerberos server the clients talk<br clear="none">> to.<br clear="none">><br clear="none">> As a test, I removed /etc/krb5.conf and rebooted the client. After<br clear="none">> reboot, I can still log in and "kinit user" .<br clear="none">> Removing /etc/krb5.keytab, however would stop user from logging in and<br clear="none">> sssd to start.</div><br clear="none">><br clear="none">><br clear="none">><br clear="none"><br clear="none">/etc/krb5.conf configures Kerberos client library: it instructs the <br clear="none">client about which realm it should use, whether to use dns discovery or <br clear="none">use static list of KDC and mapping between DNS domains and realms.<br clear="none"><br clear="none">Read `man krb5.conf' for more info.<br clear="none"><br clear="none">sssd stores plenty of information about Kerberos realm in its own <br clear="none">configuration (realm, DNS discovery etc.) so it can authenticate the <br clear="none">user even without valid krb5.conf (as you observed).<br clear="none"><br clear="none">However, to pull in user info from authoritative source (IPA LDAP), sssd <br clear="none">authenticates against IPA as the host principal using /etc/krb5.keytab, <br clear="none">that's why it stopped working and refused to start after you removed it.<br clear="none"><br clear="none">-- <br clear="none">Martin^3 Babinsky<br clear="none"><br clear="none">-- <br clear="none">Manage your subscription for the Freeipa-users mailing list:<br clear="none"><a shape="rect" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">Go to <a shape="rect" href="http://freeipa.org/" target="_blank">http://freeipa.org </a>for more info on the project<div class="yqt6670768522" id="yqtfd39035"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>