The created krb5.conf for 'net ads join' doesn't have a domain entry.
net ads join -k -UADDOMAIN\user will then fail to find a KDC.
Do we need one? because all my servers (Debian/Ubuntu) only have :
default_realm = INTERNAL.DOMAIN.TLD
And as long the DNS is setup correctlty, this should work fine out of the box.
net ads join -k is also all i used in all my members and all joined without problems. ( based on samba 4.6+ upto 4.12.6 )
So this looks to me there's more going on.
Only i dont use RH/Centos.
And isnt this wrong.. net ads join -k -U ...
I would expect to see :
net ads join -k
net ads join -U"ADDOMAIN\user"
net ads join -U"ADDOMAIN\user@REALM"
net ads join -U"user@REALM"
This bug was referenced in samba master:
Created attachment 16202 [details]
patch for 4.13
Take a look at the krb5.conf we generate, we only create an entry for the realm, we also should have one for the domain.
It also fixes a bug in selftest when in FIPS mode.
Karolin, if possible please add the patch to 4.13 if possible A minor 4.13 elease would be ok too. Thanks!
(In reply to Andreas Schneider from comment #5)
Pushed to autobuild-v4-13-test.
This bug was referenced in samba v4-13-test:
This bug was referenced in samba v4-13-stable: