Created attachment 18859 [details] Patch to create host<fqdn> principcals instead of HOST<fqdn> Here's a patch that "fixes" this problem. It shouldn't be a problem if net ads join tills the AD to create host/<fqdn> since AD is case insensitive, but Unix utilities are not but there might be something I'm not aware of (perhaps make it selectable with some command line option). Anyway, it works for me... For an example of a unix tool that breaks if /etc/krb5.keytab contains HOST/<fqdn> is pam_krb5 (on FreeBSD)
hmm, we keep not quite fixing this class of problem. https://bugzilla.samba.org/show_bug.cgi?id=15759#c3 is relevant. Also, e.g. bug 9699 and bug 3671.
(In reply to Douglas Bagnall from comment #1) I have just spent sometime trying to understand why using openssh to connect to a Samba AD DC using GSSAPI didn't work. It basically boiled down to the computers SPN starting with 'HOST/' instead of 'host/'. Adding an SPN that did start with 'host/' cured my problem, but raised the question, should I be able to add an SPN that only differed by case ? I suppose that I should point out that redhat fixed this in adcli nearly 12 years ago, see: https://cgit.freedesktop.org/realmd/adcli/commit/?__goaway_challenge=meta-refresh&__goaway_id=80815279b6b8e0bbc0cb45aceb03db0f&__goaway_referer=https%3A%2F%2Fbugzilla.redhat.com%2F&id=ec132a3add4c41a9c1efa6c12b2c900df66151d1