On Wed, 2005-04-06 at 17:35 +0100, Mário Gamito wrote: > Hi Sean, > > No, i did nothing to krb5.conf > Didn't find any reference to that. > > Can you send me your example, please ? > > > I only put > > tux.dte.ua.pt TUX.DTE.UA.PT > > in krb.realms Mario- Take a look at the stock /etc/krb5.conf, and change all the example.com/EXAMPLE.COM settings to match your domain/realm settings. Once you can kinit as zbr, you'll know that your kerberos setup is functional. For example, at UCSD, the campus active directory is (some would argue, cleverly :) called AD.UCSD.EDU, so a working krb5.conf looks like [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = AD.UCSD.EDU dns_lookup_realm = false dns_lookup_kdc = false [realms] AD.UCSD.EDU = { kdc = ad.ucsd.edu:88 admin_server = ad.ucsd.edu:749 default_domain = AD.UCSD.EDU } [domain_realm] .ucsd.edu = AD.UCSD.EDU ucsd.edu = AD.UCSD.EDU .ad.ucsd.edu = AD.UCSD.EDU ad.ucsd.edu = AD.UCSD.EDU [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } This is pretty much the stock krb5.conf after replacing all the example.com/EXAMPLE.COM with ad.ucsd.edu/AD.UCSD.EDU with a very minor tweak [domain_realm] section. -- Sean