Kerberos SSH ticket forwarding with different hostname than realm domain fqdn

Posted on

We are using Active Directory as identity provider in sssd.
We use this for ssh user provisioning and authenticating using Kerberos ticket forwarding feature.
It requires that fqdn of host and fqdn of domain to be joined should be same. But in our environment, we have different fqdn for hostname and different fqdn for AD domain.
Ex -
AD Domain - ad.example.net
Our Current Hostname - server.int.example.com
SSSD/Kerberos expecting hostname - server.ad.example.net

Is there any way via sssd/krb configurations where I can keep my hostname as it is (server.int.example.com) and SSSD/Krb5 will use it as server.ad.example.net

I tried sssd config - ad_hostname,
but seems kerberos ticket forwarding is not working after that.
It prompts password for each login, ideally it should use TGT

PK

Responses