Hi,
I am trying to setup cross domain trust between FreeIPA and MIT Kerberos. I have already created krbtgt in the both FreeIPA and MIT Kerberos. I can successfully get Kerberos ticket from the both domains.However when I try to access Hadoop using the FreeIPA domain then I get this error in trace log. Wondering what is missing? Service ticket not found in the subject >>> Realm doInitialParse: cRealm=[TEST.COM], sRealm=[TEST2.COM] >>> Realm parseCapaths: no cfg entry >>> Credentials acquireServiceCreds: main loop: [0] tempService=krbtgt/ test2....@test.com Using builtin default etypes for default_tgs_enctypes default etypes for default_tgs_enctypes: 18 17 16 23 1 3. >>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType getKDCFromDNS using UDP >>> KrbKdcReq send: kdc=test2company.com. UDP:88, timeout=30000, number of retries =3, #bytes=701 >>> KDCCommunication: kdc=test2company.com. UDP:88, timeout=30000,Attempt =1, #bytes=701 >>> KrbKdcReq send: #bytes read=637 >>> KdcAccessibility: remove test2company.com.:88 >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType >>> Credentials acquireServiceCreds: global OK-AS-DELEGATE turned off at krbtgt/test2....@test.com >>> Credentials acquireServiceCreds: got tgt >>> Credentials acquireServiceCreds: got right tgt >>> Credentials acquireServiceCreds: obtaining service creds for nn/ testcompany....@test2.com Using builtin default etypes for default_tgs_enctypes default etypes for default_tgs_enctypes: 18 17 16 23 1 3. >>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType >>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType >>> KrbKdcReq send: kdc=testcompany.com UDP:88, timeout=30000, number of retries =3, #bytes=662 >>> KDCCommunication: kdc=testcompany.com UDP:88, timeout=30000,Attempt =1, #bytes=662 >>> KrbKdcReq send: #bytes read=150 >>> KdcAccessibility: remove testcompany.com >>> KDCRep: init() encoding tag is 126 req type is 13 >>>KRBError: cTime is Sun Jun 01 13:55:49 EDT 1975 170877349000 sTime is Sat Apr 09 15:01:16 EDT 2016 1460228476000 suSec is 693381 error code is 31 error Message is Integrity check on decrypted field failed realm is TEST2.COM sname is nn/testcompany.com msgType is 30
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project