If you weren’t able to succeed in integrating Active Directory into Linux, don’t worry. This page will show you how to test Kerberos authentication and join the Active Directory domain manually so you can identify the problem.

Launch the terminal window and type in the highlighted items below.

Test the Kerberos authentication

Kerberos is an authentication mechanism used by Active Directory to verify user or host identity. We will use kinit, an executable used to obtain Kerberos access granting ticket, to test the Kerberos authentication mechanism.

[root@mail ~]# kinit bugsbunny

Change bugsbunny to any Active Directory user account.

If it replies

  • Cannot resolve network address for KDC in requested realm while getting initial credentials

    DNS problem, check the DNS or use ip addresses in the Domain Controllers field of the Winbind Settings.

  • Cannot find KDC for requested realm while getting initial credentials

    Check the spelling of your Active Directory realm and check the spelling in Winbind Settings. Capitalization is important.

  • Client not found in Kerberos database while getting initial credentials

    Check the user name you used if it exists in Active Directory.

  • Cannot contact any KDC for requested realm while getting initial credentials

    Check if the domain controller you specified in Winbind Settings is indeed working is not firewalled.

See Winbind Setting for RHEL/CentOS 5
See Winbind Setting for RHEL/CentOS 4

Password for bugsbunny@ACME.LOCAL: type in the password here

If it replies

  • Preauthentication failed while getting initial credentials

    It means the password is wrong.

  • Password has expired while getting initial credentials

    The password is no longer valid and needs to be changed.

  • Clock skew too great while getting initial credentials

    Synchronize your clocks using NTP. For a quick and temporary fix, use net time set to synchronize time with the domain controller.

Join the Active Directory Domain

[root@mail ~]# net ads join -U administrator

Replace administrator with any user name having Domain Admin rights. Specify your password when asked. You should be able to join the Active Directory domain now.

***
Posted on 4/25/2007 and last updated on 10/31/2008
Filed under Active Directory , Kerberos , Samba


Share This