samba - Aug 2006 - wbinfo: Client not found in Kerberos database

Hi,

I'm trying to get winbind going per:

<http://samba.org/samba/docs/man/Samba3-HOWTO/winbind.html>

I get as far as joining the domain with:

# net join -U Administrator
Administrator's password:
realm must be set in in smb.conf for ADS join to succeed.
ADS join did not work, falling back to RPC...
Joined domain MYDOMAIN.

Winbind starts fine, but when I try to get users or groups:

# wbinfo -u
Error looking up domain users

A look at the log shows:

libads/kerberos.c:ads_kinit_password(164)
  kerberos_kinit_password host/MYHOST@MYDOMAIN.LOCAL failed: Client
not found in Kerberos database
 nsswitch/winbindd_ads.c:ads_cached_connection(109)
  ads_connect for domain MYDOMAIN failed: Client not found in Kerberos
database

Some querying shows:

# wbinfo --domain-info=MYDOMAIN
Name              : MYDOMAIN
Alt_Name          : MYDOMAIN.LOCAL
SID               : S-1-5-21-1309917255-3401098517-287287619
Active Directory  : Yes
Native            : No
Primary           : Yes
Sequence          : -1

# wbinfo --sequence
SOURCE : 1
BUILTIN : 1
MYDOMAIN : DISCONNECTED

Noting the "DISCONNECTED" I tried to join the domain with:

# net ads join -U Administrator
Administrator's password:
realm must be set in in smb.conf for ADS join to succeed.

I asked my sysadmin what our realm is, but he didn't know what I was
referring to.  I suggested it might have something to do with
Kerberos, and he said we're using ActiveDirectory without Kerberos.
The last time I used Samba was pre-AD days, and I'm at a loss as to
how to troubleshoot this further?

Thanks,

Ian

On Mon, 2006-08-14 at 17:48 -0700, Ian Brandt wrote:
> # net ads join -U Administrator
> Administrator's password:
> realm must be set in in smb.conf for ADS join to succeed.
and probably you better configure also krb5.conf accordingly
> I asked my sysadmin what our realm is, but he didn't know what I was
> referring to.  I suggested it might have something to do with
> Kerberos, and he said we're using ActiveDirectory without Kerberos.
There exist no such thing like AD without Kerberos, in windows the REALM
is the same as the AD DNS Domain.

Simo.

-- 
Simo Sorce
Samba Team GPL Compliance Officer
email: idra@samba.org
http://samba.org