I'm using SSSD on my Debian 13 Linux machines to connect to Active Directory and everything is working smoothly with Kerberos authentication for SSH. Recently, I added a new Service Principal Name (SPN) to the computer object in AD using the command: `setspn -A host/test.domain.com server1$`. However, when I run `adcli update --verbose`, it shows that the SPN was added, but it's not appearing in the keytab file when I check with `klist -k`. The only solution I've found is to leave the realm and rejoin AD, which refreshes the keytab properly. Is there another method to update the keytab without having to go through the rejoining process?
3 Answers
Have you tried using `adcli update` with the `--add-service-principal` option? That might do the trick for you!
Another quick solution could be running `sss_cache -E`. It might help refresh the SSSD cache and allow the SPN to show up in the keytab sooner. Have you given that a shot?
I tried that but it didn't seem to make any difference for me.
Sometimes SPNs can take a while to propagate through the domain. You might want to compare key versions between the keytab and the domain using commands like `kinit` or `kvno` to check their versions. That might give you a clue if there's a replication issue going on.
Yeah, I've noticed that too! AD replication can really slow things down. I think making all replication happen immediately could help, but it usually needs to be done carefully to avoid throwing everything out of sync.
It worked like a charm! I used `adcli update --add-service-principal=host/test.domain.com` and it finally got added to the keytab. Now I can SSH in with Kerberos using the new SPN. Thanks for the help!