[libdefaults]
default_keytab_name = /etc/krb5.keytab
default_realm = AUTOLAB.LOCAL
default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC
default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC
preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC
dns_lookup_kdc = true
pkinit_kdc_hostname = <DNS>
pkinit_anchors = DIR:/var/trusted_certs
pkinit_cert_match = <EKU>msScLogin
pkinit_eku_checking = kpServerAuth
pkinit_win2k_require_binding = false
pkinit_identities = PKCS11:/opt/likewise/lib64/libpkcs11wrapper.so
# default_realm = EXAMPLE.COM
[realms]
AUTOLAB.LOCAL = {
auth_to_local = RULE:[1:$0\$1](^AUTOLAB\.LOCAL\\.*)s/^AUTOLAB\.LOCAL/AUTOLAB/
auth_to_local = RULE:[1:$0\$1](^AUTOLAB\.LOCAL\\.*)s/^AUTOLAB\.LOCAL/AUTOLAB/
auth_to_local = DEFAULT
}
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMON
[domain_realm]
.autolab.local = AUTOLAB.LOCAL
[appdefaults]
pam = {
mappings = AUTOLAB\\(.*) [email protected]
forwardable = true
validate = true
}
httpd = {
mappings = AUTOLAB\\(.*) [email protected]
reverse_mappings = (.*)@AUTOLAB\.LOCAL AUTOLAB\$1
}