Not able to add 2nd Powershell host from another domain

[rwtushar]

I am using powershell plugin 1.0.6.

below is the content of my krb5.conf, I was able to add the powershell host for the default_realm but now when I try to add the host from the second domain I am getting below error.

No valid credentials provided (Mechanism level: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)) (Dynamic Script Module name : addPowerShellHost#16)

below is my krb5.conf file. not sure what I am missing here.

[libdefaults]
default_realm=ABC.CORP
udp_preference_limit = 1
dns_lookup_kdc = true
[realms]
ABC.CORP = {
kdc = tc2dcad101.abc.corp
kdc = tc2dcad102.abc.corp
admin_server = tc2dcad101.abc.corp
default_domain = abc.corp

}
123.XYZ.PROD = {
kdc = lontc2dc01.123.xyz.prod
kdc = lontc2dc02.123.xyz.prod
admin_server = lontc2dc01.123.xyz.prod
default_domain = 123.xyz.prod

}
[domain_realms]
tc2dcad101..abc.corp=ABC.CORP
tc2dcad102..abc.corp=ABC.CORP
lontc2dc01.123.xyz.prod=123.XYZ.PROD
lontc2dc02.123.xyz.prod=123.XYZ.PROD

[logging]
default = FILE:/var/log/krb5/krb5kdc.log
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
# default = SYSLOG:NOTICE:DAEMON

[sbeaver]

Have to ask...  Did you reboot vRO after you edited the krb5.conf?

[rwtushar]

Yes it is rebooted.

one more thing is when I use a user which doesn't exists in the AD then I get a different error which confirms it is talking to AD.

[SpasKaloferov]

HI ,

You should use [domain_realm] and not [domain_realms] for a start. You should also have plug-in version 1.0.6.2283945 or above. Check this article for more info:

How to add PowerShell hosts from multiple domains with Kerberos authentication to the same vRO

http://kaloferov.com/blog/how-to-add-powershell-hosts-from-multiple-domains-with-kerberos-authentica...

BR,
Spas Kaloferov

[rwtushar]

Hello Spas,

When I use a user which is not in AD I get a different error which confirms the krb5.conf is good. So now I don’t know what level of permissions are required for the user I am using to add the powershell host to VRO.

Client not found in Kerberos database (6) (Dynamic Script Module name : addPowerShellHost#16)                        

Thanks,

Tushar.

[igaydajiev]

hope you were able to resolve your issue.

In case you are still strugling with it I found few typos in the krb5,conf file

[domain_realms]

tc2dcad101..abc.corp=ABC.CORP

tc2dcad102..abc.corp=ABC.CORP

lontc2dc01.123.xyz.prod=123.XYZ.PROD

lontc2dc02.123.xyz.prod=123.XYZ.PROD

should be changed to

[domain_realms]

abc.corp=ABC.CORP

.abc.corp=ABC.CORP

123.xyz.prod=123.XYZ.PROD

.123.xyz.prod=123.XYZ.PROD

'.' - infront of the domain means mach any host from above domain to this rule and use provided REALM