You get *mostly* working Kerberos. It's not quite that reliable.

noinsight · on July 25, 2017

What issues have you run into? I haven't encountered any problems.

Admittedly I mostly use it for logging into servers with AD accounts (it will autocreate homedirs too!) and access controls via AD groups.

You can permit SSH/sudo access through AD group memberships. SSH works with Kerberos SSO.

cjsuk · on July 25, 2017

Mainly periodic random unexplainable KDC_ERR_C_PRINCIPAL_UNKNOWN which appears to be the Kerberos equivalent of "fuck you!"

dijit · on July 25, 2017

Check your ntp; this happens when kerberos loses trust with the principle.

Happens on Windows too but they mitigate it by _forcing_ you to use NTP against the AD servers.

cjsuk · on July 25, 2017

We already use NTP (chrony) against the DCs.

We did have some problems with timedatectl being a dick in the early days of CentOS 7 which reported NTP as enabled but it wasn't. That caused the same issue but we resolved that one and it still periodically happens.

I can't quote for the state of the DC's though; they're not mine and I don't want them! :)