From 549a960554f44e79d74c65d9f889ccaef497b11d Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 19 Apr 2018 09:38:47 +0200 Subject: [PATCH] MAN: Document which principal does the AD provider use MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Administrators are often confused by the difference between what principal is used to authenticate to AD. Let's document that. Reviewed-by: Pavel Březina (cherry picked from commit 91d1e4c134b7c90abd2ff86b313175c542cd834c) --- src/man/include/ad_modified_defaults.xml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/man/include/ad_modified_defaults.xml b/src/man/include/ad_modified_defaults.xml index c41b454f8..818a2bf78 100644 --- a/src/man/include/ad_modified_defaults.xml +++ b/src/man/include/ad_modified_defaults.xml @@ -58,6 +58,22 @@ ldap_use_tokengroups = true + + + ldap_sasl_authid = sAMAccountName@REALM (typically SHORTNAME$@REALM) + + + The AD provider looks for a different principal than the + LDAP provider by default, because in an Active Directory + environment the principals are divided into two groups + - User Principals and Service Principals. Only User + Principal can be used to obtain a TGT and by default, + computer object's principal is constructed from + its sAMAccountName and the AD realm. The well-known + host/hostname@REALM principal is a Service Principal + and thus cannot be used to get a TGT with. + + -- 2.14.3