may i ask if you configured your krb5 environment (config files)? and if you dont know anything about krb5, can you explain what you are trying to do?

ok. make sure they set /etc/krb5/krb5.conf as the default mit/heimdal krb5.conf is in /etc.

here is a /etc/krb5/krb5.conf for my test ad 2k3 domain (change the domain to match yours if you so choose to use this example)

[libdefaults]
default_realm = MAILME.COM
default_tkt_enctypes = des-cbc-md5 des-cbc-crc
default_tgs_enctypes = des-cbc-md5 des-cbc-crc

[realms]
MAILME.COM = {
kdc = server2k.mailme.com:88
admin_server = server2k.mailme.com:749
}

[domain_realm]
.mailme.com = MAILME.COM
mailme.com = MAILME.COM


[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log
kdc_rotate = {
period = 1d
versions = 10
}
[appdefaults]
kinit = {
renewable = true
forwardable= true
}
gkadmin = {
help_url = http://docs.sun.com:80/ab2/coll.384.1/SEAM/@AB2PageView/1195
}


there are various ways to build a working krb5 config file out there. however this is a base setup i use. feel free to test or use some of the other means available out there.

here is one example: [http://blog.scottlowe.org/?p=447]
and a bigadmin article: [http://wikis.sun.com/display/BigAdmin/Using%20Kerberos%20to%20Authenticate%20a%20Solaris%2010%20OS%20LDAP%20Client%20With%20Microsoft%20Active%20Directory]

Edited by: sid_sanders on Jun 9, 2008 9:37 AM

solaris comes with kerberos exes/libs installed (for most installation selections). you have to configure the krb5.conf to make things begin to work from the client side. AD can be 2000 or 2003. mit or heimdal are open source krb5 vers. they can be configured to have krb5.conf in diff places however the default is in /etc. so i was just trying to make sure you dont make changes to the wrong solaris krb5.conf

it can. if you want to use krb5 tickets for telnet/ftp/ssh (if configured and available) it would be useful to have dns functioning. make sure you have /etc/resolv.conf configured along with /etc/nsswitch.conf (hosts: files dns).

does klist -e show anything? are you ok now?

klist -e shows you encryption type of any tickets you may have. things look ok from that listing. there may be other steps you can do however as you said, you need to hear some more before doing much else.