# Cross-domain auth using Kerberos

**URL:** <https://forum.ansible.com/t/cross-domain-auth-using-kerberos/33574>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [August 10, 2020, 7:42am UTC](https://forum.ansible.com/t/cross-domain-auth-using-kerberos/33574 "2020-08-10T07:42:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Richter](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@Michael\_Richter](https://forum.ansible.com/u/Michael_Richter)\
**Post date:** [August 10, 2020, 7:42am UTC](https://forum.ansible.com/t/cross-domain-auth-using-kerberos/33574/1 "2020-08-10T07:42:41Z")

</div>

Hi,  
On a Linux server I want to access a Windows server from Windows domain _sub.dnsdomain_ using an account from parent Windows domain _dnsdomain_. The account has admin permissions to that server and can login using RDP.

I have configured Kerberos realms for both domains on the Linux server. I can than get a Kerberos ticket using kinit user. I can access servers from _dnsdomain_. But I can not access the server from _sub.dnsdomain_.

[libdefaults]  
default\_realm = DNSDOMAIN  
dns\_lookup\_realm = false  
#ticket\_lifetime = 24h  
renew\_lifetime = 7d  
rdns = false  
default\_tkt\_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5  
default\_tgs\_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5  
permitted\_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5  
ticket\_lifetime = 600  
kdc\_timesync = 1  
ccache\_type = 4

# The following krb5.conf variables are only for MIT Kerberos.

kdc\_timesync = 1  
ccache\_type = 4  
forwardable = true  
proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.

fcc-mit-ticketflags = true

[realms]  
DNSDOMAIN = {  
kdc = dc1.dnsdomain:88  
kdc = dc2.dnsdomain:88  
admin\_server = dc1.dnsdomain:749  
default\_domain = dnsdomain  
}  
SUB.DNSDOMAIN = {  
kdc = subdc1.sub.dnsdomain:88  
kdc = subdc2.sub.dnsdomain:88  
admin\_server = subdc1.sub.dnsdomain:749  
default\_domain = sub.dnsdomain  
}

[domain\_realm]  
.dnsdomain = DNSDOMAIN  
dnsdomain = DNSDOMAIN  
.sub.dnsdomain = SUB.DNSDOMAIN  
sub.dnsdomain = SUB.DNSDOMAIN

[appdefaults]  
autologin = true  
forward = true  
forwardable = true  
encrypt = true

Note: The Windows domain name differs from the DNS names. I’m not using it in Kerberos config.

Than I can do this:

$ kinit user  
Password for user@DNSDOMAIN:  
$ klist  
Ticket cache: FILE:/tmp/krb5cc\_1000  
Default principal: user@DNSDOMAIN

Valid starting Expires Service principal  
07.08.2020 14:06:07 07.08.2020 14:16:00 krbtgt/DNSDOMAIN@DNSDOMAIN  
renew until 10.08.2020 14:06:07  
$ rpcclient server.dnsdomain -k  
rpcclient $\> srvinfo  
XXXXXXX  
platform\_id : 500  
os version : 6.3  
server type : 0x801013  
rpcclient $\> quit  
$ rpcclient subserver.sub.dnsdomain -k  
Cannot connect to server. Error was NT\_STATUS\_LOGON\_FAILURE

If I try to connect via Ansible/WinRM to the server in subdomain I get the error:

Server not found in Kerberos database

How to get access to the server in subdomain using an account from parent domain?

---

<div class="post-metadata">

**Author:** ![Michael\_Richter](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@Michael\_Richter](https://forum.ansible.com/u/Michael_Richter)\
**Post date:** [August 18, 2020, 10:47am UTC](https://forum.ansible.com/t/cross-domain-auth-using-kerberos/33574/2 "2020-08-18T10:47:19Z")

</div>

OK, threw away Kerberos and switched to NTLM which works great.