Re: Setting rdns = false causing "cannot determine realm" error

On 2/2/19 9:22 AM, Adam Lewenberg wrote:
> If rdns is set to "true" then everything works. However, when set to
> "false" we see the message "Error: Unspecified GSS failure.  Minor code
> may provide more information (Cannot determine realm for numeric host
> address)"

It sounds like the client program is resolving the name to an IP
address, then importing a host-based GSS name like "[email protected]".  With
rdns=true, MIT krb5 will reverse-resolve 1.2.3.4 to a hostname; with
rdns=false, releases 1.11 and earlier will error out with that message.
 (Later releases would try to use the service principal
"ldap/[email protected]", which would likely also fail.)  The script
probably needs to be changed to pass a hostname to Net::LDAP.

It's also conceivable that Net::LDAP is at fault; I don't know much
about it.  But it seems unlikely that any version of libkrb5 would do a
forward resolution and then try to do a realm lookup of the IP address;
that would render rdns=false a useless configuration.

> Note: I realize that this may not be a Heimdal issue since the client
> uses MIT Kerberos, but I thought I'd take a stab at someone on this list
> having a useful suggestion.

You might try [email protected] for future questions like this.