Коллеги, здравствуйте. Нужна Ваша помощь, не получается настроить 1С через AD.
Дано: 1С 8.3.27.1719, Debian 12.
hostname: t03-1c11.fd.local
etc/hosts:
#127.0.1.1 T03-1C11.rd.vvv T03-1C11
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.98.38.121 t03-1c11.fd.local
10.98.38.122 t03-1c12.fd.local
10.98.38.121 t03-1c11.fd.local
10.98.38.122 t03-1c12
10.98.38.121 t03-1c11```
/etc/krb5.conf:
[libdefaults]
default_realm = FD.LOCAL
dns_lookup_kdc = true
dns_lookup_realm = true
rdns = false
[domain_realm]
.fd.local = FD.LOCAL
fd.local = FD.LOCAL
Keytab сгенерирован: ktpass -princ usr1cv8/t03-1c11.fd.local@FD.LOCAL -mapuser usr1cv8 -pass "hg4FT%#7" -ptype KRB5_NT_SRV_HST -out C:\Temp\usr1cv8.keytab
Права:
chown usr1cv8:grp1cv8 /etc/1C/usr1cv8.keytab
chmod 400 /etc/1C/usr1cv8.keytab
SPN: setspn -A 1CV8/t03-1c11.fd.local usr1cv8
В сервисе указан конфиг:
[Unit]
Description=1C:Enterprise Server 8.3 (8.3.27.1719) (%I)
Requires=network.target
[Service]
# 1C:Enterprise server keytab file.
# default - usr1cv83.keytab file in 1C:Enterprise server
# installation directory
#
#Environment=SRV1CV8_KEYTAB=/opt/1cv8/x86_64/8.3.27.1719/usr1cv8.keytab
Environment=KRB5_KTNAME=/etc/1C/usr1cv8.keytab
Environment=SRV1CV8_KEYTAB=/etc/1C/usr1cv8.keytab
Билет получаю:
root@t03-1c11:/var/log/1c/rphost_324787# klist -k -K /etc/1C/usr1cv8.keytab
Keytab name: FILE:/etc/1C/usr1cv8.keytab
KVNO Principal
---- --------------------------------------------------------------------------
11 usr1cv8/t03-1c11.fd.local@FD.LOCAL (0xe83db1d72a4a26bfd4375fdfe9563cb0)
root@t03-1c11:/var/log/1c/rphost_324787# echo ${AD_REALM}
FD.LOCAL
root@t03-1c11:/var/log/1c/rphost_324787# kinit -k -t /etc/1C/usr1cv8.keytab "usr1cv8/$(hostname -f)@${AD_REALM}"
root@t03-1c11:/var/log/1c/rphost_324787# klist
Ticket cache: FILE:/tmp/krb5cc_usr1cv8
Default principal: usr1cv8/t03-1c11.fd.local@FD.LOCAL
Valid starting Expires Service principal
23.09.2025 18:57:53 24.09.2025 04:57:53 krbtgt/FD.LOCAL@FD.LOCAL
renew until 24.09.2025 18:57:52
SSO не отрабатывает. В 1С писал при указании уз домен в нижнем регистре, так и в верхнем:
\\FD.LOCAL\УЗ
\\fd.local\УЗ
В технологическом журнале:
```939 24:41.119008-0,EXCP,2,level=INFO,process=rphost,OSThread=324828,t:clientID=34,Descr='GSS-API error gss_acquire_cred: No credentials were supplied, or the credentials were unavailable or inaccessible
'
940 24:41.119009-0,EXCP,2,level=INFO,process=rphost,OSThread=324828,t:clientID=34,Descr='GSS-API error gss_acquire_cred: Permission denied```
