#127.0.1.1      T03-1C11.rd.vvv T03-1C11

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.98.38.121 t03-1c11.fd.local
10.98.38.122 t03-1c12.fd.local
10.98.38.121 t03-1c11.fd.local
10.98.38.122 t03-1c12
10.98.38.121 t03-1c11```

/etc/krb5.conf:

[libdefaults]
default_realm = FD.LOCAL
dns_lookup_kdc = true
dns_lookup_realm = true
rdns = false
[domain_realm]
.fd.local = FD.LOCAL
fd.local = FD.LOCAL


Keytab сгенерирован: ktpass -princ usr1cv8/t03-1c11.fd.local@FD.LOCAL -mapuser usr1cv8 -pass "hg4FT%#7" -ptype KRB5_NT_SRV_HST -out C:\Temp\usr1cv8.keytab

Права:

chown usr1cv8:grp1cv8 /etc/1C/usr1cv8.keytab
chmod 400 /etc/1C/usr1cv8.keytab

SPN: setspn -A 1CV8/t03-1c11.fd.local usr1cv8

В сервисе указан конфиг:

[Unit]
Description=1C:Enterprise Server 8.3 (8.3.27.1719) (%I)
Requires=network.target

[Service]
# 1C:Enterprise server keytab file.
# default - usr1cv83.keytab file in 1C:Enterprise server
#           installation directory
#
#Environment=SRV1CV8_KEYTAB=/opt/1cv8/x86_64/8.3.27.1719/usr1cv8.keytab
Environment=KRB5_KTNAME=/etc/1C/usr1cv8.keytab
Environment=SRV1CV8_KEYTAB=/etc/1C/usr1cv8.keytab

Билет получаю:


root@t03-1c11:/var/log/1c/rphost_324787# klist -k -K /etc/1C/usr1cv8.keytab
Keytab name: FILE:/etc/1C/usr1cv8.keytab
KVNO Principal
---- --------------------------------------------------------------------------
  11 usr1cv8/t03-1c11.fd.local@FD.LOCAL (0xe83db1d72a4a26bfd4375fdfe9563cb0)
root@t03-1c11:/var/log/1c/rphost_324787# echo ${AD_REALM}
FD.LOCAL
root@t03-1c11:/var/log/1c/rphost_324787# kinit -k -t /etc/1C/usr1cv8.keytab "usr1cv8/$(hostname -f)@${AD_REALM}"
root@t03-1c11:/var/log/1c/rphost_324787# klist
Ticket cache: FILE:/tmp/krb5cc_usr1cv8
Default principal: usr1cv8/t03-1c11.fd.local@FD.LOCAL

Valid starting       Expires              Service principal
23.09.2025 18:57:53  24.09.2025 04:57:53  krbtgt/FD.LOCAL@FD.LOCAL
        renew until 24.09.2025 18:57:52


SSO не отрабатывает. В 1С писал при указании уз домен в нижнем регистре, так и в верхнем:

\\FD.LOCAL\УЗ
\\fd.local\УЗ

В технологическом журнале:

```939  24:41.119008-0,EXCP,2,level=INFO,process=rphost,OSThread=324828,t:clientID=34,Descr='GSS-API error gss_acquire_cred: No credentials were supplied, or the credentials were unavailable or inaccessible
'
  940  24:41.119009-0,EXCP,2,level=INFO,process=rphost,OSThread=324828,t:clientID=34,Descr='GSS-API error gss_acquire_cred: Permission denied```