We have an IPA client in the NWRA.COM realm and are trying to do a krb5 nfs mount from a Windows server in the AD.NWRA.COM realm. The two realms are connected by a two way trust. Mounting of CIFS shares works fine.
# mount -t nfs -v -o sec=krb5,vers=4.1 SERVER.ad.nwra.com:test_nfs /mnt mount.nfs: timeout set for Mon Aug 18 16:11:46 2025 mount.nfs: trying text-based options 'sec=krb5,vers=4.1,addr=10.X.X.X,clientaddr=10.X.X.X' mount.nfs: mount(2): Permission denied mount.nfs: access denied by server while mounting SERVER.ad.nwra.com:test_nfs
I think this is the issue:
Aug 18 16:09:48 gssproxy[1121023]: [CID 11][2025/08/18 23:09:48]: gp_rpc_execute: executing 8 (GSSX_INIT_SEC_CONTEXT) for ser vice "nfs-client", euid: 0,socket: (null) Aug 18 16:09:48 gssproxy[1121023]: GSSX_ARG_INIT_SEC_CONTEXT( call_ctx: { "" [ ] } context_handle: <Null> cred_handle: { "host/CLIENT.mry.nwra.com@NWRA.COM" [ { "host/CLIENT.mry.nwra.com@NWRA.COM" { 1 2 840 113554 1 2 2 } INITIATE 84879 0 [ { [ krb5.set.allowed... ] [ ................... ] } ] } ] [ .............2..... ] 0 } target_name: "nfs@SERVER.ad.nwra.com" mech_type: { 1 2 840 113554 1 2 2 } req_flags: 2 time_req: 0 input_cb: <Null> input_token: <Null> [ { [ sync.modified.cr... ] [ 64656661756c740 ] } ] ) Aug 18 16:09:48 gssproxy[1121023]: [CID 11][2025/08/18 23:09:48]: Credentials allowed by configuration Aug 18 16:09:48 gssproxy[1121023]: GSSX_RES_INIT_SEC_CONTEXT( status: { 851968 { 1 2 840 113554 1 2 2 } 2529638919 "Unspe cified GSS failure. Minor code may provide more information" "Server krbtgt/AD.NWRA.COM@NWRA.COM not found in Kerberos datab ase" [ ] } context_handle: <Null> output_token: <Null> ) Aug 18 16:09:48 rpc.gssd[1120142]: WARNING: Failed to create krb5 context for user with uid 0 for server nfs@SERVER.ad. nwra.com Aug 18 16:09:48 rpc.gssd[1120142]: WARNING: Failed to create machine krb5 context with cred cache FILE:/tmp/krb5ccmachine_NWR A.COM for server SERVER.ad.nwra.com Aug 18 16:09:48 rpc.gssd[1120142]: ERROR: Failed to create machine krb5 context with any credentials cache for server SERVER.ad.nwra.com Aug 18 16:09:48 rpc.gssd[1120142]: do_error_downcall(0x7f69a33a7700): uid 0 err -13 Aug 18 16:09:48 rpc.gssd[1120142]: destroying client nfs/clnt59 Aug 18 16:09:48 rpc.gssd[1120142]: freeing client nfs/clnt59 Aug 18 16:09:48 rpc.gssd[1120142]: destroying client nfs/clnt58
Shouldn't krbtgt/AD.NWRA.COM@NWRA.COM be krbtgt/AD.NWRA.COM@AD.NWRA.COM?