title: CentOS 7 SSSD Unable to create GSSAPI-encrypted LDAP connection
body: <p>I am tying to configure SSSD for the first time for CentOS 7, we have one forest but multiple domains:</p>
  
  <pre><code>xx.company.com
  eu.company.com
  na.company.com
  ap.company.com
  </code></pre>
  
  <p>There is already trust relation between domains. I am getting below error:</p>
  
  <pre><code>Sep 16 12:56:46 XXA-ANSTLNX14 [sssd[ldap_child[4201]]]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Client 'host/XXa-anstlnx14.eu.COMPANY.COM@EU.COMPANY.COM' not found in Kerberos database. Unable to create GSSAPI-encrypted LDAP connection.
  </code></pre>
  
  <p>Below is Kerberos Configuration file:</p>
  
  <pre><code>cat /etc/krb5.conf
  [logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
  
  [libdefaults]
  default_realm = EU.COMPANY.COM
  dns_lookup_realm = false
  dns_lookup_kdc = false
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true
  rdns = false
  default_ccache_name = KEYRING:persistent:%{uid}
  
  [realms]
  XX.COMPANY.COM = {
  kdc = XXa-XXdc01.XX.COMPANY.COM
  kdc = XXc-XXdc01.XX.COMPANY.COM
  kdc = XXs-XXdc01.XX.COMPANY.COM
  admin_server = XXa-XXdc01.XX.COMPANY.COM
  default_domain = XX.COMPANY.COM
  }
  EU.COMPANY.COM = {
  kdc = XXa-eudc01.eu.COMPANY.COM
  kdc = XXc-eudc01.eu.COMPANY.COM
  kdc = XXs-eudc01.eu.COMPANY.COM
  admin_server = XXa-eudc01.eu.COMPANY.COM
  default_domain = eu.COMPANY.COM
  }
  NA.COMPANY.COM = {
  kdc = XXa-nadc01.na.COMPANY.COM
  kdc = XXc-nadc01.na.COMPANY.COM
  kdc = XXs-nadc01.na.COMPANY.COM
  admin_server = XXa-nadc01.na.COMPANY.COM
  default_domain = na.COMPANY.COM
  }
  AP.COMPANY.COM = {
  kdc = XXa-apdc01.ap.COMPANY.COM
  kdc = XXc-apdc01.ap.COMPANY.COM
  kdc = XXs-apdc01.ap.COMPANY.COM
  admin_server = XXa-apdc01.ap.COMPANY.COM
  default_domain = ap.COMPANY.COM
  }
  DMZ.COMPANY.COM = {
  kdc = XXa-dmzdc01.dmz.COMPANY.COM
  kdc = XXc-dmzdc01.dmz.COMPANY.COM
  kdc = XXs-dmzdc01.dmz.COMPANY.COM
  admin_server = XXa-dmzdc01.dmz.COMPANY.COM
  default_domain = dmz.COMPANY.COM
  }
  COMPANY.COM = {
  kdc = XXa-autdc01.COMPANY.COM
  kdc = XXc-autdc01.COMPANY.COM
  kdc = XXs-autdc01.COMPANY.COM
  admin_server = XXa-autdc01.COMPANY.COM
  default_domain = COMPANY.COM
  }
  
  [domain_realm]
  .XX.COMPANY.COM = XX.COMPANY.COM
  XX.COMPANY.COM = XX.COMPANY.COM
  .eu.COMPANY.COM = EU.COMPANY.COM
  eu.COMPANY.COM = EU.COMPANY.COM
  .na.COMPANY.COM = NA.COMPANY.COM
  na.COMPANY.COM = NA.COMPANY.COM
  .ap.COMPANY.COM = AP.COMPANY.COM
  ap.COMPANY.COM = AP.COMPANY.COM
  .dmz.COMPANY.COM = DMZ.COMPANY.COM
  dmz.COMPANY.COM = DMZ.COMPANY.COM
  .COMPANY.COM = COMPANY.COM
  </code></pre>
  
  <p>I am not sure if this is a Kerberos configuration issue (so far I see there is keytab file generated) or this is something to be tuned in SSSD</p>
  
  <pre><code># klist -kte
  Keytab name: FILE:/etc/krb5.keytab
  KVNO Timestamp         Principal
  ---- ----------------- --------------------------------------------------------
     3 09/16/19 13:46:43 host/xxxa-anstlnx19.xxx.COMPANY.COM@xxx.COMPANY.COM (des-cbc-crc)
     3 09/16/19 13:46:43 host/xxxA-ANSTLNX19@xxx.COMPANY.COM (des-cbc-crc)
     3 09/16/19 13:46:43 host/xxxa-anstlnx19.xxx.COMPANY.COM@xxx.COMPANY.COM (des-cbc-md5)
     3 09/16/19 13:46:43 host/xxxA-ANSTLNX19@xxx.COMPANY.COM (des-cbc-md5)
     3 09/16/19 13:46:43 host/xxxa-anstlnx19.xxx.COMPANY.COM@xxx.COMPANY.COM (aes128-cts-hmac-sha1-96)
     3 09/16/19 13:46:43 host/xxxA-ANSTLNX19@xxx.COMPANY.COM (aes128-cts-hmac-sha1-96)
     3 09/16/19 13:46:43 host/xxxa-anstlnx19.xxx.COMPANY.COM@xxx.COMPANY.COM (aes256-cts-hmac-sha1-96)
     3 09/16/19 13:46:43 host/xxxA-ANSTLNX19@xxx.COMPANY.COM (aes256-cts-hmac-sha1-96)
     3 09/16/19 13:46:43 host/xxxa-anstlnx19.xxx.COMPANY.COM@xxx.COMPANY.COM (arcfour-hmac)
     3 09/16/19 13:46:43 host/xxxA-ANSTLNX19@xxx.COMPANY.COM (arcfour-hmac)
     3 09/16/19 13:46:43 xxxA-ANSTLNX19$@xxx.COMPANY.COM (des-cbc-crc)
     3 09/16/19 13:46:43 xxxA-ANSTLNX19$@xxx.COMPANY.COM (des-cbc-md5)
     3 09/16/19 13:46:43 xxxA-ANSTLNX19$@xxx.COMPANY.COM (aes128-cts-hmac-sha1-96)
     3 09/16/19 13:46:43 xxxA-ANSTLNX19$@xxx.COMPANY.COM (aes256-cts-hmac-sha1-96)
     3 09/16/19 13:46:43 xxxA-ANSTLNX19$@xxx.COMPANY.COM (arcfour-hmac)
  </code></pre>
  
  <p>Thanks</p>