On 12/12/2018 09:39 AM, Angel Kafazov wrote:> I need to migrate
principals from one kerberos server to another. Both
> servers have different realms. Is this possible?
It's tricky. If a principal has a password-based key, by default the
key is salted with the concatenation of the realm and principal name,
like "ATHENA.MIT.EDUraeburn". If you move the principal entry to the
new realm, the default salt changes and clients will compute the wrong key.
A workaround is to run kadmin's "renprinc" command on the principal
entry before migrating it, and then rename it back to what it was.
renprinc records the old default salt as an explicit salt in the
principal key data, effectively fixing its value so that the correct
salt will be presented to clients in the new realm.
I believe you will also need to use kdb5_util dump's "-mkey_convert"
option so that the principal key data will be encrypted in the master
key of the new realm.
This thread contains more details (but the use case was a full realm
rename, not migrating principal entries):