[Samba] Failed to establish your Kerberos Ticket cache due time differences with the domain controller

[Rowland Penny]

On Tue, 24 Jul 2018 10:32:32 +0100
Roy Eastwood via samba <samba at lists.samba.org> wrote:

> 
> 
> > -----Original Message-----
> > From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of
> > L.P.H. van Belle via samba
> > Sent: 24 July 2018 09:41
> > To: samba at lists.samba.org
> > Subject: Re: [Samba] Failed to establish your Kerberos Ticket cache
> > due time differences with the domain controller
> > 
> > I did re-read the whole thread again.
> > 
> > Im running out of options..
> > 
> > When i look at :
> > https://wiki.samba.org/index.php/PAM_Offline_Authentication
> > You can do these last checks.
> > 
> > Run the :  Testing offline authentication as show on the wiki.
> 
> I added winbind offline login = yes to the smb.conf file and
> restarted samba-ad-dc.   But as winbind/winbindd is not started
> separately I couldn't work out how to take winbind offline.
> "smbcontrol winbind offline" doesn't seem to do anything.
> 

Adding that line to a DC does not make sense, it is only any use on
something like a laptop, these have been known to wander away from the
domain ;-)
A DC cannot wander away from itself.

> 
> > Check if these packages are installed.
> > libpam-krb5

Install this package, it isn't part of Samba

Rowland