Should have a working KDC...

config/domains.nix

@@ -40,7 +40,7 @@
       local-groups = [ "fudo" "selby" "admin" ];
       local-admins = [ "niten" ];
       admin-email = "niten@fudo.org";
-      gssapi-realm = "FUDO.ORG";
+      gssapi-realm = "RUS.SELBY.CA";
     };
 
     "informis.land" = {

config/hosts/clunk.nix

@@ -91,8 +91,8 @@ in {
       realm = "RUS.SELBY.CA";
       bind-addresses = [ "10.0.0.1" "127.0.0.1" "[::1]" ];
       acl = {
-        "niten" = { perms = [ "all" ]; };
-        "*/root" = { perms = [ "password" "list" ]; };
+        "niten" = { perms = [ "add" "change-password" "list" ]; };
+        "*/root" = { perms = [ "all" ]; };
       };
     };
 

config/networks/rus.selby.ca.nix

@@ -1,13 +1,13 @@
 { config, lib, ... }:
 
+with lib;
 let local-domain = "rus.selby.ca";
-
 in {
   default-host = "10.0.0.1";
 
   mx = [ "mail.fudo.org" ];
 
-  gssapi-realm = "FUDO.ORG";
+  gssapi-realm = toUpper local-domain;
 
   hosts = {
     clunk = {
@@ -61,11 +61,11 @@ in {
       }];
       kerberos = [{
         port = 88;
-        host = "france.fudo.org";
+        host = "clunk.${local-domain}";
       }];
       kerberos-adm = [{
-        port = 88;
-        host = "france.fudo.org";
+        port = 749;
+        host = "clunk.${local-domain}";
       }];
       ssh = [{
         port = 22;
@@ -80,15 +80,15 @@ in {
       }];
       kerberos = [{
         port = 88;
-        host = "france.fudo.org";
+        host = "clunk.${local-domain}";
       }];
       kerboros-master = [{
         port = 88;
-        host = "france.fudo.org";
+        host = "clunk.${local-domain}";
       }];
       kpasswd = [{
         port = 464;
-        host = "france.fudo.org";
+        host = "clunk.${local-domain}";
       }];
     };
   };

config/profiles/common.nix

@@ -25,15 +25,22 @@ in {
   krb5 = {
     enable = true;
 
+    appdefaults = {
+      forwardable = true;
+      proxiable = true;
+      encrypt = true;
+      forward = true;
+    };
+
     libdefaults = {
       allow_weak_crypto = false;
       dns_lookup_kdc = true;
+      dns_lookup_realm = true;
       forwardable = true;
-      ignore_acceptor_hostname = true;
-      noaddresses = true;
-      rdns = false;
       proxiable = true;
     };
+
+    kerberos = pkgs.heimdalFull;
   };
 
   services = {