Server Requirements

To authenticate users, the server that Cockpit is running on must be joined to a domain. This can usually be accomplished using the realm join example.com command.

The domain must be resolveable by DNS. For instance, the SRV records of the kerberos server should be resolveable:

$ host -t SRV  _kerberos._udp.example.com
_kerberos._udp.example.com has SRV record 0 100 88 dc.example.com

The server running Cockpit should have a fully qualified name that ends with the domain name.

There must be a valid Kerberos host key for the server in the /etc/krb5.keytab file. It may be necessary to create a kerberos service principal and update the keytab if it is not present. Depending on your domain type different service names are required:

Active Directory

HOST/server.example.com@EXAMPLE.COM

IPA and MIT

HTTP/server.example.com@EXAMPLE.COM

The following command can be used to list the /etc/krb5.keytab:

$ sudo klist -k

Lastly accounts from the domain must be resolveable to unix accounts on the server running Cockpit. For example:

$ getent passwd user@example.com
user@example.com:*:381001109:381000513:User Name:/home/user:/bin/sh