Kerberos を使用した SAP セキュアネットワークコミュニケーション接続の設定

[libdefaults]
    # "dns_canonicalize_hostname" and "rdns" are better set to false for improved security.
    # If set to true, the canonicalization mechanism performed by Kerberos client may
    # allow service impersonification, the consequence is similar to conducting TLS certificate
    # verification without checking host name.
    # If left unspecified, the two parameters will have default value true, which is less secure.
    dns_canonicalize_hostname = false
    rdns = false
    #   default_realm = EXAMPLE.COM
        default_realm = SSODOMAIN.LAB

[realms]
    #       EXAMPLE.COM = {
    #                kdc = kerberos.example.com
    #               admin_server = kerberos.example.com
    #       }
SSODOMAIN.LAB = {
                kdc = DC.SSODOMAIN.LAB
               admin_server = dc.SSODOMAIN.LAB
       }
[domain_realm]
  .ssodomain.lab = SSODOMAIN.LAB
   ssodomain.lab = SSODOMAIN.LAB

[logging]
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON

[libdefaults]
    default_ccache_name = FILE:/tmp/krb5cc_%{uid}