linux-krb5.conf

includedir /etc/krb5.conf.d/

# depending on your config, you may wish to uncomment the following:
# includedir /var/lib/sss/pubconf/krb5.include.d/

[libdefaults]
  default_ccache_name = FILE:/tmp/krb5cc_%{uid}
  default_realm = IPA.REDHAT.COM
  dns_lookup_realm = true
  dns_lookup_kdc = true
  rdns = false
  dns_canonicalize_hostname = false
  ticket_lifetime = 24h
  forwardable = true
  udp_preference_limit = 0

[realms]

    REDHAT.COM = {
        default_domain = redhat.com
        dns_lookup_kdc = true
        master_kdc = kerberos.corp.redhat.com
        admin_server = kerberos.corp.redhat.com
    }

    #make sure to save the IPA CA cert
    #mkdir /etc/ipa && curl -o /etc/ipa/ca.crt https://password.corp.redhat.com/ipa.crt
    IPA.REDHAT.COM = {
       pkinit_anchors = FILE:/etc/ipa/ca.crt
       pkinit_pool = FILE:/etc/ipa/ca.crt
       default_domain = ipa.redhat.com
       dns_lookup_kdc = true
       # Trust tickets issued by legacy realm on this host
       auth_to_local = RULE:[1:$1@$0](.*@REDHAT\.COM)s/@.*//
       auth_to_local = DEFAULT
    }

#DO NOT ADD A [domain_realms] section
#https://mojo.redhat.com/docs/DOC-1166841