etc_krb5.conf

[libdefaults]
 default_realm = CERN.CH
 ticket_lifetime = 25h
 renew_lifetime = 120h
 forwardable = true
 proxiable = true
 default_tkt_enctypes = arcfour-hmac-md5 aes256-cts aes128-cts des3-cbc-sha1 des-cbc-md5 des-cbc-crc
 allow_weak_crypto = true

[realms]
 CERN.CH = {
  default_domain = cern.ch
  kpasswd_server = afskrb5m.cern.ch
  admin_server = afskrb5m.cern.ch
  kdc = cerndc.cern.ch:88

  v4_name_convert = {
     host = {
         rcmd = host
     }
  }
 }

 FNAL.GOV = {
  default_domain = fnal.gov
  admin_server = krb-fnal-admin.fnal.gov
  kdc = krb-fnal-1.fnal.gov:88 
  kdc = krb-fnal-2.fnal.gov:88 
  kdc = krb-fnal-3.fnal.gov:88 
  kdc = krb-fnal-4.fnal.gov:88 
  kdc = krb-fnal-cms188.fnal.gov:88
  kdc = krb-fnal-cms204.fnal.gov:88
  master_kdc = krb-fnal-admin.fnal.gov:88
 }

 KFKI.HU = {
  kdc = kerberos.kfki.hu
  admin_server = kerberos.kfki.hu
 } 

 HEP.MAN.AC.UK = {
  kdc = afs4.hep.man.ac.uk
  kdc = afs1.hep.man.ac.uk
  kdc = afs2.hep.man.ac.uk
  kdc = afs3.hep.man.ac.uk
  admin_server = afs4.hep.man.ac.uk
  kpasswd_server = afs4.hep.man.ac.uk
  default_domain = hep.man.ac.uk
 }
[domain_realm]
 .cern.ch = CERN.CH
 .fnal.gov = FNAL.GOV
 .kfki.hu = KFKI.HU
 .hep.man.ac.uk = HEP.MAN.AC.UK
[appdefaults]
   pkinit_pool =  DIR:/etc/pki/tls/certs/
   pkinit_anchors = DIR:/etc/pki/tls/certs/
; options for Red Hat pam_krb5-2
 pam = {
   external = true
   ticket_lifetime = 25h
 }