Error setting up ccache for "host" service on client using default keytab: Cannot contact any KDC for requested realm
by rui liang
I did it,
Date - the 2021-08-28 s
for line in `getcert list | grep Request | cut -d "'" -f2`; do getcert resubmit -i $line; done
Now the CA status is all CA_UNREACHABLE
How do I deal with this? It's getting worse. Can you help me? Thank you very much
I see no response, and it's being executed
ipa-cacert-manage renew
ipa-certupdate
root@fs-hiido-kerberos-21-117-149:/var/lib/certmonger/requests# getcert list
Number of certificates and requests being tracked: 8.
Request ID '20190910112327':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=CA Audit,O=YYDEVOPS.COM
expires: 2021-08-30 11:23:07 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/lib/ipa/certmonger/stop_pkicad
post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190910112328':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=OCSP Subsystem,O=YYDEVOPS.COM
expires: 2021-08-30 11:23:06 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
eku: id-kp-OCSPSigning
pre-save command: /usr/lib/ipa/certmonger/stop_pkicad
post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190910112329':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=CA Subsystem,O=YYDEVOPS.COM
expires: 2021-08-30 11:23:07 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib/ipa/certmonger/stop_pkicad
post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190910112330':
status: CA_UNREACHABLE
ca-error: Internal error
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=Certificate Authority,O=YYDEVOPS.COM
expires: 2039-09-10 11:23:06 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
pre-save command: /usr/lib/ipa/certmonger/stop_pkicad
post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190910112331':
status: CA_UNREACHABLE
ca-error: Error 7 connecting to http://fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com:8080/ca/ee/ca...: Couldn't connect to server.
stuck: no
key pair storage: type=NSSDB,location='/etc/apache2/nssdb',nickname='ipaCert',token='NSS Certificate DB',pinfile='/etc/apache2/nssdb/pwdfile.txt'
certificate: type=NSSDB,location='/etc/apache2/nssdb',nickname='ipaCert',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=IPA RA,O=YYDEVOPS.COM
expires: 2021-08-30 11:23:25 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib/ipa/certmonger/renew_ra_cert_pre
post-save command: /usr/lib/ipa/certmonger/renew_ra_cert
track: yes
auto-renew: yes
Request ID '20190910112332':
status: CA_UNREACHABLE
ca-error: Error 7 connecting to https://fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com:8443/ca/agen...: Couldn't connect to server.
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-renew-agent
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com,O=YYDEVOPS.COM
expires: 2021-08-30 11:23:06 UTC
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth
pre-save command: /usr/lib/ipa/certmonger/stop_pkicad
post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20190910112351':
status: CA_UNREACHABLE
ca-error: Error setting up ccache for "host" service on client using default keytab: Cannot contact any KDC for requested realm.
stuck: no
key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-YYDEVOPS-COM',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-YYDEVOPS-COM/pwdfile.txt'
certificate: type=NSSDB,location='/etc/dirsrv/slapd-YYDEVOPS-COM',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com,O=YYDEVOPS.COM
expires: 2023-08-14 11:24:24 UTC
principal name: ldap/fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com(a)YYDEVOPS.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib/ipa/certmonger/restart_dirsrv YYDEVOPS-COM
track: yes
auto-renew: yes
Request ID '20190910112410':
status: CA_UNREACHABLE
ca-error: Error setting up ccache for "host" service on client using default keytab: Cannot contact any KDC for requested realm.
stuck: no
key pair storage: type=NSSDB,location='/etc/apache2/nssdb',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/apache2/nssdb/pwdfile.txt'
certificate: type=NSSDB,location='/etc/apache2/nssdb',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=YYDEVOPS.COM
subject: CN=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com,O=YYDEVOPS.COM
expires: 2023-08-14 11:26:13 UTC
principal name: HTTP/fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com(a)YYDEVOPS.COM
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
1 year, 10 months
Upgrading from EL7.9 to EL8
by Angus Clarke
Hello
I am planning the upgrade of one of our FreeIPA deployments from EL7.9
Previously, we have been quite good at upgrading through OS point upgrades (7.3, 7.4, 7.5 etc) as this was the advice through that series of FreeIPA software.
Upgrading our FreeIPAs from EL7.9 today will see me introduce an EL8 FreeIPA which will receive the freeipa software from the Appstream repository. At time of writing, that process will see me introducing a replica running ipa-server 4.9.8 to my existing FreeIPA nodes running ipa-server 4.6.8
Should I be concerned about more minor updates and find some way of upgrading through different ipa-server (and dependencies) releases from Appstream or do you think I should just run the procedure as described above?
Thanks
Angus
1 year, 10 months
IPA Update Problem
by Georg Seyerl
Hi IPA Team,
after an IPA upgrade from version 4.9.6 to 4.9.8 I get the following error when I run ipa-server-upgrad manually:
2022-06-09T09:24:25Z DEBUG stderr=
2022-06-09T09:24:25Z DEBUG wait_for_open_ports: localhost [389] timeout 120
2022-06-09T09:24:25Z DEBUG waiting for port: 389
2022-06-09T09:24:25Z DEBUG Failed to connect to port 389 tcp on 127.0.0.1
2022-06-09T09:26:25Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manua
lly.
2022-06-09T09:26:25Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute
return_value = self.run()
File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run
server.upgrade()
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.py", line 2011, in upgrade
upgrade_configuration()
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/upgrade.py", line 1632, in upgrade_configuration
ds.start(ds.serverid)
File "/usr/lib/python3.6/site-packages/ipaserver/install/dsinstance.py", line 643, in start
instance_name, capture_output=capture_output, wait=wait
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 524, in start
self.service.start(instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python3.6/site-packages/ipaplatform/redhat/services.py", line 138, in start
instance_name, capture_output=capture_output, wait=wait)
File "/usr/lib/python3.6/site-packages/ipaplatform/base/services.py", line 317, in start
self.wait_for_open_ports(self.service_instance(instance_name))
File "/usr/lib/python3.6/site-packages/ipaplatform/base/services.py", line 286, in wait_for_open_ports
self.api.env.startup_timeout)
File "/usr/lib/python3.6/site-packages/ipapython/ipautil.py", line 1341, in wait_for_open_ports
raise socket.timeout("Timeout exceeded")
2022-06-09T09:26:25Z DEBUG The ipa-server-upgrade command failed, exception: timeout: Timeout exceeded
2022-06-09T09:26:25Z ERROR Timeout exceeded
2022-06-09T09:26:25Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
A subset of the upgraded packages:
Upgrade ipa-client-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.x86_64 @ol8_x86_64_appstream
Upgraded ipa-client-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.x86_64 @@System
Upgrade ipa-client-common-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.noarch @ol8_x86_64_appstream
Upgraded ipa-client-common-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.noarch @@System
Upgrade ipa-common-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.noarch @ol8_x86_64_appstream
Upgraded ipa-common-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.noarch @@System
Upgrade ipa-healthcheck-core-0.7-10.module+el8.6.0+20578+18b36d36.noarch @ol8_x86_64_appstream
Upgraded ipa-healthcheck-core-0.7-6.module+el8.5.0+20379+1b4496cf.noarch @@System
Upgrade ipa-selinux-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.noarch @ol8_x86_64_appstream
Upgraded ipa-selinux-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.noarch @@System
Upgrade ipa-server-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.x86_64 @ol8_x86_64_appstream
Upgraded ipa-server-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.x86_64 @@System
Upgrade ipa-server-common-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.noarch @ol8_x86_64_appstream
Upgraded ipa-server-common-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.noarch @@System
Upgrade ipa-server-trust-ad-4.9.8-7.0.1.module+el8.6.0+20654+19b76db2.x86_64 @ol8_x86_64_appstream
Upgraded ipa-server-trust-ad-4.9.6-12.0.1.module+el8.5.0+20642+b228f286.x86_64 @@System
We found the following error in the file /var/log/dirsrv/DOMAIN/errors
[09/Jun/2022:11:30:45.658955068 +0200] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/fqdn-host@MYDOMAIN] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested
realm)
In comparison with other IPA Servers the entries in the ds.keytab file looks fine.
Thanks
G
1 year, 10 months
Re: Welcome to the "FreeIPA-users" mailing list
by Sarawut Leelatwatanakul
Hi,
I’d like to post this this forum.
Thanks,
Lee.
> On 13 Jun BE 2565, at 14:21, freeipa-users-request(a)lists.fedorahosted.org wrote:
>
> Welcome to the "FreeIPA-users" mailing list!
>
> To post to this list, send your email to:
>
> freeipa-users(a)lists.fedorahosted.org
>
> You can make such adjustments via email by sending a message to:
>
> freeipa-users-request(a)lists.fedorahosted.org
>
> with the word 'help' in the subject or body (don't include the
> quotes), and you will get back a message with instructions. You will
> need your password to change your options, but for security purposes,
> this email is not included here. If you have forgotten your password
> you will need to click on the 'Forgot Password?' link on the login
> page.
1 year, 10 months
ipa client install error never seen before
by Ranbir
Hi All,
I'm running a Rocky IdM domain with six masters. I have a one way trust
configured with the AD domain. I can look up users in AD from the trust
agents and controllers. So far so good.
I'm now doing a typical client enrollment, which is something I've done
many, many times before. The client install completes, but the messages
below get ouput during the install/config:
Principal is not set when enrolling with OTP; using principal
'admin(a)idm.dope.tld' for 'getent passwd'
Unable to find 'admin' user with 'getent passwd admin(a)idm.dope.tld'!
Unable to reliably detect configuration. Check NSS setup manually.
The end result is I can't lookup trusted users in AD or the ipa domain.
/etc/nsswitch.conf is also not configured like it normally is.
I ran the install in verbose mode, which didn't reveal anything obvious
either. :/
I'm confused as to why it's even happening. I did a POC for everyone to
prove freeipa will work for us and I didn't encounter any problems.
Everything went as I expected it to. The one difference between the
prod system I'm building now and the POC is that the trust for the POC
ipa domain was with a different AD domain. I don't see how that could
be affecting the install on this first client.
Any tips/help would be appreciated.
--
Ranbir
1 year, 10 months
FreeIPA and samba problems
by Mathias Homann
Hi all,
I have successfully deployed a FreeIPA server in docker using the image from
https://hub.docker.com/r/freeipa/freeipa-server/, and on the linux side
everything works just fine - user logins, automount, using IPA as
authentication source for AWX and portainer, you name it.
Today I have joined my samba server to the ipa realm, and finally turned off
nis - and that's where the *** hit the fan: samba isn't working anymore.
If I run that samba as standalone I can't connect because it seems that samba
(on opensuse) doesn't know how to get user details from sssd, so when I tred
to connect I got this:
[2022/06/07 17:49:25.744112, 0] ../../source3/passdb/lookup_sid.c:
1633(get_primary_group_sid)
Failed to find a Unix account for lemmy
So I made my way through https://www.freeipa.org/page/Howto/
Integrating_a_Samba_File_Server_With_IPA but that's not helping either.
Now, when I try something like "smbclient -k -L smbserver" I get some weird
"session setup failed: NT_STATUS_INVALID_PARAMETER" message on the commandline
- but it works just fine when I run the same command against the actual ipa
server.
Right now I'm using the minimal smb.conf from that website.
What am I missing?
Cheers
MH
--
Mathias Homann
Mathias.Homann(a)openSUSE.org
Jabber (XMPP): lemmy(a)tuxonline.tech
Matrix: @mathias:eregion.de
IRC: [Lemmy] on liberachat and ircnet (bouncer active)
keybase: https://keybase.io/lemmy
gpg key fingerprint: 8029 2240 F4DD 7776 E7D2 C042 6B8E 029E 13F2 C102
1 year, 10 months
ipa-replica-install (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired
by rui liang
new freeipa(4.3) client ipa-replica-install unsuccessful
root@fs-hiido-ipa-ca-64-252:/var/lib/certmonger/requests# cat 20220607091036
id=20220607091036
key_type=RSA
key_gen_type=RSA
key_size=2048
key_gen_size=2048
key_next_type=UNSPECIFIED
key_next_gen_type=RSA
key_next_size=0
key_next_gen_size=2048
key_preserve=0
key_storage_type=NSSDB
key_storage_location=/etc/dirsrv/slapd-YYDEVOPS-COM
key_token=NSS Certificate DB
key_nickname=Server-Cert
key_pin_file=/etc/dirsrv/slapd-YYDEVOPS-COM//pwdfile.txt
key_perms=0
key_pubkey=3082010A0282010100ABAE6132CE275098AE738330F45086F71F725B80C43034EDBA8CF3D9A5D17515F4B07B2409C0D45B74885870CE48BD169D5EE1D06262C85291D692505BD7895FD09754F5D186DD0509DCF620649842F37AFFD45FD124AE40988557430C237C598F49CB845630DF0C1CE12BEB4E74CA5278398730094E7868794B75F6F572F205D0567EC509E35EDB7CB26AAF8C4713C828EB81EE39A13F7568009585C3C1EBA35833C7F30691580ABC0D85811097E74FCD502BA73709B350A74C8CBED646AD01A40E4D71AFE7FBBD11B96BD0A1975E267C54AA1A7C29C5EF20E349E200CFCC58BD748497DFF29EC87B4A39A121B6C79573A0C59943F1C7981691CD01C44B675D0203010001
key_pubkey_info=30820122300D06092A864886F70D01010105000382010F003082010A0282010100ABAE6132CE275098AE738330F45086F71F725B80C43034EDBA8CF3D9A5D17515F4B07B2409C0D45B74885870CE48BD169D5EE1D06262C85291D692505BD7895FD09754F5D186DD0509DCF620649842F37AFFD45FD124AE40988557430C237C598F49CB845630DF0C1CE12BEB4E74CA5278398730094E7868794B75F6F572F205D0567EC509E35EDB7CB26AAF8C4713C828EB81EE39A13F7568009585C3C1EBA35833C7F30691580ABC0D85811097E74FCD502BA73709B350A74C8CBED646AD01A40E4D71AFE7FBBD11B96BD0A1975E267C54AA1A7C29C5EF20E349E200CFCC58BD748497DFF29EC87B4A39A121B6C79573A0C59943F1C7981691CD01C44B675D0203010001
key_generated_date=20220607091036
key_requested_count=1
key_issued_count=0
cert_storage_type=NSSDB
cert_storage_location=/etc/dirsrv/slapd-YYDEVOPS-COM
cert_nickname=Server-Cert
cert_perms=0
cert_is_ca=0
cert_ca_path_length=0
cert_no_ocsp_check=0
last_need_notify_check=19700101000000
last_need_enroll_check=19700101000000
template_subject=fs-hiido-ipa-ca-64-252.hiido.host.yydevops.com
template_principal=ldap/fs-hiido-ipa-ca-64-252.hiido.host.yydevops.com(a)YYDEVOPS.COM
template_is_ca=0
template_ca_path_length=0
template_no_ocsp_check=0
csr=-----BEGIN NEW CERTIFICATE REQUEST-----
MIIDsDCCApgCAQAwOTE3MDUGA1UEAxMuZnMtaGlpZG8taXBhLWNhLTY0LTI1Mi5o
aWlkby5ob3N0Lnl5ZGV2b3BzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAKuuYTLOJ1CYrnODMPRQhvcfcluAxDA07bqM89ml0XUV9LB7JAnA1Ft0
iFhwzki9Fp1e4dBiYshSkdaSUFvXiV/Ql1T10YbdBQnc9iBkmELzev/UX9EkrkCY
hVdDDCN8WY9Jy4RWMN8MHOEr6050ylJ4OYcwCU54aHlLdfb1cvIF0FZ+xQnjXtt8
smqvjEcTyCjrge45oT91aACVhcPB66NYM8fzBpFYCrwNhYEQl+dPzVArpzcJs1Cn
TIy+1katAaQOTXGv5/u9Eblr0KGXXiZ8VKoafCnF7yDjSeIAz8xYvXSEl9/ynsh7
SjmhIbbHlXOgxZlD8ceYFpHNAcRLZ10CAwEAAaCCATAwJQYJKoZIhvcNAQkUMRge
FgBTAGUAcgB2AGUAcgAtAEMAZQByAHQwggEFBgkqhkiG9w0BCQ4xgfcwgfQwgcEG
A1UdEQEBAASBtjCBs6BQBgorBgEEAYI3FAIDoEIMQGxkYXAvZnMtaGlpZG8taXBh
LWNhLTY0LTI1Mi5oaWlkby5ob3N0Lnl5ZGV2b3BzLmNvbUBZWURFVk9QUy5DT02g
XwYGKwYBBQICoFUwU6AOGwxZWURFVk9QUy5DT02hQTA/oAMCAQGhODA2GwRsZGFw
Gy5mcy1oaWlkby1pcGEtY2EtNjQtMjUyLmhpaWRvLmhvc3QueXlkZXZvcHMuY29t
MAwGA1UdEwEB/wQCMAAwIAYDVR0OAQEABBYEFFmNcihY2hfR8EtJHZbaKlJPQAvN
MA0GCSqGSIb3DQEBCwUAA4IBAQBkxhUjn13xm66r2vBWLjUu74PeuhTvmChkLxQN
0XWrf8OJ6rl6Lcf4RQYQe6E4xJ6yyVGdM8kPaFQ7W7SYli95r5tVn4LpENYCTewb
q/tqWWLjcgRdk/hBrSknyCBEY1Idf0krbIEJK2vGqbi5ajFZhjlTQ2uiec0k7Wls
EpVFcGkFpgsFBuKKeO3H+Xj+2+w29jnkwXrmu6N4FKh+ikFDQBzy2pO6u/+pIvqq
9QTpx517GWuLwze4vcIa6xtBAuiq40+A00tWi5exmYCNi7rxpvI56zAvtvN9vMbP
gqfDTBOhPx/4f3WFqAmfWZcGWSmw+xOQzhqPhMxj5Q5cWDsS
-----END NEW CERTIFICATE REQUEST-----
spkac=MIICQDCCASgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrrmEyzidQmK5zgzD0UIb3H3JbgMQwNO26jPPZpdF1FfSweyQJwNRbdIhYcM5IvRadXuHQYmLIUpHWklBb14lf0JdU9dGG3QUJ3PYgZJhC83r/1F/RJK5AmIVXQwwjfFmPScuEVjDfDBzhK+tOdMpSeDmHMAlOeGh5S3X29XLyBdBWfsUJ417bfLJqr4xHE8go64HuOaE/dWgAlYXDweujWDPH8waRWAq8DYWBEJfnT81QK6c3CbNQp0yMvtZGrQGkDk1xr+f7vRG5a9Chl14mfFSqGnwpxe8g40niAM/MWL10hJff8p7Ie0o5oSG2x5VzoMWZQ/HHmBaRzQHES2ddAgMBAAEWADANBgkqhkiG9w0BAQsFAAOCAQEAOegGLgw81dvQa4LfvEybdeiTwKke9SnXfalpsWoGOsFx8arsLvhihDL0Ai3ZKeVjJTNlq9+1klq2AfAC7s9xC5oIK3YyFVvzSIAhwxiBvAtBe8KwwVfZnNB0HKroXIkn0JrGlyb1fheePSKIZCs1THwFigYSp3MTo0j3wNSFKgusJ+7RH0sLYO/5AwJ4JrqO4xPLz7rSfDbMgep7Qg+Ylv2YIXGecH2Hft/0LLchxbbCJd2OnKNvEW+wyotVwG4v8XPaSBT2aiKuFcD5gMY3clbeTv7tIwuH1K27R0cSiJZKAznMCuB2MhMi+CWRlvCYfS8nyqwziOnYRG3SZa7MLg==
scep_tx=23408524965258346450630507198266950287255212778687783181270846979351580813985
minicert=MIIDDjCCAfagAwIBAAIgM8DBb8vrkCLtVakYwBoCDvE3QB7kwQiBV5zAfRCoqqEwDQYJKoZIhvcNAQELBQAwOTE3MDUGA1UEAxMuZnMtaGlpZG8taXBhLWNhLTY0LTI1Mi5oaWlkby5ob3N0Lnl5ZGV2b3BzLmNvbTAiGA8yMDIyMDYwNzAwMDAwMFoYDzIxMjIwNjA3MDAwMDAwWjA5MTcwNQYDVQQDEy5mcy1oaWlkby1pcGEtY2EtNjQtMjUyLmhpaWRvLmhvc3QueXlkZXZvcHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq65hMs4nUJiuc4Mw9FCG9x9yW4DEMDTtuozz2aXRdRX0sHskCcDUW3SIWHDOSL0WnV7h0GJiyFKR1pJQW9eJX9CXVPXRht0FCdz2IGSYQvN6/9Rf0SSuQJiFV0MMI3xZj0nLhFYw3wwc4SvrTnTKUng5hzAJTnhoeUt19vVy8gXQVn7FCeNe23yyaq+MRxPIKOuB7jmhP3VoAJWFw8Hro1gzx/MGkVgKvA2FgRCX50/NUCunNwmzUKdMjL7WRq0BpA5Nca/n+70RuWvQoZdeJnxUqhp8KcXvIONJ4gDPzFi9dISX3/KeyHtKOaEhtseVc6DFmUPxx5gWkc0BxEtnXQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCcQSS8v0lkknnYfvPhfBZjyzb9RiszlRVxIj1aZQxum2O3EXI49yhBytL5cz39NjdDMmcn0DS1OlU+y4270Wfb3KiNDvuDfoY7hvahOLQNU+hKAVx13PU7uGQU+3SjOR+FtR2e9gX7QQ3aRjoH+dmm3ys4sS9CN7gnnzw9uVC59+g0snz9iFMV+gFVl/16PSX4F+zJqxna84RIIbBTqfQ00pkB230LmbWKuLxh8CCJHWi9x61a4ZWU25hHMZgP6YoWv3rrrzdZvDscb9Qffp7QPV+II
tzeyGhVKRwZ1tlwMyzrTHAMYixDNS5Ejhr5P/NjSnpDAul/Kw01NKoIe4OI
state=CA_UNREACHABLE
autorenew=1
monitor=1
ca_name=IPA
submitted=20220607091038
ca_error=Server at https://fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com:443/ca/eeca/...': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.).
root@fs-hiido-ipa-ca-64-252:/var/lib/certmonger/requests# ^C
root@fs-hiido-ipa-ca-64-252:/var/lib/certmonger/requests#
root@fs-hiido-ipa-ca-64-252:/var/lib/certmonger/requests#
root@fs-hiido-ipa-ca-64-252:/var/lib/certmonger/requests# less 20220607091036
id=20220607091036
key_type=RSA
key_gen_type=RSA
key_size=2048
key_gen_size=2048
key_next_type=UNSPECIFIED
key_next_gen_type=RSA
key_next_size=0
key_next_gen_size=2048
key_preserve=0
key_storage_type=NSSDB
key_storage_location=/etc/dirsrv/slapd-YYDEVOPS-COM
key_token=NSS Certificate DB
key_nickname=Server-Cert
key_pin_file=/etc/dirsrv/slapd-YYDEVOPS-COM//pwdfile.txt
key_perms=0
key_pubkey=3082010A0282010100ABAE6132CE275098AE738330F45086F71F725B80C43034EDBA8CF3D9A5D17515F4B07B2409C0D45B74885870CE48BD169D5EE1D06262C85291D692505BD7895FD09754F5D186DD0509DCF620649842F37AFFD45FD124AE40988557430C237C598F49CB845630DF0C1CE12BEB4E74CA5278398730094E7868794B75F6F572F205D0567EC509E35EDB7CB26AAF8C4713C828EB81EE39A13F7568009585C3C1EBA35833C7F30691580ABC0D85811097E74FCD502BA73709B350A74C8CBED646AD01A40E4D71AFE7FBBD11B96BD0A1975E267C54AA1A7C29C5EF20E349E200CFCC58BD748497DFF29EC87B4A39A121B6C79573A0C59943F1C7981691CD01C44B675D0203010001
key_pubkey_info=30820122300D06092A864886F70D01010105000382010F003082010A0282010100ABAE6132CE275098AE738330F45086F71F725B80C43034EDBA8CF3D9A5D17515F4B07B2409C0D45B74885870CE48BD169D5EE1D06262C85291D692505BD7895FD09754F5D186DD0509DCF620649842F37AFFD45FD124AE40988557430C237C598F49CB845630DF0C1CE12BEB4E74CA5278398730094E7868794B75F6F572F205D0567EC509E35EDB7CB26AAF8C4713C828EB81EE39A13F7568009585C3C1EBA35833C7F30691580ABC0D85811097E74FCD502BA73709B350A74C8CBED646AD01A40E4D71AFE7FBBD11B96BD0A1975E267C54AA1A7C29C5EF20E349E200CFCC58BD748497DFF29EC87B4A39A121B6C79573A0C59943F1C7981691CD01C44B675D0203010001
key_generated_date=20220607091036
key_requested_count=1
key_issued_count=0
cert_storage_type=NSSDB
cert_storage_location=/etc/dirsrv/slapd-YYDEVOPS-COM
cert_nickname=Server-Cert
cert_perms=0
cert_is_ca=0
cert_ca_path_length=0
cert_no_ocsp_check=0
last_need_notify_check=19700101000000
last_need_enroll_check=19700101000000
template_subject=fs-hiido-ipa-ca-64-252.hiido.host.yydevops.com
template_principal=ldap/fs-hiido-ipa-ca-64-252.hiido.host.yydevops.com(a)YYDEVOPS.COM
template_is_ca=0
template_ca_path_length=0
template_no_ocsp_check=0
csr=-----BEGIN NEW CERTIFICATE REQUEST-----
MIIDsDCCApgCAQAwOTE3MDUGA1UEAxMuZnMtaGlpZG8taXBhLWNhLTY0LTI1Mi5o
aWlkby5ob3N0Lnl5ZGV2b3BzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAKuuYTLOJ1CYrnODMPRQhvcfcluAxDA07bqM89ml0XUV9LB7JAnA1Ft0
iFhwzki9Fp1e4dBiYshSkdaSUFvXiV/Ql1T10YbdBQnc9iBkmELzev/UX9EkrkCY
hVdDDCN8WY9Jy4RWMN8MHOEr6050ylJ4OYcwCU54aHlLdfb1cvIF0FZ+xQnjXtt8
smqvjEcTyCjrge45oT91aACVhcPB66NYM8fzBpFYCrwNhYEQl+dPzVArpzcJs1Cn
TIy+1katAaQOTXGv5/u9Eblr0KGXXiZ8VKoafCnF7yDjSeIAz8xYvXSEl9/ynsh7
SjmhIbbHlXOgxZlD8ceYFpHNAcRLZ10CAwEAAaCCATAwJQYJKoZIhvcNAQkUMRge
FgBTAGUAcgB2AGUAcgAtAEMAZQByAHQwggEFBgkqhkiG9w0BCQ4xgfcwgfQwgcEG
A1UdEQEBAASBtjCBs6BQBgorBgEEAYI3FAIDoEIMQGxkYXAvZnMtaGlpZG8taXBh
LWNhLTY0LTI1Mi5oaWlkby5ob3N0Lnl5ZGV2b3BzLmNvbUBZWURFVk9QUy5DT02g
XwYGKwYBBQICoFUwU6AOGwxZWURFVk9QUy5DT02hQTA/oAMCAQGhODA2GwRsZGFw
Gy5mcy1oaWlkby1pcGEtY2EtNjQtMjUyLmhpaWRvLmhvc3QueXlkZXZvcHMuY29t
MAwGA1UdEwEB/wQCMAAwIAYDVR0OAQEABBYEFFmNcihY2hfR8EtJHZbaKlJPQAvN
MA0GCSqGSIb3DQEBCwUAA4IBAQBkxhUjn13xm66r2vBWLjUu74PeuhTvmChkLxQN
0XWrf8OJ6rl6Lcf4RQYQe6E4xJ6yyVGdM8kPaFQ7W7SYli95r5tVn4LpENYCTewb
q/tqWWLjcgRdk/hBrSknyCBEY1Idf0krbIEJK2vGqbi5ajFZhjlTQ2uiec0k7Wls
EpVFcGkFpgsFBuKKeO3H+Xj+2+w29jnkwXrmu6N4FKh+ikFDQBzy2pO6u/+pIvqq
9QTpx517GWuLwze4vcIa6xtBAuiq40+A00tWi5exmYCNi7rxpvI56zAvtvN9vMbP
gqfDTBOhPx/4f3WFqAmfWZcGWSmw+xOQzhqPhMxj5Q5cWDsS
-----END NEW CERTIFICATE REQUEST-----
spkac=MIICQDCCASgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrrmEyzidQmK5zgzD0UIb3H3JbgMQwNO26jPPZpdF1FfSweyQJwNRbdIhYcM5IvRadXuHQYmLIUpHWklBb14lf0JdU9dGG3QUJ3PYgZJhC83r/1F/RJK5AmIVXQwwjfFmPScuEVjDfDBzhK+tOdMpSeDmHMAlOeGh5S3X29XLyBdBWfsUJ417bfLJqr4xHE8go64HuOaE/dWgAlYXDweujWDPH8waRWAq8DYWBEJfnT81QK6c3CbNQp0yMvtZGrQGkDk1xr+f7vRG5a9Chl14mfFSqGnwpxe8g40niAM/MWL10hJff8p7Ie0o5oSG2x5VzoMWZQ/HHmBaRzQHES2ddAgMBAAEWADANBgkqhkiG9w0BAQsFAAOCAQEAOegGLgw81dvQa4LfvEybdeiTwKke9SnXfalpsWoGOsFx8arsLvhihDL0Ai3ZKeVjJTNlq9+1klq2AfAC7s9xC5oIK3YyFVvzSIAhwxiBvAtBe8KwwVfZnNB0HKroXIkn0JrGlyb1fheePSKIZCs1THwFigYSp3MTo0j3wNSFKgusJ+7RH0sLYO/5AwJ4JrqO4xPLz7rSfDbMgep7Qg+Ylv2YIXGecH2Hft/0LLchxbbCJd2OnKNvEW+wyotVwG4v8XPaSBT2aiKuFc...skipping...
key_pin_file=/etc/dirsrv/slapd-YYDEVOPS-COM//pwdfile.txt
key_perms=0
key_pubkey=3082010A0282010100ABAE6132CE275098AE738330F45086F71F725B80C43034EDBA8CF3D9A5D17515F4B07B2409C0D45B74885870CE48BD169D5EE1D06262C85291D692505BD7895FD09754F5D186DD0509DCF620649842F37AFFD45FD124AE40988557430C237C598F49CB845630DF0C1CE12BEB4E74CA5278398730094E7868794B75F6F572F205D0567EC509E35EDB7CB26AAF8C4713C828EB81EE39A13F7568009585C3C1EBA35833C7F30691580ABC0D85811097E74FCD502BA73709B350A74C8CBED646AD01A40E4D71AFE7FBBD11B96BD0A1975E267C54AA1A7C29C5EF20E349E200CFCC58BD748497DFF29EC87B4A39A121B6C79573A0C59943F1C7981691CD01C44B675D0203010001
key_pubkey_info=30820122300D06092A864886F70D01010105000382010F003082010A0282010100ABAE6132CE275098AE738330F45086F71F725B80C43034EDBA8CF3D9A5D17515F4B07B2409C0D45B74885870CE48BD169D5EE1D06262C85291D692505BD7895FD09754F5D186DD0509DCF620649842F37AFFD45FD124AE40988557430C237C598F49CB845630DF0C1CE12BEB4E74CA5278398730094E7868794B75F6F572F205D0567EC509E35EDB7CB26AAF8C4713C828EB81EE39A13F7568009585C3C1EBA35833C7F30691580ABC0D85811097E74FCD502BA73709B350A74C8CBED646AD01A40E4D71AFE7FBBD11B96BD0A1975E267C54AA1A7C29C5EF20E349E200CFCC58BD748497DFF29EC87B4A39A121B6C79573A0C59943F1C7981691CD01C44B675D0203010001
key_generated_date=20220607091036
key_requested_count=1
key_issued_count=0
cert_storage_type=NSSDB
cert_storage_location=/etc/dirsrv/slapd-YYDEVOPS-COM
cert_nickname=Server-Cert
cert_perms=0
cert_is_ca=0
cert_ca_path_length=0
cert_no_ocsp_check=0
last_need_notify_check=19700101000000
last_need_enroll_check=19700101000000
template_subject=fs-hiido-ipa-ca-64-252.hiido.host.yydevops.com
template_principal=ldap/fs-hiido-ipa-ca-64-252.hiido.host.yydevops.com(a)YYDEVOPS.COM
template_is_ca=0
template_ca_path_length=0
template_no_ocsp_check=0
csr=-----BEGIN NEW CERTIFICATE REQUEST-----
MIIDsDCCApgCAQAwOTE3MDUGA1UEAxMuZnMtaGlpZG8taXBhLWNhLTY0LTI1Mi5o
aWlkby5ob3N0Lnl5ZGV2b3BzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAKuuYTLOJ1CYrnODMPRQhvcfcluAxDA07bqM89ml0XUV9LB7JAnA1Ft0
iFhwzki9Fp1e4dBiYshSkdaSUFvXiV/Ql1T10YbdBQnc9iBkmELzev/UX9EkrkCY
hVdDDCN8WY9Jy4RWMN8MHOEr6050ylJ4OYcwCU54aHlLdfb1cvIF0FZ+xQnjXtt8
smqvjEcTyCjrge45oT91aACVhcPB66NYM8fzBpFYCrwNhYEQl+dPzVArpzcJs1Cn
TIy+1katAaQOTXGv5/u9Eblr0KGXXiZ8VKoafCnF7yDjSeIAz8xYvXSEl9/ynsh7
SjmhIbbHlXOgxZlD8ceYFpHNAcRLZ10CAwEAAaCCATAwJQYJKoZIhvcNAQkUMRge
FgBTAGUAcgB2AGUAcgAtAEMAZQByAHQwggEFBgkqhkiG9w0BCQ4xgfcwgfQwgcEG
A1UdEQEBAASBtjCBs6BQBgorBgEEAYI3FAIDoEIMQGxkYXAvZnMtaGlpZG8taXBh
LWNhLTY0LTI1Mi5oaWlkby5ob3N0Lnl5ZGV2b3BzLmNvbUBZWURFVk9QUy5DT02g
XwYGKwYBBQICoFUwU6AOGwxZWURFVk9QUy5DT02hQTA/oAMCAQGhODA2GwRsZGFw
Gy5mcy1oaWlkby1pcGEtY2EtNjQtMjUyLmhpaWRvLmhvc3QueXlkZXZvcHMuY29t
MAwGA1UdEwEB/wQCMAAwIAYDVR0OAQEABBYEFFmNcihY2hfR8EtJHZbaKlJPQAvN
MA0GCSqGSIb3DQEBCwUAA4IBAQBkxhUjn13xm66r2vBWLjUu74PeuhTvmChkLxQN
0XWrf8OJ6rl6Lcf4RQYQe6E4xJ6yyVGdM8kPaFQ7W7SYli95r5tVn4LpENYCTewb
q/tqWWLjcgRdk/hBrSknyCBEY1Idf0krbIEJK2vGqbi5ajFZhjlTQ2uiec0k7Wls
EpVFcGkFpgsFBuKKeO3H+Xj+2+w29jnkwXrmu6N4FKh+ikFDQBzy2pO6u/+pIvqq
9QTpx517GWuLwze4vcIa6xtBAuiq40+A00tWi5exmYCNi7rxpvI56zAvtvN9vMbP
gqfDTBOhPx/4f3WFqAmfWZcGWSmw+xOQzhqPhMxj5Q5cWDsS
-----END NEW CERTIFICATE REQUEST-----
spkac=MIICQDCCASgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrrmEyzidQmK5zgzD0UIb3H3JbgMQwNO26jPPZpdF1FfSweyQJwNRbdIhYcM5IvRadXuHQYmLIUpHWklBb14lf0JdU9dGG3QUJ3PYgZJhC83r/1F/RJK5AmIVXQwwjfFmPScuEVjDfDBzhK+tOdMpSeDmHMAlOeGh5S3X29XLyBdBWfsUJ417bfLJqr4xHE8go64HuOaE/dWgAlYXDweujWDPH8waRWAq8DYWBEJfnT81QK6c3CbNQp0yMvtZGrQGkDk1xr+f7vRG5a9Chl14mfFSqGnwpxe8g40niAM/MWL10hJff8p7Ie0o5oSG2x5VzoMWZQ/HHmBaRzQHES2ddAgMBAAEWADANBgkqhkiG9w0BAQsFAAOCAQEAOegGLgw81dvQa4LfvEybdeiTwKke9SnXfalpsWoGOsFx8arsLvhihDL0Ai3ZKeVjJTNlq9+1klq2AfAC7s9xC5oIK3YyFVvzSIAhwxiBvAtBe8KwwVfZnNB0HKroXIkn0JrGlyb1fheePSKIZCs1THwFigYSp3MTo0j3wNSFKgusJ+7RH0sLYO/5AwJ4JrqO4xPLz7rSfDbMgep7Qg+Ylv2YIXGecH2Hft/0LLchxbbCJd2OnKNvEW+wyotVwG4v8XPaSBT2aiKuFcD5gMY3clbeTv7tIwuH1K27R0cSiJZKAznMCuB2MhMi+CWRlvCYfS8nyqwziOnYRG3SZa7MLg==
scep_tx=23408524965258346450630507198266950287255212778687783181270846979351580813985
minicert=MIIDDjCCAfagAwIBAAIgM8DBb8vrkCLtVakYwBoCDvE3QB7kwQiBV5zAfRCoqqEwDQYJKoZIhvcNAQELBQAwOTE3MDUGA1UEAxMuZnMtaGlpZG8taXBhLWNhLTY0LTI1Mi5oaWlkby5ob3N0Lnl5ZGV2b3BzLmNvbTAiGA8yMDIyMDYwNzAwMDAwMFoYDzIxMjIwNjA3MDAwMDAwWjA5MTcwNQYDVQQDEy5mcy1oaWlkby1pcGEtY2EtNjQtMjUyLmhpaWRvLmhvc3QueXlkZXZvcHMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq65hMs4nUJiuc4Mw9FCG9x9yW4DEMDTtuozz2aXRdRX0sHskCcDUW3SIWHDOSL0WnV7h0GJiyFKR1pJQW9eJX9CXVPXRht0FCdz2IGSYQvN6/9Rf0SSuQJiFV0MMI3xZj0nLhFYw3wwc4SvrTnTKUng5hzAJTnhoeUt19vVy8gXQVn7FCeNe23yyaq+MRxPIKOuB7jmhP3VoAJWFw8Hro1gzx/MGkVgKvA2FgRCX50/NUCunNwmzUKdMjL7WRq0BpA5Nca/n+70RuWvQoZdeJnxUqhp8KcXvIONJ4gDPzFi9dISX3/KeyHtKOaEhtseVc6DFmUPxx5gWkc0BxEtnXQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCcQSS8v0lkknnYfvPhfBZjyzb9RiszlRVxIj1aZQxum2O3EXI49yhBytL5cz39NjdDMmcn0DS1OlU+y4270Wfb3KiNDvuDfoY7hvahOLQNU+hKAVx13PU7uGQU+3SjOR+FtR2e9gX7QQ3aRjoH+dmm3ys4sS9CN7gnnzw9uVC59+g0snz9iFMV+gFVl/16PSX4F+zJqxna84RIIbBTqfQ00pkB230LmbWKuLxh8CCJHWi9x61a4ZWU25hHMZgP6YoWv3rrrzdZvDscb9Qffp7QPV+II
tzeyGhVKRwZ1tlwMyzrTHAMYixDNS5Ejhr5P/NjSnpDAul/Kw01NKoIe4OI
state=CA_UNREACHABLE
autorenew=1
monitor=1
ca_name=IPA
submitted=20220607091038
ca_error=Server at https://fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com:443/ca/eeca/...': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.).
Tested several servers are the same, should be ca expired problem
What do I need to do to replicate this situation?
1 year, 10 months
Syncing AD to IPA users
by Ronald Wimmer
We managed to use IPA users as AIX users in our environment.
Preferrably, we would like to use users from an AD group directly what
does not seem to be possible without SSSD for AIX, right?
As an alternative it would be great to synchronize users in a specific
AD group to IPA users. I already have a draft of a python script in mind
that could do the job.
Is there any way go synchronize a user's password from AD?
Cheers,
Ronald
1 year, 10 months
GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
by Ronald Wimmer
Today I tried to update one of our Keycloaks from version 12 to 18.
Everything looked good except Kerberos login. I am using the exact same
keytab file I used in KC version 12 but in version 18 I do get this:
May 24 23:18:36 kc001.linux.mydomain.at kc.sh[8164]: 2022-05-24
23:18:36,996 WARN
[org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator]
(executor-thread-2) SPNEGO login failed:
java.security.PrivilegedActionException: GSSException: Failure
unspecified at GSS-API level (Mechanism level: Checksum failed)
Any ideas what might be the cause?
Cheers,
Ronald
1 year, 10 months