One of the FreeIPA replicas are not able to use the GSSAPI authentication
to connect to ldap server on itself or any other FreeIPA server. I'm not
sure why. I added
example.com to just replace the actual domains, we're
not using that. I really don't fully understand how the krbprincipalname
is used but as a thought I think maybe we have 2 ldap/ krbbprincipal names
for this host/service and it's using the wrong one for the mapping.
ipa-server-4.5.0
eu-ipa-02.example.com: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (49) Problem connecting to replica - LDAP
error: Invalid credentials (connection error)
last update ended: 1970-01-01 00:00:00+00:00
ipa-001.example.com: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (49) Problem connecting to replica - LDAP
error: Invalid credentials (connection error)
last update ended: 1970-01-01 00:00:00+00:00
rsdfw-ipa-01.example.com: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (49) Problem connecting to replica - LDAP
error: Invalid credentials (connection error)
last update ended: 1970-01-01 00:00:00+00:00
rsiad-ipa-01.example.com: replica
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (49) Problem connecting to replica - LDAP
error: Invalid credentials (connection error)
last update ended: 1970-01-01 00:00:00+00:00
[root@eu-ipa-01 ~]# klist -ke /etc/dirsrv/ds.keytab
Keytab name: FILE:/etc/dirsrv/ds.keytab
KVNO Principal
----
--------------------------------------------------------------------------
2 ldap/eu-ipa-01.example.com(a)EXAMPLE.COM (aes256-cts-hmac-sha1-96)
2 ldap/eu-ipa-01.example.com(a)EXAMPLE.COM (aes128-cts-hmac-sha1-96)
2 ldap/eu-ipa-01.example.com(a)EXAMPLE.COM (des3-cbc-sha1)
2 ldap/eu-ipa-01.example.com(a)EXAMPLE.COM (arcfour-hmac)
2 ldap/eu-ipa-01.example.com(a)EXAMPLE.COM (camellia128-cts-cmac)
2 ldap/eu-ipa-01.example.com(a)EXAMPLE.COM (camellia256-cts-cmac)
ldapsearch -h
eu-ipa-01.example.com -D "cn=directory manager" -W -b
"dc=example,dc=com" '(krbprincipalname=ldap/eu-ipa-01*)'
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (krbprincipalname=ldap/eu-ipa-01*)
# requesting: ALL
#
# ldap/eu-ipa-01.example.com(a)EXAMPLE.COM, services, accounts,
example.com
dn: krbprincipalname=ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
,cn=services,cn=accou
nts,dc=example,dc=com
krbLastSuccessfulAuth: 20180411141738Z
ipaAllowedToPerform;read_keys:
cn=admins,cn=groups,cn=accounts,dc=example,dc=ne
t
memberOf: cn=replication managers,cn=sysaccounts,cn=etc,dc=example,dc=com
ipaKrbPrincipalAlias: ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
userCertificate::
krbExtraData::
krbPrincipalKey::
krbLoginFailedCount: 0
krbLastPwdChange: 20170718043248Z
krbCanonicalName: ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
objectClass: ipaobject
objectClass: top
objectClass: ipaservice
objectClass: pkiuser
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbTicketPolicyAux
objectClass: ipakrbprincipal
objectClass: ipaallowedoperations
managedBy:
fqdn=eu-ipa-01.example.com
,cn=computers,cn=accounts,dc=example,dc=com
krbPrincipalName: ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
ipaUniqueID: 26d525e0-6b72-11e7-803b-0643f376e57a
krbPwdPolicyReference: cn=Default Service Password
Policy,cn=services,cn=accou
nts,dc=example,dc=com
# ldap/eu-ipa-01.example.com(a)EXAMPLE.COM +
d07bbe98-65a111e7-8454f4db-22f31cc6, s
ervices, accounts,
example.com
dn: krbprincipalname=ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
+nsuniqueid=d07bbe98-
65a111e7-8454f4db-22f31cc6,cn=services,cn=accounts,dc=example,dc=com
ipaKrbPrincipalAlias: ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
userCertificate::
krbExtraData::
krbPrincipalKey::
krbLastPwdChange: 20170710185854Z
krbCanonicalName: ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
objectClass: ipaobject
objectClass: top
objectClass: ipaservice
objectClass: pkiuser
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbTicketPolicyAux
objectClass: ipakrbprincipal
managedBy:
fqdn=eu-ipa-01.example.com
,cn=computers,cn=accounts,dc=example,dc=com
krbPrincipalName: ldap/eu-ipa-01.example.com(a)EXAMPLE.COM
ipaUniqueID: d1f75da2-65a1-11e7-b431-0643f376e57a
krbPwdPolicyReference: cn=Default Service Password
Policy,cn=services,cn=accou
nts,dc=example,dc=com
# search result
search: 2
result: 0 Success
# numResponses: 3
# numEntries: 2
Is this 2nd result the one it's trying to use and it has the wrong password
associated with it?
[11/Apr/2018:12:06:08.426926060 +0100] conn=137434 op=1 BIND dn=""
method=sasl version=3 mech=GSSAPI
[11/Apr/2018:12:06:08.431094978 +0100] conn=137434 op=1 RESULT err=14
tag=97 nentries=0 etime=0, SASL bind in progress
[11/Apr/2018:12:06:08.431544044 +0100] conn=137434 op=2 BIND dn=""
method=sasl version=3 mech=GSSAPI
[11/Apr/2018:12:06:08.432833552 +0100] conn=137434 op=2 RESULT err=14
tag=97 nentries=0 etime=0, SASL bind in progress
[11/Apr/2018:12:06:08.432981174 +0100] conn=137434 op=3 BIND dn=""
method=sasl version=3 mech=GSSAPI
[11/Apr/2018:12:06:08.433457303 +0100] conn=137434 op=3 RESULT err=49
tag=97 nentries=0 etime=0 - SASL(-14): authorization failure:
[11/Apr/2018:12:06:08.433918022 +0100] conn=137434 op=4 UNBIND
[11/Apr/2018:12:06:08.433934070 +0100] conn=137434 op=4 fd=229 closed - U1
Any help would be most appreciated. Thank you.
--
IMPORTANT: This e-mail (including
any attachments) is intended for
the use of
the individual or entity to which it is addressed and may
contain information
that is classified, private, or confidential. If the
reader of this message is
not the intended recipient, or the employee or
agent responsible for delivering
the message to the intended recipient, you
are hereby notified that any
dissemination, distribution, or copying of
this communication is prohibited. If
you have received this communication
in error, please notify us immediately by
replying to this e-mail. Thank
you.