One of the FreeIPA replicas are not able to use the GSSAPI authentication to connect to ldap server on itself or any other FreeIPA server.  I'm not sure why.  I added example.com to just replace the actual domains, we're not using that.  I really don't fully understand how the krbprincipalname is used but as a thought I think maybe we have 2 ldap/ krbbprincipal names for this host/service and it's using the wrong one for the mapping.

ipa-server-4.5.0

eu-ipa-02.example.com: replica
  last init status: None
  last init ended: 1970-01-01 00:00:00+00:00
  last update status: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)
  last update ended: 1970-01-01 00:00:00+00:00
ipa-001.example.com: replica
  last init status: None
  last init ended: 1970-01-01 00:00:00+00:00
  last update status: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)
  last update ended: 1970-01-01 00:00:00+00:00
rsdfw-ipa-01.example.com: replica
  last init status: None
  last init ended: 1970-01-01 00:00:00+00:00
  last update status: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)
  last update ended: 1970-01-01 00:00:00+00:00
rsiad-ipa-01.example.com: replica
  last init status: None
  last init ended: 1970-01-01 00:00:00+00:00
  last update status: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)
  last update ended: 1970-01-01 00:00:00+00:00

[root@eu-ipa-01 ~]# klist -ke /etc/dirsrv/ds.keytab
Keytab name: FILE:/etc/dirsrv/ds.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   2 ldap/eu-ipa-01.example.com@EXAMPLE.COM (aes256-cts-hmac-sha1-96)
   2 ldap/eu-ipa-01.example.com@EXAMPLE.COM (aes128-cts-hmac-sha1-96)
   2 ldap/eu-ipa-01.example.com@EXAMPLE.COM (des3-cbc-sha1)
   2 ldap/eu-ipa-01.example.com@EXAMPLE.COM (arcfour-hmac)
   2 ldap/eu-ipa-01.example.com@EXAMPLE.COM (camellia128-cts-cmac)
   2 ldap/eu-ipa-01.example.com@EXAMPLE.COM (camellia256-cts-cmac)

ldapsearch -h eu-ipa-01.example.com -D "cn=directory manager" -W -b "dc=example,dc=com" '(krbprincipalname=ldap/eu-ipa-01*)'

Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (krbprincipalname=ldap/eu-ipa-01*)
# requesting: ALL
#

# ldap/eu-ipa-01.example.com@EXAMPLE.COM, services, accounts, example.com
dn: krbprincipalname=ldap/eu-ipa-01.example.com@EXAMPLE.COM,cn=services,cn=accou
 nts,dc=example,dc=com
krbLastSuccessfulAuth: 20180411141738Z
ipaAllowedToPerform;read_keys: cn=admins,cn=groups,cn=accounts,dc=example,dc=ne
 t
memberOf: cn=replication managers,cn=sysaccounts,cn=etc,dc=example,dc=com
ipaKrbPrincipalAlias: ldap/eu-ipa-01.example.com@EXAMPLE.COM
userCertificate::
krbExtraData::
krbPrincipalKey::
krbLoginFailedCount: 0
krbLastPwdChange: 20170718043248Z
krbCanonicalName: ldap/eu-ipa-01.example.com@EXAMPLE.COM
objectClass: ipaobject
objectClass: top
objectClass: ipaservice
objectClass: pkiuser
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbTicketPolicyAux
objectClass: ipakrbprincipal
objectClass: ipaallowedoperations
managedBy: fqdn=eu-ipa-01.example.com,cn=computers,cn=accounts,dc=example,dc=com
krbPrincipalName: ldap/eu-ipa-01.example.com@EXAMPLE.COM
ipaUniqueID: 26d525e0-6b72-11e7-803b-0643f376e57a
krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou
 nts,dc=example,dc=com

# ldap/eu-ipa-01.example.com@EXAMPLE.COM + d07bbe98-65a111e7-8454f4db-22f31cc6, s
 ervices, accounts, example.com
dn: krbprincipalname=ldap/eu-ipa-01.example.com@EXAMPLE.COM+nsuniqueid=d07bbe98-
 65a111e7-8454f4db-22f31cc6,cn=services,cn=accounts,dc=example,dc=com
ipaKrbPrincipalAlias: ldap/eu-ipa-01.example.com@EXAMPLE.COM
userCertificate::
krbExtraData::
krbPrincipalKey::
krbLastPwdChange: 20170710185854Z
krbCanonicalName: ldap/eu-ipa-01.example.com@EXAMPLE.COM
objectClass: ipaobject
objectClass: top
objectClass: ipaservice
objectClass: pkiuser
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbTicketPolicyAux
objectClass: ipakrbprincipal
managedBy: fqdn=eu-ipa-01.example.com,cn=computers,cn=accounts,dc=example,dc=com
krbPrincipalName: ldap/eu-ipa-01.example.com@EXAMPLE.COM
ipaUniqueID: d1f75da2-65a1-11e7-b431-0643f376e57a
krbPwdPolicyReference: cn=Default Service Password Policy,cn=services,cn=accou
 nts,dc=example,dc=com

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

Is this 2nd result the one it's trying to use and it has the wrong password associated with it?

[11/Apr/2018:12:06:08.426926060 +0100] conn=137434 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI
[11/Apr/2018:12:06:08.431094978 +0100] conn=137434 op=1 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress
[11/Apr/2018:12:06:08.431544044 +0100] conn=137434 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI
[11/Apr/2018:12:06:08.432833552 +0100] conn=137434 op=2 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress
[11/Apr/2018:12:06:08.432981174 +0100] conn=137434 op=3 BIND dn="" method=sasl version=3 mech=GSSAPI
[11/Apr/2018:12:06:08.433457303 +0100] conn=137434 op=3 RESULT err=49 tag=97 nentries=0 etime=0 - SASL(-14): authorization failure:
[11/Apr/2018:12:06:08.433918022 +0100] conn=137434 op=4 UNBIND
[11/Apr/2018:12:06:08.433934070 +0100] conn=137434 op=4 fd=229 closed - U1


Any help would be most appreciated.  Thank you.


IMPORTANT: This e-mail (including any attachments) is intended for the use of the individual or entity to which it is addressed and may contain information that is classified, private, or confidential. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is prohibited. If you have received this communication in error, please notify us immediately by replying to this e-mail. Thank you.