Hi all,
  I have a setup with two servers running CenOS 7.6 which I updated recently to ipa-server-4.6.4-10.el7.centos.6.x86_64. The update apparently completed successfully and after that I went through the update of several clients (ipa-client-4.6.4-10.el7.centos.6.x86_64) some of which export kerberized nfs shares. However, after the upgrade, the nfs shares are not accessible neither by other clients nor by servers. I don't know if it's a coincidence, but I can access only shares exported by a non-upgraded client.
When trying to mount by hand from server (:fidias) with admin credentials I receive:

[root@fidias]# mount -t nfs4 -o sec=krb5 medusa:/export/teras /teras
mount.nfs4: access denied by server while mounting medusa:/export/teras

[root@fidias]# ipa-getkeytab -r -s fidias.geo.auth.gr -p nfs/medusa.geo.auth.gr -k medusa-nfs.keytab
Failed to parse result: Insufficient access rights

Failed to get keytab

[root@fidias]# KRB5_TRACE=/dev/stderr kinit -k -t /etc/krb5.keytab nfs/medusa.geo.auth.gr
[26055] 1567693076.930983: Resolving unique ccache of type KEYRING
[26055] 1567693076.930984: Getting initial credentials for nfs/medusa.geo.auth.gr@GEO.SS.LAN
[26055] 1567693076.930985: Looked up etypes in keytab: (empty)
[26055] 1567693076.930986: Getting initial credentials for nfs/medusa.geo.auth.gr@GEO.SS.LAN
[26055] 1567693076.930987: Looked up etypes in keytab: (empty)
kinit: Keytab contains no suitable keys for nfs/medusa.geo.auth.gr@GEO.SS.LAN while getting initial credentials

How can this be fixed?
Thanks in advance,
Petros

-- 
Dr. TRIANTAFYLLIDIS PETROS
Aristotle University - Department of Geophysics, POBox 112,
54124 Thessaloniki,GREECE-TEL:+30-2310998585,FAX:2310991403