Thank you Rob, I am having exactly the same problem.

On Tue, Feb 1, 2022 at 12:55 AM Rob Crittenden <rcritten@redhat.com> wrote:
code bugs via FreeIPA-users wrote:
> Thank you for your prompt response.
> here is the out put of /var/log/krb5kdc.log during my login attempt.
[snip]
> Feb 01 00:25:44 ipa1.example.com <http://ipa1.example.com/>
> krb5kdc[3754](Error): PAC issue: PAC record claims domain SID different
> to local domain SID or any trusted domain SID: local
> [S-1-5-21-4170108275-2486169439-623049963], PAC
> [S-1-5-21-4279381677-1236361367-2895659079]

This is the problem.

See
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/4S4QQDC4FBVTA4GYWWVBPKGYN3MF4UJ6/#4S4QQDC4FBVTA4GYWWVBPKGYN3MF4UJ6

rob

>
>
> There is not much activity log in  /var/log/httpd/error_log:
>
> [Tue Feb 01 00:20:59.340501 2022] [wsgi:error] [pid 10150:tid
> 139780524480256] [remote 10.2.3.188:49652 <http://10.2.3.188:49652/>]
> ipa: INFO: [jsonserver_i18n_messages] UNKNOWN:
> i18n_messages(version='2.245'): SUCCESS
> [Tue Feb 01 00:25:44.539447 2022] [wsgi:error] [pid 10149:tid
> 139780524480256] [remote 10.2.3.188:49753 <http://10.2.3.188:49753/>]
> ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. 
> Minor code may provide more information, Minor (2598844948): TGT has
> been revoked
>
> On Tue, Feb 1, 2022 at 12:17 AM Alexander Bokovoy <abokovoy@redhat.com
> <mailto:abokovoy@redhat.com>> wrote:
>
>     On la, 29 tammi 2022, code bugs via FreeIPA-users wrote:
>     >Hello,
>     >
>     >-IPA WebGUI login fails with "Login failed due to an unknown reason"
>     >-After upgrading IPA, can no longer log into the WebGUI
>     >Version/Release/Distribution
>     >
>     >$ cat /etc/centos-release
>     >CentOS Linux release 8.5.2111
>     >$ rpm -q freeipa-server freeipa-client ipa-server ipa-client
>     389-ds-base
>     >pki-ca krb5-server
>     >package freeipa-server is not installed
>     >package freeipa-client is not installed
>     >ipa-server-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64
>     >ipa-client-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64
>     >389-ds-base-1.4.3.23-12.module_el8.5.0+1056+b3c5a4b9.x86_64
>     >pki-ca-10.11.2-2.module_el8.5.0+945+a81e57da.noarch
>     >krb5-server-1.18.2-14.el8.x86_64
>     >Additional info:
>     >
>     >tail /var/log/httpd/error_log
>     >
>     >[wsgi:error] [pid 8833:tid 139812622513920] [remote 10.2.3.80:51404
>     <http://10.2.3.80:51404>] ipa:
>     >INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure.
>     Minor code
>     >may provide more information, Minor (2598844948): TGT has been revoked
>
>     Please show entries in /var/log/krb5kdc.log corresponding to this
>     timeframe. If TGT is revoked, it most likely is documented why in that
>     log. Also, if possible, show other requests in httpd's error_log for the
>     same timeframe -- if that was Web UI login, there would be few around
>     this error.
>
>     One possible problem could be what is documented in
>     https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/4S4QQDC4FBVTA4GYWWVBPKGYN3MF4UJ6/#7SKWKKFFDMMFWOXPR53ZFGB634RKJHVU
>     but then it would not be possible to get a Kerberos ticket in kinit as
>     well. Perhaps, you have a problem with anonymous PKINIT on this host
>     instead.
>
>     >
>     >further,
>     >
>     >   1. default "admin" user can IPA WebGUIlogin
>     >   2. other users cannot login  IPA WebGUIlogin, but can login
>     using cli
>     >   (kinit)
>     >   3. when i create a new user, the new user can login IPA WebGUI.
>
>
>
>
>     --
>     / Alexander Bokovoy
>     Sr. Principal Software Engineer
>     Security / Identity Management Engineering
>     Red Hat Limited, Finland