Hi Flo,
On 7/23/19 2:49 PM, Florence Blanc-Renaud wrote:
On 7/23/19 12:27 PM, Harald Dunkel via FreeIPA-users wrote:
> PS: Attached is slapd's errors file as well. Please note the
> Kerberos errors:
>
> :
> [23/Jul/2019:11:42:23.714599643 +0200] - ERR - set_krb5_creds - Could not get initial
credentials for principal [ldap/ipa0.example.de(a)EXAMPLE.DE] in keytab
[FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)
Hi,
This error means that kerberos server is not running on ipa0 when 389-ds server starts.
What is the output of ipactl status on ipa0? You can restart the services with ipactl
start --ignore-service-failures (otherwise failure of a single IPA service will stop the
whole stack).
[root@ipa0 ~]# ipactl start --ignore-service-failures
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting httpd Service
Starting ipa-custodia Service
Starting ntpd Service
Starting pki-tomcatd Service
Failed to start pki-tomcatd Service
Forced start, ignoring pki-tomcatd Service, continuing normal operation
Starting ipa-otpd Service
ipa: INFO: The ipactl command was successful
[root@ipa0 ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: STOPPED
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
The kdc is running. Its serving requests all the time.
Regards
Harri