Agree Flo, making sure that I am in the past, unfortunately still not resolution.
[root@ca-ldap01 ~]# systemctl restart krb5kdc
[root@ca-ldap01 ~]# systemctl restart dirsrv(a)DOMAIN-COM.service
[root@ca-ldap01 ~]# systemctl restart httpd
[root@ca-ldap01 ~]# systemctl restart pki-tomcatd(a)pki-tomcat.service
Kerberos now understand we are in the past!
[root@ca-ldap01 ~]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin(a)domain.COM
Valid starting Expires Service principal
08/13/2018 11:21:32 08/14/2018 11:21:28 krbtgt/domain.COM(a)domain.COM
[root@ca-ldap01 ~]# date
Mon Aug 13 11:22:20 PDT 2018
And these are renew.log errors when certmonger is restarted, or getcert resubmit,
basically insufficient access to directory server !?
2018-08-13T18:46:49Z 13747 MainThread ipa DEBUG Initializing principal
host/ca-ldap01.domain.com(a)DOMAIN.COM using keytab /etc/krb5.keytab
2018-08-13T18:46:49Z 13747 MainThread ipa DEBUG using ccache
/var/run/certmonger/tmp-NGZEev/ccache
2018-08-13T18:46:49Z 13747 MainThread ipa DEBUG Attempt 1/1: success
2018-08-13T18:46:49Z 13747 MainThread ipa DEBUG Loading StateFile from
'/var/lib/ipa/sysrestore/sysrestore.state'
2018-08-13T18:46:49Z 13747 MainThread ipa DEBUG Could not connect to the
Directory Server on
ca-ldap01.domain.com: Insufficient access: Invalid credentials
Syslog message also reads "Insufficient access: Invalid credentials"
Aug 13 12:20:39 ca-ldap01 dogtag-ipa-ca-renew-agent-submit: Traceback (most recent call
last):#012 File "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit",
line 511, in <module>#012 sys.exit(main())#012 File
"/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit", line 497, in
main#012 if ca.is_renewal_master():#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 1188,
in is_renewal_master#012 self.ldap_connect()#012 File
"/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 177, in
ldap_connect#012 conn.do_bind(self.dm_password, autobind=self.autobind)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1690, in
do_bind#012 self.do_sasl_gssapi_bind(timeout=timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1668, in
do_sasl_gssapi_bind#012 self.__bind_with_wait(self.gssapi_bind, timeout)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", lin
e 1650, in __bind_with_wait#012 bind_func(*args, **kwargs)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1108, in
gssapi_bind#012 '', auth_tokens, server_controls, client_controls)#012 File
"/usr/lib64/python2.7/contextlib.py", line 35, in __exit__#012
self.gen.throw(type, value, traceback)#012 File
"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 973, in
error_handler#012 raise errors.ACIError(info="%s %s" % (info,
desc))#012ACIError: Insufficient access: Invalid credentials
Aug 13 12:20:39 ca-ldap01 certmonger: 2018-08-13 12:20:39 [16173] Internal error
I've been worrying now, it's being a week and this is prod environment. I've
tried to add 5th server, but replica to it fails. Any hope for resolution?