Thank you for reply, Rob.
I'm afraid it doesn't even get to 389-ds layer at least there is no log entries at the moment of failure. not access nor error. The only error i'm getting on the server side is
[Tue Feb 06 02:35:30.637409 2018] [auth_gssapi:error] [pid 24222] [client 10.23.2.84:48966] NO AUTH DATA Client did not send any authentication headers, referer: https://ipaserver/ipa/xml
during the ipa-join attempt from client side.
However, i've got some hint I've managed to join this client by running ipa-join locally on ipa server after kinit admin (same user used for ipa-client-install). Does it mean anything? Like some relevant entry missed from ldap which is responsible for remote hosts rights to join?
This is also a manual ipa-join attempt from the client (kinit admin was done as well):
XML-RPC CALL:
<?xml version="1.0" encoding="UTF-8"?>\r\n <methodCall>\r\n <methodName>join</methodName>\r\n <params>\r\n <param><value><array><data>\r\n <value><string>client fqdn</string></value>\r\n </data></array></value></param>\r\n <param><value><struct>\r\n <member><name>nsosversion</name>\r\n <value><string>3.10.0-693.17.1.el7.x86_64</string></value></member>\r\n <member><name>nshardwareplatform</name>\r\n <value><string>x86_64</string></value></member>\r\n </struct></value></param>\r\n </params>\r\n </methodCall>\r\n
XML-RPC RESPONSE:
<?xml version='1.0' encoding='UTF-8'?>\n <methodResponse>\n <fault>\n <value><struct>\n <member>\n <name>faultCode</name>\n <value><int>2100</int></value>\n </member>\n <member>\n <name>faultString</name>\n <value><string>Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)</string></value>\n </member>\n </struct></value>\n </fault>\n </methodResponse>\n