Thank you for reply, Rob.
I'm afraid it doesn't even get to 389-ds layer at least there is no log entries at
the moment of failure. not access nor error.
The only error i'm getting on the server side is
[Tue Feb 06 02:35:30.637409 2018] [auth_gssapi:error] [pid 24222] [client
10.23.2.84:48966] NO AUTH DATA Client did not send any authentication headers, referer:
https://ipaserver/ipa/xml
during the ipa-join attempt from client side.
However, i've got some hint
I've managed to join this client by running ipa-join locally on ipa server after kinit
admin (same user used for ipa-client-install).
Does it mean anything? Like some relevant entry missed from ldap which is responsible for
remote hosts rights to join?
This is also a manual ipa-join attempt from the client (kinit admin was done as well):
XML-RPC CALL:
<?xml version="1.0" encoding="UTF-8"?>\r\n
<methodCall>\r\n
<methodName>join</methodName>\r\n
<params>\r\n
<param><value><array><data>\r\n
<value><string>client fqdn</string></value>\r\n
</data></array></value></param>\r\n
<param><value><struct>\r\n
<member><name>nsosversion</name>\r\n
<value><string>3.10.0-693.17.1.el7.x86_64</string></value></member>\r\n
<member><name>nshardwareplatform</name>\r\n
<value><string>x86_64</string></value></member>\r\n
</struct></value></param>\r\n
</params>\r\n
</methodCall>\r\n
XML-RPC RESPONSE:
<?xml version='1.0' encoding='UTF-8'?>\n
<methodResponse>\n
<fault>\n
<value><struct>\n
<member>\n
<name>faultCode</name>\n
<value><int>2100</int></value>\n
</member>\n
<member>\n
<name>faultString</name>\n
<value><string>Insufficient access: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Credential cache is
empty)</string></value>\n
</member>\n
</struct></value>\n
</fault>\n
</methodResponse>\n