On 03/05/2021 13:58, Rob Crittenden wrote:
lejeczek via FreeIPA-users wrote:
Hi guys
I do not see any clear problems and no errors in client log but each time I try to install client process stops: ... No SRV records of NTP servers found and no NTP server or pool address was provided. Using default chrony configuration. Attempting to sync time with chronyc. Time synchronization was successful. Do you want to download the CA cert from http://c8kubermaster2.ton.mko.priv.com/ipa/config/ca.crt ? (this is INSECURE) [no]:
If I go with 'yes' as the answer then: ... Joining realm failed: SASL Bind failed Invalid credentials
Installation failed. Rolling back changes. Disabling client Kerberos and LDAP configurations nscd daemon is not installed, skip configuration nslcd daemon is not installed, skip configuration Client uninstall complete. The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
One thing is new and different from all freeIPA deployments I have done in the past, namely REALM =! FQDN but both share a "top level/part". I do not think about that being the root cause. Client install would succeed if I gave it: --server= --domain= --realm= (which is bit weir cause those seem to get discovered as expected)
Any thought on routes of troubleshooting very appreciated. many thanks, L.
You need to read the client install log carefully to ensure it is discovering the expected domain/realm/server.
After providing enrollment credentials those are used to retrieve the CA certificate over LDAP and if that fails, it falls back to HTTP.
Given the enrollment is failing with a bind error perhaps it is as simple as a bad password. That or you're binding to a different server than you are expecting.
rob
Thanks. I mentioned that if I gave client install: --server= --domain= --realm= (using values discovered) then installation succeeds. I also hit, if not "Do you want to download the CA...", then: ... Configured /etc/krb5.conf for IPA realm MKO.PRIV.COM Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm ".... ... unless, I give it --ser..... Most certainly it's not password issue. I can reproduce it every time, including fresh deployment. I see this when REALM =! FQDN, eg. MKO.PRIV.COM vs ton.uk.mko.priv.com
ipa-server-4.9.2-3.module_el8.5.0+750+c59b186b.x86_64
many thanks, L.