IPA version 4.6.8.


Got a host that doesn’t allow user logins, but was joined at some point to the domain.

Everything that I can think of to check appears to be working

                Log into client system with local credentials

                Logs show invalid user attempts

Client Keytab looks valid…..do these ever expire?


                                                read_kt /etc/krb5.keytab


                                                                Shows the host/hostname.domain


                Cannot ‘id admin’ or ‘id’ any other user

                Can obtain Kerberos keys for admin

                Can run ipa user-show for any user

                System appears valid in idmweb gui


What did I miss?

                Get a new keytab for the client with ipa-getkeytab?

                Is there some server/client certs I should be checking?




David Patterson