IPA version 4.6.8.
Got a host that doesn’t allow user logins, but was joined at some point to the domain.
Everything that I can think of to check appears to be working
Log into client system with local credentials
Logs show invalid user attempts
Client Keytab looks valid…..do these ever expire?
Shows the host/hostname.domain
Cannot ‘id admin’ or ‘id’ any other user
Can obtain Kerberos keys for admin
Can run ipa user-show for any user
System appears valid in idmweb gui
What did I miss?
Get a new keytab for the client with ipa-getkeytab?
Is there some server/client certs I should be checking?