On 25/05/2023 11:58, lejeczek via FreeIPA-users wrote:
Hi guys.

This is my first trial/test of replicas in container - here I added a replica to already existing, bare-metal IPA domain, which otherwise works a okey - so numerous issues are possible.
In container, only in this replica, I get:

bash-5.1# ipa dnszone-find
ipa: ERROR: No valid Negotiate header in server response

What that is, might be, a symptom of? Where to go with troubleshooting?

All thoughts share are much appreciated.
many thanks, L.


for experts, bit more debug:

-> $ ipa --debug dnszone-find
ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
ipa: DEBUG: failed to find session_cookie in persistent storage for principal 'admin@MINE.PRIV'
ipa: DEBUG: trying https://swir-ipa.mine.priv/ipa/json
ipa: DEBUG: New HTTP connection (swir-ipa.mine.priv)
ipa: DEBUG: HTTP connection destroyed (swir-ipa.mine.priv)
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package
    plugins = api._remote_plugins
AttributeError: 'API' object has no attribute '_remote_plugins'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/ipalib/rpc.py", line 724, in single_request
    if not self._auth_complete(response):
  File "/usr/lib/python3.9/site-packages/ipalib/rpc.py", line 673, in _auth_complete
    raise errors.KerberosError(
ipalib.errors.KerberosError: No valid Negotiate header in server response
ipa: ERROR: No valid Negotiate header in server response

-> $ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin@MINE.PRIV

Valid starting     Expires            Service principal
05/25/23 09:46:11  05/26/23 09:40:03  krbtgt/MINE.PRIV@MINE.PRIV
05/25/23 09:47:45  05/26/23 09:40:03  HTTP/swir-ipa.mine.priv@MINE.PRIV