Maybe firewall on client host?
I would look to allowed ports and traffic exchange.

2018-02-02 14:09 GMT+03:00 skrawczenko--- via FreeIPA-users <freeipa-users@lists.fedorahosted.org>:
Hundreds of clients have been joined earlier, never such an issue.
What could have happened please advise?

Client debug - nothing suspicious until:

2018-02-02T10:07:47Z DEBUG args=/usr/sbin/ipa-join -s <arguments>
2018-02-02T10:07:50Z DEBUG Process finished, return code=17
2018-02-02T10:07:50Z DEBUG stdout=
2018-02-02T10:07:50Z DEBUG stderr=No permission to join this host to the IPA domain.

Server debug, not sure if related to the above error:

[Fri Feb 02 02:07:48.515408 2018] [auth_gssapi:error] [pid 28668] [client <ip>:52140] NO AUTH DATA Client did not send any authentication headers, referer: https://ipa.host/ipa/xml

Selinux is disabled on the client side.
Server version 4.5.0

i'm using -p admin to join clients. Therefore permissions are full.

Any ideas please.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org



--
Best regards, Andrew.