Harald Dunkel via FreeIPA-users wrote:
Hi Flo,
On 7/23/19 2:49 PM, Florence Blanc-Renaud wrote:
> On 7/23/19 12:27 PM, Harald Dunkel via FreeIPA-users wrote:
>> PS: Attached is slapd's errors file as well. Please note the
>> Kerberos errors:
>>
>> :
>> [23/Jul/2019:11:42:23.714599643 +0200] - ERR - set_krb5_creds - Could
>> not get initial credentials for principal
>> [ldap/ipa0.example.de(a)EXAMPLE.DE] in keytab
>> [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for
>> requested realm)
> Hi,
> This error means that kerberos server is not running on ipa0 when
> 389-ds server starts. What is the output of ipactl status on ipa0? You
> can restart the services with ipactl start --ignore-service-failures
> (otherwise failure of a single IPA service will stop the whole stack).
[root@ipa0 ~]# ipactl start --ignore-service-failures
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting httpd Service
Starting ipa-custodia Service
Starting ntpd Service
Starting pki-tomcatd Service
Failed to start pki-tomcatd Service
Forced start, ignoring pki-tomcatd Service, continuing normal operation
Starting ipa-otpd Service
ipa: INFO: The ipactl command was successful
[root@ipa0 ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: STOPPED
pki-tomcatd Service: STOPPED
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
The kdc is running. Its serving requests all the time.
It's a red herring. There is a chicken and egg problem here. The KDC
uses LDAP as its backend and 389-ds needs a ticket. 389-ds starts first,
can't get a ticket and then eventually recovers once the KDC is running.
rob