Loading the python2 ipa packages got through the first error.
The script seems to be setting some permissions and creating some users but then there are some keytab failures.
I'm just a beginner at this so I need to learn more about how ipa handles these matters. I see the portal user Self Service in the user table vi the web UI.
I already kinit admin prior to this and get:
[
me@portal ~
]$ create-portal-user
Created privilege 'Portal management privilege'
Added permission 'System: Add Stage User' to privilege
Added permission 'System: Read Stage User' to privilege
Added permission 'System: Change User password' to privilege
Cannot add permission 'System: Read User Standard Attributes' to privilege
ipa: WARNING: Cannot add permission 'System: Read User Standard Attributes' to privilege
Cannot add permission 'System: Read User Addressbook Attributes' to privilege
ipa: WARNING: Cannot add permission 'System: Read User Addressbook Attributes' to privilege
Created role 'Portal management'
Added privilege 'Portal management privilege' to role 'Portal management'
Created user 'portal'
Added role 'Portal management' to user 'portal'
Retrieving keytab...
ipa-getkeytab -s
prime.ipa.kkgpitt.org -p
portal@IPA.KKGPITT.ORG -k /etc/ipa/portal.keytab
Failed to add key to the keytab
Traceback (most recent call last):
File "/home/me/.local/bin/create-portal-user", line 207, in <module>
main()
File "/home/me/.local/bin/create-portal-user", line 197, in main
create_keytab(args.username, args.keytab, args.keytab_owner)
File "/home/me/.local/bin/create-portal-user", line 180, in create_keytab
subprocess.check_call(cmd)
File "/usr/lib64/python2.7/subprocess.py", line 190, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['ipa-getkeytab', '-s', u'
prime.ipa.kkgpitt.org', '-p',
u'portal@IPA.KKGPITT.ORG', '-k', '/etc/ipa/portal.keytab']' returned non-zero exit status 11
[me@portal ~]$ ipa-getkeytab -s
prime.ipa.kkgpitt.org -p
portal@IPA.KKGPITT.ORG -k /etc/ipa/portal.keytab
Failed to add key to the keytab
I tried to manually change the password and try again which yielded a slightly different error.
[me@portal ~]$ ipa-getkeytab -s
prime.ipa.kkgpitt.org -p <new pw> -k /etc/ipa/portal.keytab
Failed to parse result: PrincipalName not found.
Retrying with pre-4.0 keytab retrieval method...
Failed to parse result: PrincipalName not found.
Failed to get keytab!
Failed to get keytab