Cant login via AD user - FreeIPA-users - Fedora mailing-lists

13 Jun 2021


      Good day.
IPA - 4.9.4.
OS - Fedora 34.
I have established a trust relationship with the AD domain.
The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com"
I can get a ticket using kinit username@example.com in CLI.
I can not log into the server using the AD account from UI.
With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю
In /var/log/httpd/error_log
[Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS
In /var/log/krb5kdc.log
Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser@example.com@IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM@IPA.EXAMPLE.COM, Realm not local to KDC
/etc/krb.conf
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 default_realm = IPA.EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = true
 rdns = false
 ticket_lifetime = 24h
 forwardable = true
 udp_preference_limit = 0
 default_ccache_name = KEYRING:persistent:%{uid}
 default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc
[realms]
 IPA.EXAMPLE.COM = {
  kdc = freeipa-master.ipa.example.com:88
  master_kdc = freeipa-master.ipa.example.com:88
  admin_server = freeipa-master.ipa.example.com:749
  default_domain = ipa.example.com
  pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
  pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
  auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@EXAMPLE.COM/@example.com/
  auth_to_local = DEFAULT
}
[domain_realm]
 .ipa.example.com = IPA.EXAMPLE.COM
 ipa.example.com = IPA.EXAMPLE.COM
 freeipa-master.ipa.example.com = IPA.EXAMPLE.COM
[dbmodules]
  IPA.EXAMPLE.COM = {
    db_library = ipadb.so
  }
[plugins]
 certauth = {
  module = ipakdb:kdb/ipadb.so
  enable_only = ipakdb
 }
/etc/sssd/sssd.conf
[domain/ipa.example.com]
krb5_use_kdcinfo = False
krb5_use_fast = never
id_provider = ipa
ipa_server_mode = True
ipa_server = freeipa-master.ipa.example.com
ipa_domain = ipa.example.com
ipa_hostname = freeipa-master.ipa.example.com
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = True
[sssd]
services = nss, pam, ifp, ssh, sudo
domains = ipa.example.com
[nss]
homedir_substring = /home
memcache_timeout = 600
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
allowed_uids = ipaapi, root
[secrets]
[session_recording]
I would be grateful for any help