On 03/05/2021 13:58, Rob Crittenden wrote:
lejeczek via FreeIPA-users wrote:
> Hi guys
> I do not see any clear problems and no errors in client log but each
> time I try to install client process stops:
> No SRV records of NTP servers found and no NTP server or pool address
> was provided.
> Using default chrony configuration.
> Attempting to sync time with chronyc.
> Time synchronization was successful.
> Do you want to download the CA cert from
> (this is INSECURE) [no]:
> If I go with 'yes' as the answer then:
> Joining realm failed: SASL Bind failed
> Invalid credentials
> Installation failed. Rolling back changes.
> Disabling client Kerberos and LDAP configurations
> nscd daemon is not installed, skip configuration
> nslcd daemon is not installed, skip configuration
> Client uninstall complete.
> The ipa-client-install command failed. See
> /var/log/ipaclient-install.log for more information
> One thing is new and different from all freeIPA deployments I have done
> in the past, namely
> REALM =! FQDN
> but both share a "top level/part".
> I do not think about that being the root cause.
> Client install would succeed if I gave it:
> --server= --domain= --realm= (which is bit weir cause those seem to get
> discovered as expected)
> Any thought on routes of troubleshooting very appreciated.
> many thanks, L.
You need to read the client install log carefully to ensure it is
discovering the expected domain/realm/server.
After providing enrollment credentials those are used to retrieve the CA
certificate over LDAP and if that fails, it falls back to HTTP.
Given the enrollment is failing with a bind error perhaps it is as
simple as a bad password. That or you're binding to a different server
than you are expecting.
I mentioned that if I gave client install: --server=
--domain= --realm= (using values discovered) then
I also hit, if not "Do you want to download the CA...", then:
Configured /etc/krb5.conf for IPA realm MKO.PRIV.COM
Major (851968): Unspecified GSS failure. Minor code may
provide more information, Minor (2529639066): Cannot find
KDC for realm "....
unless, I give it --ser.....
Most certainly it's not password issue.
I can reproduce it every time, including fresh deployment. I
see this when REALM =! FQDN, eg. MKO.PRIV.COM
many thanks, L.