Hi,
It turns out this is a docker specific problem when the container is run with
--privileged
See
https://github.com/freeipa/freeipa-container/issues/383#issuecomment-8867... for
more
________________________________________
发件人: 胡 玮文 <huww98(a)outlook.com>
发送时间: 2021年7月26日 11:15
收件人: freeipa-users(a)lists.fedorahosted.org
主题: Login failed after upgrade
Hi all,
Some similar issues have appeared on this list several times, but I think mine is
different.
I have a docker deployment with 2 replicas. I upgraded them from docker image
freeipa/freeipa-server:fedora-33-4.9.2 to fedora-34-4.9.6. The upgrade process goes
smoothly. However, now I cannot log in into web-UI, with the error "Login failed due
to an unknown reason", and every ipa command returns "ipa: ERROR: No valid
Negotiate header in server response". 2 replicas report the same error and reboot
does not help. But kinit works.
The strange thing is that no "fail" message in kdc log. So I don't have any
idea what may go wrong. ipa-healthcheck reports 2 warning, but they seem not relevant
here: "No DNA range defined" and missing ipa-ca AAAA records (we don't have
IPv6 address now, so manually removed AAAA)
Some previous threads indicate an outdated keytab, but It seems not my case. "kinit
-k -t /var/lib/ipa/gssproxy/http.keytab HTTP/ipa1.mydomain.com(a)MYDOMAIN.COM" works
fine.
Any help is very appreciated.
Thanks
Hu Weiwen
/var/log/httpd/error_log:
[auth_gssapi:error] [pid 2062:tid 2117] [client fe80::a242:3fff:fe37:52fb%enp13s0f1:60752]
GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure.
Minor code may provide more information ( SPNEGO cannot find mechanisms to negotiate)]
[wsgi:error] [pid 2056:tid 2353] [remote 125.216.246.30:12133] ipa: INFO: 401
Unauthorized: No session cookie found
/var/log/krb5kdc.log
krb5kdc[2041](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18),
aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha256-128(19),
aes128-cts-hmac-sha1-96(17), camellia128-cts-cmac(25)}) 202.38.247.181: NEEDED_PREAUTH:
WELLKNOWN/ANONYMOUS(a)MYDOMAIN.COM for krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM, Additional
pre-authentication required
krb5kdc[2041](info): closing down fd 11
krb5kdc[2027](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18),
aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha256-128(19),
aes128-cts-hmac-sha1-96(17), camellia128-cts-cmac(25)}) 202.38.247.181: ISSUE: authtime
1627268346, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18),
ses=aes256-cts-hmac-sha1-96(18)}, WELLKNOWN/ANONYMOUS(a)MYDOMAIN.COM for
krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM
krb5kdc[2027](info): closing down fd 11
krb5kdc[2027](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18),
aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha256-128(19),
aes128-cts-hmac-sha1-96(17), camellia128-cts-cmac(25)}) 202.38.247.181: NEEDED_PREAUTH:
myusername(a)MYDOMAIN.COM for krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM, Additional
pre-authentication required
krb5kdc[2027](info): closing down fd 11
krb5kdc[2027](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18),
aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha256-128(19),
aes128-cts-hmac-sha1-96(17), camellia128-cts-cmac(25)}) 202.38.247.181: ISSUE: authtime
1627268346, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18),
ses=aes256-cts-hmac-sha1-96(18)}, myusername(a)MYDOMAIN.COM for
krbtgt/MYDOMAIN.COM(a)MYDOMAIN.COM
krb5kdc[2027](info): closing down fd 11
krb5kdc[2027](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18),
aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha256-128(19),
aes128-cts-hmac-sha1-96(17), camellia128-cts-cmac(25)}) 202.38.247.181: ISSUE: authtime
1627268346, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18),
ses=aes256-cts-hmac-sha1-96(18)}, myusername(a)MYDOMAIN.COM for
HTTP/ipa1.mydomain.com(a)MYDOMAIN.COM
krb5kdc[2027](info): closing down fd 11
journalctl does not show any error. "systemctl status" reports every service is
running