Began receiving the following error, when attempting to run any ipa commands from all idM
servers as AD users, that are members via ext_group of Admin. The stack has been running
for well over a year now with AD trust in place and first time seeing this issue.
IPA Version 4.5.0
RHEL 7.4
# ipa hbactest
ipa: ERROR: cannot connect to 'any of the configured servers': <
https://server
fqdn//ipa/json>, <
https://server fqdn//ipa/json>, <
https://server
fqdn//ipa/json>, <
https://server fqdn//ipa/json>
WebUI , replication, both AD and IPA user authentication, AD trust; all appear to be
functioning as expected.
The only updates that have been applied to the IdM servers since last known working were
the below listed security updates.
Packages Altered:
Updated 389-ds-base-1.3.6.1-28.el7_4.x86_64 @rhui-REGION-rhel-server-releases
Update 1.3.7.5-21.el7_5.x86_64 @rhui-REGION-rhel-server-releases
Updated 389-ds-base-libs-1.3.6.1-28.el7_4.x86_64 @rhui-REGION-rhel-server-releases
Update 1.3.7.5-21.el7_5.x86_64 @rhui-REGION-rhel-server-releases
Updated dhclient-12:4.2.5-58.el7_4.3.x86_64 @rhui-REGION-rhel-server-releases
Update 12:4.2.5-68.el7_5.1.x86_64 @rhui-REGION-rhel-server-releases
Updated dhcp-common-12:4.2.5-58.el7_4.3.x86_64 @rhui-REGION-rhel-server-releases
Update 12:4.2.5-68.el7_5.1.x86_64 @rhui-REGION-rhel-server-releases
Updated dhcp-libs-12:4.2.5-58.el7_4.3.x86_64 @rhui-REGION-rhel-server-releases
Update 12:4.2.5-68.el7_5.1.x86_64 @rhui-REGION-rhel-server-releases
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: RUNNING
ntpd Service: RUNNING
pki-tomcatd Service: RUNNING
smb Service: RUNNING
winbind Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
The following log entries are created in the httpd error_log when AD user attempts to run
ipa cli commands.
[Fri Jun 01 20:17:14.442248 2018] [auth_gssapi:error] [pid 5717] [client
10.150.0.226:52676] Failed to unseal session data!, referer:
https://server fqdn/ipa/xml
[Fri Jun 01 20:17:14.442271 2018] [auth_gssapi:error] [pid 5717] [client
10.150.0.226:52676] NO AUTH DATA Client did not send any authentication headers, referer:
https://server fqdn/ipa/xml
[Fri Jun 01 20:17:14.468538 2018] [:error] [pid 1668] ipa: INFO: 401 Unauthorized:
Insufficient access: Invalid credentials
[Fri Jun 01 20:17:14.498108 2018] [:error] [pid 1669] ipa: INFO: 401 Unauthorized:
Insufficient access: Invalid credentials
Any help is appreciated.