adduser using keytab does not work, using kinit credential it does - FreeIPA-users - Fedora mailing-lists

28 Nov 2017


      I try to add a user using a principal where has been received a keytab for, the user and it's group are owner, chmod is 600 as it should be. The user can create a valid credential using this keytab.
When I call the user_add command I get the following error.
Array
(
    [error] => Array
        (
            [code] => 2100
            [data] => Array
                (
                    [info] => Could not read UPG Definition originfilter. Check your permissions.
                )
[message] => Insufficient access: Could not read UPG Definition originfilter. Check your permissions.
            [name] => ACIError
        )
[id] => 
    [principal] => testuser/ipa-01.mydomain.tld@MY.DOMAIN
    [result] => 
    [version] => 4.4.4
)
Everything goes well when I do a 'kinit testuser' and created a credential and then call the user_add function again.
Where could this go wrong ?