Hi Rob,
The FreeIPA accounts are using LDAP for logins to clients, right?
That’s what I’ve understood. Is that wrong?
SSSD uses the host keytab to authenticate so if Kerberos isn't working
then that would be affected.
The reason that I am forcing Kerberos realm is that the discovery
does
not properly configure the krb5.conf, and it fails because it says it
can’t contact the KDC for the Realm. Once I configure krb5.conf with
the missing parameters, it works fine. I use kinit and it finds the
real fine.
It's failing because KDC discovery (dns_lookup_kdc) is true in your
final krb5.conf and since it can't be looked up, things fail. You're
probably missing the Kerberos TXT record.
I assume this doesn't return your realm:
$ dig +short -t TXT _kerberos.example.test.
rob
Thanks,
Scott Reed
*From: *Rob Crittenden <mailto:rcritten@redhat.com>
*Sent: *Friday, May 7, 2021 6:23 PM
*To: *FreeIPA users list <mailto:freeipa-users@lists.fedorahosted.org>
*Cc: *Steve Reed <mailto:scottmreed@hotmail.com>
*Subject: *Re: [Freeipa-users] Problem with Client Installs on Centos 7
Steve Reed via FreeIPA-users wrote:
> Hi all,
>
> I am running Versions 4.8 of the client installations. I have one
machine that installed except it failed to configure the krb5.conf file
properly and it fails saying that it can't find the KDC for the realm
xyz.com. I can fix Kerberos by manually editing the kfb5.conf file.
Except for the rest of the machines which won't work for ldap logins,
but Kerberos works fine.
>
> Prior to the installation, I make sure the resolv.conf file is
configured properly. I make sure that the /etc/hosts file has the
proper entries for the machine I am installing on and the server. No
extraneous domain names. Also, I make sure the hostname is fully
qualified with the domain name. I turn off any potential firewalld,
iptables or ip6tables services as well.
>
> This is the installation command:
>
> ipa-client-install --mkhomedir -p admin -w PassWord@12345!
--ntp-server=idm.xyz.com --unattended --force-join --realm
XYZ.COM
>
>
> 2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log
> 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with
arguments [] and options: {'no_dns_sshfp': False, 'force': False,
'verbose': False, 'ip_addresses': None, 'configure_firefox':
False,
'realm_name': 'XYZ.COM', 'force_ntpd': False,
'on_master': False,
'no_nisdomain': False, 'ssh_trust_dns': False, 'principal':
'admin',
'keytab': None, 'no_ntp': False, 'domain_name': None,
'request_cert':
False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False,
'ca_cert_files': None, 'all_ip_addresses': False,
'kinit_attempts':
None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates':
False,
'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords':
False,
'servers': None, 'no_ssh': False, 'force_join': True,
'firefox_dir':
None, 'unattended': True, 'quiet': False, 'nisdomain': None,
'prompt_password': False, 'host_name': None, 'permit': False,
'automount_location': None, 'preserve_sssd': False, 'mkhomedir':
True,
'log_file': None, 'uninstall': False}
> 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos
> 2021-05-07T20:36:19Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
> 2021-05-07T20:36:19Z DEBUG Starting external process
> 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled
> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:19Z DEBUG stdout=
> 2021-05-07T20:36:19Z DEBUG stderr=
> 2021-05-07T20:36:19Z DEBUG Starting external process
> 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service
> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:19Z DEBUG stdout=enabled
>
> 2021-05-07T20:36:19Z DEBUG stderr=
> 2021-05-07T20:36:19Z DEBUG [IPA Discovery]
> 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None,
servers=None,
hostname=client1.xyz.com
> 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in
"xyz.com" (domain of the hostname) and its sub-domains
> 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
_ldap._tcp.xyz.com
> 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389
idm.xyz.com.
> 2021-05-07T20:36:19Z DEBUG [Kerberos realm search]
> 2021-05-07T20:36:19Z DEBUG Kerberos realm forced
> 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
_kerberos._udp.xyz.com
> 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88
idm.xyz.com.
> 2021-05-07T20:36:19Z DEBUG [LDAP server check]
> 2021-05-07T20:36:19Z DEBUG Verifying that
idm.xyz.com (realm
XYZ.COM)
is an IPA server
> 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389
> 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN
> 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is
for IPA
> 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid
IPA context
> 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer)
in dc=xyz,dc=com (sub)
> 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com
> 2021-05-07T20:36:19Z DEBUG Discovery result: Success;
server=idm.xyz.com,
domain=xyz.com,
kdc=idm.xyz.com, basedn=dc=xyz,dc=com
> 2021-05-07T20:36:19Z DEBUG Validated servers:
idm.xyz.com
> 2021-05-07T20:36:19Z DEBUG will use discovered domain:
xyz.com
> 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in
"xyz.com" (Validating DNS Discovery) and its sub-domains
> 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of
_ldap._tcp.xyz.com
> 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389
idm.xyz.com.
> 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery
> 2021-05-07T20:36:19Z DEBUG will use discovered server:
idm.xyz.com
> 2021-05-07T20:36:19Z INFO Discovery was successful!
> 2021-05-07T20:36:19Z DEBUG will use discovered realm:
XYZ.COM
> 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com
> 2021-05-07T20:36:19Z INFO Client hostname:
client1.xyz.com
> 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN
> 2021-05-07T20:36:19Z INFO Realm:
XYZ.COM
> 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS
records in
idm.xyz.com
> 2021-05-07T20:36:19Z INFO DNS Domain:
xyz.com
> 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV
records from
xyz.com (domain of the hostname)
> 2021-05-07T20:36:19Z INFO IPA Server:
idm.xyz.com
> 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS
records in
idm.xyz.com
> 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com
> 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server
ldap://idm.xyz.com:389
> 2021-05-07T20:36:19Z DEBUG Loading Index file from
'/var/lib/ipa-client/sysrestore/sysrestore.index'
> 2021-05-07T20:36:19Z DEBUG Loading StateFile from
'/var/lib/ipa-client/sysrestore/sysrestore.state'
> 2021-05-07T20:36:19Z DEBUG Starting external process
> 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k
/etc/krb5.keytab -r
XYZ.COM
> 2021-05-07T20:36:19Z DEBUG Process finished, return code=5
> 2021-05-07T20:36:19Z DEBUG stdout=
> 2021-05-07T20:36:19Z DEBUG stderr=realm not found
>
> 2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server.
> 2021-05-07T20:36:19Z DEBUG Starting external process
> 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:19Z DEBUG stdout=599779671
>
> 2021-05-07T20:36:19Z DEBUG stderr=
> 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE
> 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to
/tmp/tmpfFCY1T:
> 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
>
> includedir /etc/krb5.conf.d/
> includedir /var/lib/sss/pubconf/krb5.include.d/
>
> [libdefaults]
> default_realm =
XYZ.COM
> dns_lookup_realm = false
> dns_lookup_kdc = false
> rdns = false
> dns_canonicalize_hostname = false
> ticket_lifetime = 24h
> forwardable = true
> udp_preference_limit = 0
> default_ccache_name = KEYRING:persistent:%{uid}
>
>
> [realms]
>
XYZ.COM = {
> kdc = idm.xyz.com:88
> master_kdc = idm.xyz.com:88
> admin_server = idm.xyz.com:749
> kpasswd_server = idm.xyz.com:464
> default_domain =
xyz.com
> pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
> pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
>
> }
>
>
> [domain_realm]
> .xyz.com =
XYZ.COM
>
xyz.com =
XYZ.COM
>
client1.xyz.com =
XYZ.COM
>
>
>
> 2021-05-07T20:36:19Z DEBUG Initializing principal admin(a)XYZ.COM using
password
> 2021-05-07T20:36:19Z DEBUG Starting external process
> 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin(a)XYZ.COM -c
/tmp/krbccnj9ncO/ccache
> 2021-05-07T20:36:19Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:19Z DEBUG stdout=Password for admin(a)XYZ.COM:
>
> 2021-05-07T20:36:19Z DEBUG stderr=
> 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from
idm.xyz.com
> 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache
url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject
instance at 0x7fc3c40d7248>
> 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert
> Subject: CN=Certificate
Authority,O=XYZ.COM
> Issuer: CN=Certificate
Authority,O=XYZ.COM
> Valid From: 2021-05-06 19:54:28
> Valid Until: 2041-05-06 19:54:28
>
> 2021-05-07T20:36:19Z DEBUG Starting external process
> 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s
idm.xyz.com -b
dc=xyz,dc=com -h
client1.xyz.com -f
> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:20Z DEBUG stdout=
> 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and
stored in: /etc/krb5.keytab
> Certificate subject base is:
O=XYZ.COM
>
> 2021-05-07T20:36:20Z INFO Enrolled in IPA realm
XYZ.COM
> 2021-05-07T20:36:20Z DEBUG Starting external process
> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy
> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:20Z DEBUG stdout=
> 2021-05-07T20:36:20Z DEBUG stderr=
> 2021-05-07T20:36:20Z DEBUG Initializing principal
host/client1.xyz.com(a)XYZ.COM using keytab /etc/krb5.keytab
> 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache
> 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success
> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/ipa/default.conf'
> 2021-05-07T20:36:20Z DEBUG -> Not backing up -
'/etc/ipa/default.conf' doesn't exist
> 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf
> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/sssd/sssd.conf'
> 2021-05-07T20:36:20Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/nsswitch.conf'
> 2021-05-07T20:36:20Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
> 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf
> 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf
> 2021-05-07T20:36:20Z DEBUG Backing up system configuration file
'/etc/krb5.conf'
> 2021-05-07T20:36:20Z DEBUG Saving Index File to
'/var/lib/ipa-client/sysrestore/sysrestore.index'
> 2021-05-07T20:36:20Z DEBUG Starting external process
> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0
> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:20Z DEBUG stdout=599779671
>
> 2021-05-07T20:36:20Z DEBUG stderr=
> 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE
> 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to
/etc/krb5.conf:
> 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
>
> includedir /etc/krb5.conf.d/
> includedir /var/lib/sss/pubconf/krb5.include.d/
>
> [libdefaults]
> default_realm =
XYZ.COM
> dns_lookup_realm = true
> dns_lookup_kdc = true
> rdns = false
> dns_canonicalize_hostname = false
> ticket_lifetime = 24h
> forwardable = true
> udp_preference_limit = 0
> default_ccache_name = KEYRING:persistent:%{uid}
>
>
> [realms]
>
XYZ.COM = {
> pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
> pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
>
> }
>
>
> [domain_realm]
> .xyz.com =
XYZ.COM
>
xyz.com =
XYZ.COM
>
client1.xyz.com =
XYZ.COM
>
>
>
> 2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm
XYZ.COM
> 2021-05-07T20:36:20Z DEBUG Starting external process
> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d
dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f
/tmp/tmpxItqiM/pwdfile.txt
> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:20Z DEBUG stdout=
> 2021-05-07T20:36:20Z DEBUG stderr=
> 2021-05-07T20:36:20Z DEBUG Starting external process
> 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d
dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f
/tmp/tmpxItqiM/pwdfile.txt
> 2021-05-07T20:36:20Z DEBUG Process finished, return code=0
> 2021-05-07T20:36:20Z DEBUG stdout=
> 2021-05-07T20:36:20Z DEBUG stderr=
> 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent
storage for principal 'host/client1.xyz.com(a)XYZ.COM'
> 2021-05-07T20:36:20Z INFO trying
https://idm.xyz.com/ipa/json
> 2021-05-07T20:36:20Z DEBUG Created connection
context.rpcclient_140479019423504
> 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server
'https://idm.xyz.com/ipa/json'
> 2021-05-07T20:36:20Z DEBUG New HTTP connection (
idm.xyz.com)
> 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (
idm.xyz.com)
> Traceback (most recent call last):
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
single_request
> self.get_auth_info()
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
get_auth_info
> self._handle_exception(e, service=service)
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in
_handle_exception
> raise errors.KerberosError(message=unicode(e))
> KerberosError: Major (851968): Unspecified GSS failure. Minor code
may provide more information, Minor (2529639068): Cannot contact any KDC
for realm 'XYZ.COM'
> 2021-05-07T20:36:20Z DEBUG Destroyed connection
context.rpcclient_140479019423504
> 2021-05-07T20:36:20Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in
execute
> return_value = self.run()
> File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py",
line 319, in run
> return cfgr.run()
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 360, in run
> return self.execute()
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 386, in execute
> for rval in self._executor():
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 431, in __runner
> exc_handler(exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 460, in _handle_execute_exception
> self._handle_exception(exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 450, in _handle_exception
> six.reraise(*exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 421, in __runner
> step()
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 418, in <lambda>
> step = lambda: next(self.__gen)
> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
> six.reraise(*exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
> value = gen.send(prev_value)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 655, in _configure
> next(executor)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 431, in __runner
> exc_handler(exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 460, in _handle_execute_exception
> self._handle_exception(exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 518, in _handle_exception
> self.__parent._handle_exception(exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 450, in _handle_exception
> six.reraise(*exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 515, in _handle_exception
> super(ComponentBase, self)._handle_exception(exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 450, in _handle_exception
> six.reraise(*exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 421, in __runner
> step()
> File "/usr/lib/python2.7/site-packages/ipapython/install/core.py",
line 418, in <lambda>
> step = lambda: next(self.__gen)
> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 81, in run_generator_with_yield_from
> six.reraise(*exc_info)
> File "/usr/lib/python2.7/site-packages/ipapython/install/util.py",
line 59, in run_generator_with_yield_from
> value = gen.send(prev_value)
> File "/usr/lib/python2.7/site-packages/ipapython/install/common.py",
line 65, in _install
> for unused in self._installer(self.parent):
> File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 3670, in main
> install(self)
> File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 2391, in install
> _install(options)
> File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py",
line 2733, in _install
> api.finalize()
> File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line
740, in finalize
> self.__do_if_not_done('load_plugins')
> File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line
431, in __do_if_not_done
> getattr(self, name)()
> File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line
619, in load_plugins
> for package in self.packages:
> File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line
954, in packages
> ipaclient.remote_plugins.get_package(self),
> File
"/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py",
line 134, in get_package
> plugins = schema.get_package(server_info, client)
> File
"/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 553, in get_package
> schema = Schema(client)
> File
"/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 401, in __init__
> fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
> File
"/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 426, in _fetch
> schema = client.forward(u'schema', **kwargs)['result']
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in
forward
> return self._call_command(command, params)
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in
_call_command
> return command(*params)
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in
_call
> return self.__request(name, args)
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in
__request
> verbose=self.__verbose >= 3,
> File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
> return self.single_request(host, handler, request_body, verbose)
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in
single_request
> self.get_auth_info()
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in
get_auth_info
> self._handle_exception(e, service=service)
> File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in
_handle_exception
> raise errors.KerberosError(message=unicode(e))
>
> 2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed,
exception: KerberosError: Major (851968): Unspecified GSS failure.
Minor code may provide more information, Minor (2529639068): Cannot
contact any KDC for realm 'XYZ.COM'
> 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure.
Minor code may provide more information, Minor (2529639068): Cannot
contact any KDC for realm 'XYZ.COM'
> 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
>
> So, what I found is that the krb5.conf file is partially configured.
I'm not sure what to look for in the sssd.conf file. I am assuming that
since I can't login with an ldap account and it finds the domain that
something is not cofigured properly for that either.
>
> Any thoughts on what is going wrong? And how I can fix it or work
around it? I'm more worried about not being able to do ldap logins than
the Kerberos problem since I have a work around for that.
Can you expand on what you mean by ldap logins fail?
Is there a reason you're forcing the Kerberos realm and not relying on
discovery?
rob