On Чцв, 18 сту 2024, 彭勇 via FreeIPA-users wrote:
when we upgrade ipa-server-4.9.12-9 to ipa-server-4.9.12-11 on RHEL 8,
we
can't login to web. the web give me message: “Your session has expired.
Please log in again.”
Read the thread:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
we check the error_log
[Thu Jan 18 21:56:42.535394 2024] [auth_gssapi:error] [pid 11025:tid
139639453087488] [client 118.184.176.67:30891] Failed to unseal session
data!, referer:
https://id1.netegn.com/ipa/xml
[Thu Jan 18 21:56:43.113937 2024] [wsgi:error] [pid 11021:tid
139639621613312] [remote 118.184.176.67:30891] ipa: INFO: 401 Unauthorized:
Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified
GSS failure. Minor code may provide more information (Credential cache is
empty)
[Thu Jan 18 21:56:43.611962 2024] [wsgi:error] [pid 11023:tid
139639621613312] [remote 118.184.176.67:30893] ipa: INFO: 401 Unauthorized:
Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified
GSS failure. Minor code may provide more information (Credential cache is
empty)
all three ipa server failed. we can't resolve the problem, we restore the
snapshot and it recovery.
we install RHEL 9.3 with ipa-server-4.10.2-5,set it as replicator of master
ipa server, it has same problem.
--
Peng Yong
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland