On Tue, 2020-01-14 at 15:59 +0100, Ronald Wimmer via FreeIPA-users
wrote:
Some minutes ago and without changing anything servicea started
working
again on my Linux client whereas the problem persists on the Linux
client of a colleague.
There isn't much to go on here, however I would look in two directions initially.
Check whether your client or the server are experiencing any clock
skew.
The max clock skew is 5 minutes, so if the clocks of the two systems
difference is close to 5 minutes, small variations in communication
time may affect access.
The other thing may be related to DNS/discovery issues, esp for people
roaming in and out of their "home" network, esp if the service in
question use a DNS name (and therefore SPN) that is not part of the
same AD Domain Name subdomain.
to debug what is going on you could restart your browser from a
terminal by first setting the KRB5_TRACE envrionment variable like so:
$ KRB5_TRACE=/tmp/krb5.trace.log firefox
Or similar (not, for Firefox, if you call this cmdline while the
browser is already open, the env var will not be set as firefox will
ask the existing process to open a new window and then will exit).
Once you have a trace you can see if there were any specific errors in
trying to get a ticket for the target server that give you a better
clue.
HTH,
Simo.
--
Simo Sorce
RHEL Crypto Team
Red Hat, Inc