On ke, 25 huhti 2018, Ross Infinger via FreeIPA-users wrote:
I get this error when trying to login to the freeipa gui on the CA
master.
"Login failed due to an unknow reason"
This started after an attempt to create a new replica failed on another machine.
freeipa version: VERSION: 4.5.0, API_VERSION: 2.228
Snippet from /var/log/httpd/error_log
...
[Wed Apr 25 21:47:43.846406 2018] [:error] [pid 29271] ipa: DEBUG: stderr=kinit:
Pre-authentication failed: Cannot read password while getting initial credentials
[Wed Apr 25 21:47:43.846976 2018] [:error] [pid 29271] [remote 192.168.145.30:188]
CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_29271 -X
X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X
X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit
status 1
Anyone seen this before?
The error above is for an attempt to obtain an initial
ticket for
anonymous principal, used for wrapping requests with 2FA.
Can you show output of
ipa-pkinit-manage status
command?
Also, what is your configuration? External CA, integrated CA, etc?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland