Good day. IPA - 4.9.4. OS - Fedora 34. I have established a trust relationship with the AD domain. The list of domains is easily obtained by the command ipa trust-fetch-domains "example.com" I can get a ticket using kinit username@example.com in CLI. I can not log into the server using the AD account from UI. With exactly the same installation but on the Centos 7 + IPA 4.6.8 there are no similar problemsю
In /var/log/httpd/error_log [Sun Jun 13 15:51:14.045718 2021] [wsgi:error] [pid 2312:tid 2815] [remote 172.17.51.252:8946] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844988): KDC returned error string: PROCESS_TGS
In /var/log/krb5kdc.log Jun 13 15:51:13 freeipa-master.ipa.example.com krb5kdc[2256](info): AS_REQ (3 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), DEPRECATED:arcfour-hmac(23)}) 172.17.252.121: REFERRAL: aduser@ example.com@IPA.EXAMPLE.COM for krbtgt/IPA.EXAMPLE.COM@IPA.EXAMPLE.COM, Realm not local to KDC
/etc/krb.conf includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} default_tkt_enctypes = aes256-cts aes128-cts rc4-hmac arcfour-hmac-md5 des-cbc-md5 des-cbc-crc
[realms] IPA.EXAMPLE.COM = { kdc = freeipa-master.ipa.example.com:88 master_kdc = freeipa-master.ipa.example.com:88 admin_server = freeipa-master.ipa.example.com:749 default_domain = ipa.example.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@EXAMPLE.COM$)s/@ EXAMPLE.COM/@example.com/ auth_to_local = DEFAULT
}
[domain_realm] .ipa.example.com = IPA.EXAMPLE.COM ipa.example.com = IPA.EXAMPLE.COM freeipa-master.ipa.example.com = IPA.EXAMPLE.COM
[dbmodules] IPA.EXAMPLE.COM = { db_library = ipadb.so }
[plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb }
/etc/sssd/sssd.conf [domain/ipa.example.com] krb5_use_kdcinfo = False krb5_use_fast = never id_provider = ipa ipa_server_mode = True ipa_server = freeipa-master.ipa.example.com ipa_domain = ipa.example.com ipa_hostname = freeipa-master.ipa.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True [sssd] services = nss, pam, ifp, ssh, sudo
domains = ipa.example.com [nss] homedir_substring = /home memcache_timeout = 600
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp] allowed_uids = ipaapi, root
[secrets]
[session_recording]
I would be grateful for any help
freeipa-users@lists.fedorahosted.org