Hi all,
I am running Versions 4.8 of the client installations. I have one machine that installed except it failed to configure the krb5.conf file properly and it fails saying that it can't find the KDC for the realm xyz.com. I can fix Kerberos by manually editing the kfb5.conf file. Except for the rest of the machines which won't work for ldap logins, but Kerberos works fine.
Prior to the installation, I make sure the resolv.conf file is configured properly. I make sure that the /etc/hosts file has the proper entries for the machine I am installing on and the server. No extraneous domain names. Also, I make sure the hostname is fully qualified with the domain name. I turn off any potential firewalld, iptables or ip6tables services as well.
This is the installation command:
ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM
2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin', 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None, 'unattended': True, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False} 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=enabled
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG [IPA Discovery] 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=client1.xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (domain of the hostname) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [Kerberos realm search] 2021-05-07T20:36:19Z DEBUG Kerberos realm forced 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _kerberos._udp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [LDAP server check] 2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM) is an IPA server 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com (sub) 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Discovery result: Success; server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com 2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (Validating DNS Discovery) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery 2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com 2021-05-07T20:36:19Z INFO Discovery was successful! 2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com 2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN 2021-05-07T20:36:19Z INFO Realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO DNS Domain: xyz.com 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from xyz.com (domain of the hostname) 2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM 2021-05-07T20:36:19Z DEBUG Process finished, return code=5 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr=realm not found
2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server. 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=599779671
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T: 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] XYZ.COM = { kdc = idm.xyz.com:88 master_kdc = idm.xyz.com:88 admin_server = idm.xyz.com:749 kpasswd_server = idm.xyz.com:464 default_domain = xyz.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM
2021-05-07T20:36:19Z DEBUG Initializing principal admin@XYZ.COM using password 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin@XYZ.COM -c /tmp/krbccnj9ncO/ccache 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=Password for admin@XYZ.COM:
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from idm.xyz.com 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248> 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: 2021-05-06 19:54:28 Valid Until: 2041-05-06 19:54:28
2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b dc=xyz,dc=com -h client1.xyz.com -f 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=XYZ.COM
2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com@XYZ.COM using keytab /etc/krb5.keytab 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2021-05-07T20:36:20Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout=599779671
2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults] default_realm = XYZ.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] XYZ.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM
2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for principal 'host/client1.xyz.com@XYZ.COM' 2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json 2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server 'https://idm.xyz.com/ipa/json' 2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com) 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com) Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e)) KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main install(self) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install _install(options) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2733, in _install api.finalize() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins for package in self.packages: File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package schema = Schema(client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch schema = client.forward(u'schema', **kwargs)['result'] File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward return self._call_command(command, params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in _call_command return command(*params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call return self.__request(name, args) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in __request verbose=self.__verbose >= 3, File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request return self.single_request(host, handler, request_body, verbose) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e))
2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
So, what I found is that the krb5.conf file is partially configured. I'm not sure what to look for in the sssd.conf file. I am assuming that since I can't login with an ldap account and it finds the domain that something is not cofigured properly for that either.
Any thoughts on what is going wrong? And how I can fix it or work around it? I'm more worried about not being able to do ldap logins than the Kerberos problem since I have a work around for that.
Thanks,
Steve
Steve Reed via FreeIPA-users wrote:
Hi all,
I am running Versions 4.8 of the client installations. I have one machine that installed except it failed to configure the krb5.conf file properly and it fails saying that it can't find the KDC for the realm xyz.com. I can fix Kerberos by manually editing the kfb5.conf file. Except for the rest of the machines which won't work for ldap logins, but Kerberos works fine.
Prior to the installation, I make sure the resolv.conf file is configured properly. I make sure that the /etc/hosts file has the proper entries for the machine I am installing on and the server. No extraneous domain names. Also, I make sure the hostname is fully qualified with the domain name. I turn off any potential firewalld, iptables or ip6tables services as well.
This is the installation command:
ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM
2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin', 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None, 'unattended': True, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False} 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=enabled
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG [IPA Discovery] 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=client1.xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (domain of the hostname) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [Kerberos realm search] 2021-05-07T20:36:19Z DEBUG Kerberos realm forced 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _kerberos._udp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [LDAP server check] 2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM) is an IPA server 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com (sub) 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Discovery result: Success; server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com 2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (Validating DNS Discovery) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery 2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com 2021-05-07T20:36:19Z INFO Discovery was successful! 2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com 2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN 2021-05-07T20:36:19Z INFO Realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO DNS Domain: xyz.com 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from xyz.com (domain of the hostname) 2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM 2021-05-07T20:36:19Z DEBUG Process finished, return code=5 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr=realm not found
2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server. 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=599779671
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T: 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] XYZ.COM = { kdc = idm.xyz.com:88 master_kdc = idm.xyz.com:88 admin_server = idm.xyz.com:749 kpasswd_server = idm.xyz.com:464 default_domain = xyz.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM
2021-05-07T20:36:19Z DEBUG Initializing principal admin@XYZ.COM using password 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin@XYZ.COM -c /tmp/krbccnj9ncO/ccache 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=Password for admin@XYZ.COM:
2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from idm.xyz.com 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248> 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: 2021-05-06 19:54:28 Valid Until: 2041-05-06 19:54:28
2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b dc=xyz,dc=com -h client1.xyz.com -f 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=XYZ.COM
2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com@XYZ.COM using keytab /etc/krb5.keytab 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2021-05-07T20:36:20Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout=599779671
2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults] default_realm = XYZ.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] XYZ.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM
2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for principal 'host/client1.xyz.com@XYZ.COM' 2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json 2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server 'https://idm.xyz.com/ipa/json' 2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com) 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com) Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e)) KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main install(self) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install _install(options) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2733, in _install api.finalize() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins for package in self.packages: File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package schema = Schema(client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch schema = client.forward(u'schema', **kwargs)['result'] File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward return self._call_command(command, params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in _call_command return command(*params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call return self.__request(name, args) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in __request verbose=self.__verbose >= 3, File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request return self.single_request(host, handler, request_body, verbose) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e))
2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
So, what I found is that the krb5.conf file is partially configured. I'm not sure what to look for in the sssd.conf file. I am assuming that since I can't login with an ldap account and it finds the domain that something is not cofigured properly for that either.
Any thoughts on what is going wrong? And how I can fix it or work around it? I'm more worried about not being able to do ldap logins than the Kerberos problem since I have a work around for that.
Can you expand on what you mean by ldap logins fail?
Is there a reason you're forcing the Kerberos realm and not relying on discovery?
rob
Hi Rob,
The FreeIPA accounts are using LDAP for logins to clients, right? That’s what I’ve understood. Is that wrong?
The reason that I am forcing Kerberos realm is that the discovery does not properly configure the krb5.conf, and it fails because it says it can’t contact the KDC for the Realm. Once I configure krb5.conf with the missing parameters, it works fine. I use kinit and it finds the real fine.
Thanks,
Steve
Hi Steve,
I'm not sure if I understand exactly what's happening but it sound's like a DNS issue. The records FreeIPA/IdM needs are fairly extensive. you can print them out with the following command:
ipa dns-update-system-records --dry-run
You might need to go through and systematically add those entries to get discovery to work. One issue may be that Kerberos relies on all those SRV entries with underscores for discovery, and I'm not sure if /etc/hosts supports SRV records.
Best, Owen
Ah, after I did a kinit login.
It came back with the information on the server.
It won't work on the clients because they didn't install properly.
[root@ozservices installer]# ipa dns-update-system-records --dry-run IPA DNS records: _kerberos-master._tcp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos-master._udp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos._tcp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos._udp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos.cs.ssds. 86400 IN TXT "CS.SSDS" _kpasswd._tcp.cs.ssds. 86400 IN SRV 0 100 464 ozservices.cs.ssds. _kpasswd._udp.cs.ssds. 86400 IN SRV 0 100 464 ozservices.cs.ssds. _ldap._tcp.cs.ssds. 86400 IN SRV 0 100 389 ozservices.cs.ssds. _ntp._udp.cs.ssds. 86400 IN SRV 0 100 123 ozservices.cs.ssds. ipa-ca.cs.ssds. 86400 IN A 172.16.58.191
This shows the records you *should* have available. Compare this to those that actually exist.
rob
Steve Reed via FreeIPA-users wrote:
[root@ozservices installer]# ipa dns-update-system-records --dry-run IPA DNS records: _kerberos-master._tcp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos-master._udp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos._tcp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos._udp.cs.ssds. 86400 IN SRV 0 100 88 ozservices.cs.ssds. _kerberos.cs.ssds. 86400 IN TXT "CS.SSDS" _kpasswd._tcp.cs.ssds. 86400 IN SRV 0 100 464 ozservices.cs.ssds. _kpasswd._udp.cs.ssds. 86400 IN SRV 0 100 464 ozservices.cs.ssds. _ldap._tcp.cs.ssds. 86400 IN SRV 0 100 389 ozservices.cs.ssds. _ntp._udp.cs.ssds. 86400 IN SRV 0 100 123 ozservices.cs.ssds. ipa-ca.cs.ssds. 86400 IN A 172.16.58.191
Also, I get the same response on clients that I cannot login with the FreeIPA (LDAP accounts) , but i can login to Kerberos with my fixed krb5.conf file.
So I still have the problem even with that command returning what I reported above. Kerberos is working fine, but I can't login as admin on the machine using an SSH session.
Thoughts?
Steve Reed via FreeIPA-users wrote:
Also, I get the same response on clients that I cannot login with the FreeIPA (LDAP accounts) , but i can login to Kerberos with my fixed krb5.conf file.
So I still have the problem even with that command returning what I reported above. Kerberos is working fine, but I can't login as admin on the machine using an SSH session.
Thoughts?
It's impossible to say without any details. What does login mean? It seems to mean ssh but it's unclear. What output do you get? What do any of the logs say? Did you apply the same "workaround" everywhere?
Also, I assume you're using webmail, but each response comes in without any sort of context so its difficult to keep track of the thread using a typical e-mail client.
rob
It's impossible to say without any details.
What details do you need?
What does login mean? It seems to mean ssh but it's unclear.
A ssh login. A local machine login. All of the above.
What output do you get?
Invalid password. But I know it's the correct password, and I try with the <user id>@<domain name> format and that doesn't work either. Also, if I use a local machine account, and try kinit with the same user id and password then it works fine.
What do any of the logs say?
I found something interesting in the secure log.
Failed password for invalid user admin@XYZ.COM from <not XYZ.COM FreeIPA Server address> port 50203 ssh2
The login is contacting the wrong server to authenticate with. Where is that established in the installation or configuration files?
Did you apply the same "workaround" everywhere?
The same kerberos work-around, yes, it works so that I can run kinit and it finds the Realm KDC.
Also, I assume you're using webmail, but each response comes in without
any sort of context so its difficult to keep track of the thread using a typical e-mail client.
No, I am using the website for replies.
What do any of the logs say?
I found something interesting in the secure log.
Failed password for invalid user admin(a)XYZ.COM from <not XYZ.COM FreeIPA Server
address> port 50203 ssh2
I was wrong. My network guys are telling me it's the ip address of the machine I am trying to login from.
So, I ran across an article on how to install the client manually on the Red Hat site.
https://access.redhat.com/articles/2622831
Thank you Red Hat technical writing team. Without it we would've had to dump FreeIPA on our project.
As far as I can tell, what was missing was the correct configuration of the sssd.conf, krb5.conf files. And the certutil command was not completed correctly.
freeipa-users@lists.fedorahosted.org