Thanks for reply Rob!
/var/log/krb5kdc.log might have more details on the GSS failures, or
the
journal.
Yeah, I've checked that as well. Unfortunately 'Preauthentication failed' Was
no more explanatory to me.
After two weeks of searching for answers, I gave up and decided to reinstall ipa server.
I guess, one has to have much deeper knowledge to use it properly and I am just a mortal
user :)
/var/log/krb5kdc.log
38:21 (info): TGS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17),
aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19),
DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: ISSUE: authtime 1568572691, etypes
{rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18),
ses=aes256-cts-hmac-sha1-96(18)}, admin(a)HOME.MYDOMAIN.COM for
HTTP/ipa.home.mydomain.com(a)HOME.MYDOMAIN.COM
38:21 (info): closing down fd 11
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17),
aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19),
DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: NEEDED_PREAUTH:
HTTP/ipa.home.mydomain.com(a)HOME.MYDOMAIN.COM for
krbtgt/HOME.MYDOMAIN.COM(a)HOME.MYDOMAIN.COM, Additional pre-authentication required
38:21 (info): closing down fd 11
38:21 (info): preauth (spake) verify failure: Preauthentication failed
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17),
aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19),
DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: PREAUTH_FAILED:
HTTP/ipa.home.mydomain.com(a)HOME.MYDOMAIN.COM for
krbtgt/HOME.MYDOMAIN.COM(a)HOME.MYDOMAIN.COM, Preauthentication failed
38:21 (info): closing down fd 11
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17),
aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19),
DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: NEEDED_PREAUTH:
HTTP/ipa.home.mydomain.com(a)HOME.MYDOMAIN.COM for
krbtgt/HOME.MYDOMAIN.COM(a)HOME.MYDOMAIN.COM, Additional pre-authentication required
38:21 (info): closing down fd 11
38:21 (info): preauth (spake) verify failure: Preauthentication failed
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17),
aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19),
DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: PREAUTH_FAILED:
HTTP/ipa.home.mydomain.com(a)HOME.MYDOMAIN.COM for
krbtgt/HOME.MYDOMAIN.COM(a)HOME.MYDOMAIN.COM, Preauthentication failed
38:21 (info): closing down fd 11
Cheers!