On 25/05/2023 11:58, lejeczek via FreeIPA-users wrote:

Hi guys.

This is my first trial/test of replicas in container - here I added a replica to already existing, bare-metal IPA domain, which otherwise works a okey - so numerous issues are possible. In container, only in this replica, I get:

bash-5.1# ipa dnszone-find ipa: ERROR: No valid Negotiate header in server response

What that is, might be, a symptom of? Where to go with troubleshooting?

All thoughts share are much appreciated. many thanks, L.

for experts, bit more debug:

-> $ ipa --debug dnszone-find ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: failed to find session_cookie in persistent storage for principal 'admin@MINE.PRIV' ipa: DEBUG: trying https://swir-ipa.mine.priv/ipa/json ipa: DEBUG: New HTTP connection (swir-ipa.mine.priv) ipa: DEBUG: HTTP connection destroyed (swir-ipa.mine.priv) Traceback (most recent call last):   File "/usr/lib/python3.9/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package     plugins = api._remote_plugins AttributeError: 'API' object has no attribute '_remote_plugins'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):   File "/usr/lib/python3.9/site-packages/ipalib/rpc.py", line 724, in single_request     if not self._auth_complete(response):   File "/usr/lib/python3.9/site-packages/ipalib/rpc.py", line 673, in _auth_complete     raise errors.KerberosError( ipalib.errors.KerberosError: No valid Negotiate header in server response ipa: ERROR: No valid Negotiate header in server response

-> $ klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@MINE.PRIV

Valid starting     Expires            Service principal 05/25/23 09:46:11  05/26/23 09:40:03 krbtgt/MINE.PRIV@MINE.PRIV 05/25/23 09:47:45  05/26/23 09:40:03 HTTP/swir-ipa.mine.priv@MINE.PRIV