Hey,
I've encountered a replication issue, due to replica not being able to construct gss context.
The result is, that I cannot bind to the replica (let's call it replica1) using gssapi and other replicas cannot establish replication.
The directory logs are full of the following:
``` [02/Oct/2024:13:28:46.834250430 +0200] - DEBUG - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToreplica2.example.com" (replica2:389) - Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (No Kerberos credentials available (default cache: KCM:))) ```
I've already checked, if the time is in sync and it should be:
``` [root@replica1 ~]# clockdiff -o replica2.example.com .................................................. host=replica2.example.com rtt=8(0)ms/8ms delta=2ms/2ms Wed Oct 2 14:09:14 2024 ```
I've already checked that keys in keytab have the same kvno:
``` [root@replica2 ~]# kvno host/replica1.example.com host/replica1.example.com@EXAMPLE.COM: kvno = 2 ----- [root@replica1 ~]# kvno host/replica1.example.com host/replica1.example.com@EXAMPLE.COM: kvno = 2 ----- [root@replica1 ~]# klist -k -t /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 09/02/2024 12:11:19 ldap/replica1.example.com@EXAMPLE.COM 2 09/02/2024 12:11:19 ldap/replica1.example.com@EXAMPLE.COM 2 09/02/2024 12:11:19 ldap/replica1.example.com@EXAMPLE.COM 2 09/02/2024 12:11:19 ldap/replica1.example.com@EXAMPLE.COM 2 09/02/2024 12:11:19 ldap/replica1.example.com@EXAMPLE.COM 2 09/02/2024 12:11:19 ldap/replica1.example.com@EXAMPLE.COM ```
I have not yet tried to get a new keytab with ipa-getkeytab, because I am not sure, how the keytabs are then distributed between peers.
``` VERSION="9.4 (Plow)" VERSION: 4.11.0, API_VERSION: 2.253 (IPA) ```
I am sorry, if I did not provide all relevant logs or if it has an obvious solution.
Does anyone has any suggestions?
Thanks in advance! Kind regards Jan
On 02/10/2024 14:11, Jan Wagner via FreeIPA-users wrote:
Hey,
I've encountered a replication issue, due to replica not being able to construct gss context.
The result is, that I cannot bind to the replica (let's call it replica1) using gssapi and other replicas cannot establish replication.
The directory logs are full of the following:
[02/Oct/2024:13:28:46.834250430 +0200] - DEBUG - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToreplica2.example.com" (replica2:389) - Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (No Kerberos credentials available (default cache: KCM:)))
I'd double check the owner/mode/context of /etc/dirsrv and /etc/dirsrv/ds.keytab, & check if SELinux policy is preventing dirsrv from reading by running 'ausearch -i -m avc'.
Thanks for the quick reply!
There does not seem to be an issue, ownership and mode are the same as on the other replicas: ``` [root@replica1 ~]# stat /etc/dirsrv File: /etc/dirsrv Size: 77 Blocks: 0 IO Block: 4096 directory Device: fd00h/64768d Inode: 52432775 Links: 5 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2024-10-02 13:03:35.388075585 +0200 Modify: 2024-09-02 12:11:19.419856764 +0200 Change: 2024-09-02 12:11:19.419856764 +0200 Birth: 2024-06-20 15:15:23.756876768 +0200 [root@replica1 ~]# stat /etc/dirsrv/* File: /etc/dirsrv/config Size: 55 Blocks: 0 IO Block: 4096 directory Device: fd00h/64768d Inode: 710281 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2024-10-01 11:23:24.083650236 +0200 Modify: 2024-07-17 13:10:16.000000000 +0200 Change: 2024-08-12 09:58:18.913090871 +0200 Birth: 2024-06-20 15:15:23.756876768 +0200 File: /etc/dirsrv/ds.keytab Size: 530 Blocks: 8 IO Block: 4096 regular file Device: fd00h/64768d Inode: 52429257 Links: 1 Access: (0600/-rw-------) Uid: ( 389/ dirsrv) Gid: ( 389/ dirsrv) Access: 2024-10-02 12:25:42.580276460 +0200 Modify: 2024-09-02 12:11:19.443856859 +0200 Change: 2024-09-02 12:11:19.448856879 +0200 Birth: 2024-09-02 12:11:19.419856764 +0200 File: /etc/dirsrv/schema Size: 25 Blocks: 0 IO Block: 4096 directory Device: fd00h/64768d Inode: 17981107 Links: 2 Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2024-09-02 11:38:24.159400689 +0200 Modify: 2024-07-17 13:10:16.000000000 +0200 Change: 2024-08-12 09:58:18.913090871 +0200 Birth: 2024-06-20 15:15:23.757876772 +0200 File: /etc/dirsrv/slapd-EXAMPLE.COM Size: 4096 Blocks: 8 IO Block: 4096 directory Device: fd00h/64768d Inode: 17359662 Links: 3 Access: (0750/drwxr-x---) Uid: ( 389/ dirsrv) Gid: ( 389/ dirsrv) Access: 2024-10-02 13:27:12.437529230 +0200 Modify: 2024-10-02 16:27:45.458325614 +0200 Change: 2024-10-02 16:27:45.458325614 +0200 Birth: 2024-09-02 12:10:55.942929247 +0200 ```
And SELinux is disabled. The dirsrv user can read the /etc/dirsrv/ds.keytab no problem
The keytab is also valid, i just checked:
[root@replica1 ~]# kvno -k /etc/dirsrv/ds.keytab ldap/replica1.example.com@EXAMPLE.COM ldap/replica1.example.com@EXAMPLE.COM: kvno = 2, keytab entry valid
However the dirsrv user does not seem to have credentials cache, but that the case on others replicas too (on the ones, that do not have any issues): [root@replica1 ~]# sudo -u dirsrv kvno -k /etc/dirsrv/ds.keytab ldap/replica1.example.com@EXAMPLE.COM kvno: Credentials cache 'KCM:389' not found while getting client principal name
But I suppose, that the directory process just looks up the keys in LDAP anyway. However, if that is the case, why does it have issues retrieving it?
Jan Wagner via FreeIPA-users wrote:
The keytab is also valid, i just checked:
[root@replica1 ~]# kvno -k /etc/dirsrv/ds.keytab ldap/replica1.example.com@EXAMPLE.COM ldap/replica1.example.com@EXAMPLE.COM: kvno = 2, keytab entry valid
However the dirsrv user does not seem to have credentials cache, but that the case on others replicas too (on the ones, that do not have any issues): [root@replica1 ~]# sudo -u dirsrv kvno -k /etc/dirsrv/ds.keytab ldap/replica1.example.com@EXAMPLE.COM kvno: Credentials cache 'KCM:389' not found while getting client principal name
But I suppose, that the directory process just looks up the keys in LDAP anyway. However, if that is the case, why does it have issues retrieving it?
That just circles back to the original problem: DS can't get credentials.
I'd suggest restarting the process and looking in /var/log/krb5kdc.log for the TGT request. Along with monitoring the 389-ds error log.
rob
Thanks for the help!
The directory error logs: [02/Oct/2024:17:59:28.602977123 +0200] - INFO - main - 389-Directory/2.4.5 B2024.198.0000 starting up [02/Oct/2024:17:59:28.603834818 +0200] - INFO - main - Setting the maximum file descriptor limit to: 524288 [02/Oct/2024:17:59:28.757212599 +0200] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds [02/Oct/2024:17:59:28.761796062 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [02/Oct/2024:17:59:28.762981918 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr aci [02/Oct/2024:17:59:28.763954843 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-cachesize [02/Oct/2024:17:59:28.764851548 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-cachememsize [02/Oct/2024:17:59:28.765864853 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-readonly [02/Oct/2024:17:59:28.766752857 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-require-index [02/Oct/2024:17:59:28.770365686 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-require-internalop-index [02/Oct/2024:17:59:28.773684553 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-dncachememsize [02/Oct/2024:17:59:28.774578897 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-directory [02/Oct/2024:17:59:28.778920839 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [02/Oct/2024:17:59:28.780307477 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-cachesize [02/Oct/2024:17:59:28.782120565 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-cachememsize [02/Oct/2024:17:59:28.783162621 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-readonly [02/Oct/2024:17:59:28.786186367 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-require-index [02/Oct/2024:17:59:28.789426313 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-require-internalop-index [02/Oct/2024:17:59:28.792723820 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-dncachememsize [02/Oct/2024:17:59:28.793957866 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-directory [02/Oct/2024:17:59:28.799717345 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [02/Oct/2024:17:59:28.800883081 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-cachesize [02/Oct/2024:17:59:28.803704736 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-cachememsize [02/Oct/2024:17:59:28.804882871 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-readonly [02/Oct/2024:17:59:28.807895887 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-require-index [02/Oct/2024:17:59:28.811511036 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-require-internalop-index [02/Oct/2024:17:59:28.812205119 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-dncachememsize [02/Oct/2024:17:59:28.813153363 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-directory [02/Oct/2024:17:59:28.816725502 +0200] - NOTICE - bdb_start_autotune - found 7869560k physical memory [02/Oct/2024:17:59:28.817460326 +0200] - NOTICE - bdb_start_autotune - found 5419584k available [02/Oct/2024:17:59:28.818194490 +0200] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 491847k [02/Oct/2024:17:59:28.818860603 +0200] - NOTICE - bdb_start_autotune - cache autosizing: userRoot entry cache (3 total): 458752k [02/Oct/2024:17:59:28.819647667 +0200] - NOTICE - bdb_start_autotune - cache autosizing: userRoot dn cache (3 total): 65536k [02/Oct/2024:17:59:28.820454041 +0200] - NOTICE - bdb_start_autotune - cache autosizing: ipaca entry cache (3 total): 458752k [02/Oct/2024:17:59:28.821500706 +0200] - NOTICE - bdb_start_autotune - cache autosizing: ipaca dn cache (3 total): 65536k [02/Oct/2024:17:59:28.822282141 +0200] - NOTICE - bdb_start_autotune - cache autosizing: changelog entry cache (3 total): 458752k [02/Oct/2024:17:59:28.823039384 +0200] - NOTICE - bdb_start_autotune - cache autosizing: changelog dn cache (3 total): 65536k [02/Oct/2024:17:59:28.823877758 +0200] - NOTICE - bdb_start_autotune - total cache size: 2013534208 B; [02/Oct/2024:17:59:28.833275377 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [02/Oct/2024:17:59:28.834028980 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.839174626 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [02/Oct/2024:17:59:28.839989300 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.840775824 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [02/Oct/2024:17:59:28.849378938 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [02/Oct/2024:17:59:28.850120481 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.855340159 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [02/Oct/2024:17:59:28.856086832 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.856875866 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [02/Oct/2024:17:59:28.865336600 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [02/Oct/2024:17:59:28.865856502 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.871143999 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [02/Oct/2024:17:59:28.871935833 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.872698347 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [02/Oct/2024:17:59:28.876139944 +0200] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [02/Oct/2024:17:59:28.882424687 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.883226651 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.884134405 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=keys,cn=sec,cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.884854119 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.885587583 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.886353897 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.887069180 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.887933154 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.888835939 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.889665023 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.890518288 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.891389432 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.892263517 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.893110060 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.893960015 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.894869610 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.896913830 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.897840905 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.898707439 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.899594584 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.900412688 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.906548959 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.907416734 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.968084072 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [02/Oct/2024:17:59:28.971970842 +0200] - INFO - slapi_vattrspi_regattr - Because krbPwdPolicyReference is a new registered virtual attribute , nsslapd-ignore-virtual-attrs was set to 'off' [02/Oct/2024:17:59:28.973265389 +0200] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=example,dc=com--no CoS Templates found, which should be added before the CoS Definition. [02/Oct/2024:17:59:29.001093670 +0200] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [02/Oct/2024:17:59:29.004581568 +0200] - INFO - validate_num_config_reservedescriptors - reserve descriptors changed from 64 to 239 [02/Oct/2024:17:59:29.005342833 +0200] - INFO - connection_table_new - Number of connection sub-tables 1, each containing 63761 slots. [02/Oct/2024:17:59:29.039105944 +0200] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [02/Oct/2024:17:59:29.039831128 +0200] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [02/Oct/2024:17:59:29.040547442 +0200] - INFO - slapd_daemon - Listening on /run/slapd-EXAMPLE-COM.socket for LDAPI requests [02/Oct/2024:17:59:34.064575010 +0200] - ERR - schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=example,dc=com [02/Oct/2024:17:59:34.065597825 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=example,dc=com [02/Oct/2024:17:59:34.421255856 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com [02/Oct/2024:17:59:34.422227820 +0200] - ERR - schema-compat-plugin - Finished plugin initialization.
The directory security logs are full of "Bad Ber Tag".
In the directory access log, there are some succesfull searches (regarding kerberos ticket, I assume from localhost) and some GSSAPI errors: [02/Oct/2024:18:59:19.893133208 +0200] conn=511 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [02/Oct/2024:18:59:19.894177503 +0200] conn=511 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.000032210 optime=0.001046625 etime=0.001077535 - SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Permission denied) [02/Oct/2024:18:59:19.988382631 +0200] conn=511 op=2 UNBIND
It seems to request tickets very often (multiple times per minute): Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: NEEDED_PREAUTH: host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Additional pre-authentication required Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM Oct 02 18:09:15 replica1.example.com krb5kdc[3234562](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for ldap/replica1.example.com@EXAMPLE.COM Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: NEEDED_PREAUTH: host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Additional pre-authentication required Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for ldap/replica1.example.com@EXAMPLE.COM
I believe this should not be the case, the ticket should be requested once and used as long as it is valid, no?
On Срд, 02 кас 2024, Jan Wagner via FreeIPA-users wrote:
Thanks for the help!
The directory error logs: [02/Oct/2024:17:59:28.602977123 +0200] - INFO - main - 389-Directory/2.4.5 B2024.198.0000 starting up [02/Oct/2024:17:59:28.603834818 +0200] - INFO - main - Setting the maximum file descriptor limit to: 524288 [02/Oct/2024:17:59:28.757212599 +0200] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds [02/Oct/2024:17:59:28.761796062 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [02/Oct/2024:17:59:28.762981918 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr aci [02/Oct/2024:17:59:28.763954843 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-cachesize [02/Oct/2024:17:59:28.764851548 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-cachememsize [02/Oct/2024:17:59:28.765864853 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-readonly [02/Oct/2024:17:59:28.766752857 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-require-index [02/Oct/2024:17:59:28.770365686 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-require-internalop-index [02/Oct/2024:17:59:28.773684553 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-dncachememsize [02/Oct/2024:17:59:28.774578897 +0200] - INFO - ldbm_instance_config_set - instance: userRoot attr nsslapd-directory [02/Oct/2024:17:59:28.778920839 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [02/Oct/2024:17:59:28.780307477 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-cachesize [02/Oct/2024:17:59:28.782120565 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-cachememsize [02/Oct/2024:17:59:28.783162621 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-readonly [02/Oct/2024:17:59:28.786186367 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-require-index [02/Oct/2024:17:59:28.789426313 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-require-internalop-index [02/Oct/2024:17:59:28.792723820 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-dncachememsize [02/Oct/2024:17:59:28.793957866 +0200] - INFO - ldbm_instance_config_set - instance: ipaca attr nsslapd-directory [02/Oct/2024:17:59:28.799717345 +0200] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [02/Oct/2024:17:59:28.800883081 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-cachesize [02/Oct/2024:17:59:28.803704736 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-cachememsize [02/Oct/2024:17:59:28.804882871 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-readonly [02/Oct/2024:17:59:28.807895887 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-require-index [02/Oct/2024:17:59:28.811511036 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-require-internalop-index [02/Oct/2024:17:59:28.812205119 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-dncachememsize [02/Oct/2024:17:59:28.813153363 +0200] - INFO - ldbm_instance_config_set - instance: changelog attr nsslapd-directory [02/Oct/2024:17:59:28.816725502 +0200] - NOTICE - bdb_start_autotune - found 7869560k physical memory [02/Oct/2024:17:59:28.817460326 +0200] - NOTICE - bdb_start_autotune - found 5419584k available [02/Oct/2024:17:59:28.818194490 +0200] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 491847k [02/Oct/2024:17:59:28.818860603 +0200] - NOTICE - bdb_start_autotune - cache autosizing: userRoot entry cache (3 total): 458752k [02/Oct/2024:17:59:28.819647667 +0200] - NOTICE - bdb_start_autotune - cache autosizing: userRoot dn cache (3 total): 65536k [02/Oct/2024:17:59:28.820454041 +0200] - NOTICE - bdb_start_autotune - cache autosizing: ipaca entry cache (3 total): 458752k [02/Oct/2024:17:59:28.821500706 +0200] - NOTICE - bdb_start_autotune - cache autosizing: ipaca dn cache (3 total): 65536k [02/Oct/2024:17:59:28.822282141 +0200] - NOTICE - bdb_start_autotune - cache autosizing: changelog entry cache (3 total): 458752k [02/Oct/2024:17:59:28.823039384 +0200] - NOTICE - bdb_start_autotune - cache autosizing: changelog dn cache (3 total): 65536k [02/Oct/2024:17:59:28.823877758 +0200] - NOTICE - bdb_start_autotune - total cache size: 2013534208 B; [02/Oct/2024:17:59:28.833275377 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [02/Oct/2024:17:59:28.834028980 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.839174626 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [02/Oct/2024:17:59:28.839989300 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.840775824 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [02/Oct/2024:17:59:28.849378938 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [02/Oct/2024:17:59:28.850120481 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.855340159 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [02/Oct/2024:17:59:28.856086832 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.856875866 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [02/Oct/2024:17:59:28.865336600 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [02/Oct/2024:17:59:28.865856502 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.871143999 +0200] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [02/Oct/2024:17:59:28.871935833 +0200] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [02/Oct/2024:17:59:28.872698347 +0200] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [02/Oct/2024:17:59:28.876139944 +0200] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [02/Oct/2024:17:59:28.882424687 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.883226651 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.884134405 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=keys,cn=sec,cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.884854119 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.885587583 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=dns,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.886353897 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.887069180 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.887933154 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.888835939 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.889665023 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.890518288 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.891389432 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.892263517 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.893110060 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.893960015 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.894869610 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.896913830 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.897840905 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.898707439 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.899594584 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.900412688 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.906548959 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.907416734 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=example,dc=com does not exist [02/Oct/2024:17:59:28.968084072 +0200] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [02/Oct/2024:17:59:28.971970842 +0200] - INFO - slapi_vattrspi_regattr - Because krbPwdPolicyReference is a new registered virtual attribute , nsslapd-ignore-virtual-attrs was set to 'off' [02/Oct/2024:17:59:28.973265389 +0200] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=example,dc=com--no CoS Templates found, which should be added before the CoS Definition. [02/Oct/2024:17:59:29.001093670 +0200] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [02/Oct/2024:17:59:29.004581568 +0200] - INFO - validate_num_config_reservedescriptors - reserve descriptors changed from 64 to 239 [02/Oct/2024:17:59:29.005342833 +0200] - INFO - connection_table_new - Number of connection sub-tables 1, each containing 63761 slots. [02/Oct/2024:17:59:29.039105944 +0200] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [02/Oct/2024:17:59:29.039831128 +0200] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [02/Oct/2024:17:59:29.040547442 +0200] - INFO - slapd_daemon - Listening on /run/slapd-EXAMPLE-COM.socket for LDAPI requests [02/Oct/2024:17:59:34.064575010 +0200] - ERR - schema-compat-plugin - warning: no entries set up under ou=sudoers,dc=example,dc=com [02/Oct/2024:17:59:34.065597825 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=example,dc=com [02/Oct/2024:17:59:34.421255856 +0200] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=example,dc=com [02/Oct/2024:17:59:34.422227820 +0200] - ERR - schema-compat-plugin - Finished plugin initialization.
The directory security logs are full of "Bad Ber Tag".
In the directory access log, there are some succesfull searches (regarding kerberos ticket, I assume from localhost) and some GSSAPI errors: [02/Oct/2024:18:59:19.893133208 +0200] conn=511 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [02/Oct/2024:18:59:19.894177503 +0200] conn=511 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.000032210 optime=0.001046625 etime=0.001077535 - SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Permission denied) [02/Oct/2024:18:59:19.988382631 +0200] conn=511 op=2 UNBIND
It seems to request tickets very often (multiple times per minute): Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: NEEDED_PREAUTH: host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Additional pre-authentication required Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM Oct 02 18:09:15 replica1.example.com krb5kdc[3234562](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for ldap/replica1.example.com@EXAMPLE.COM Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: NEEDED_PREAUTH: host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM, Additional pre-authentication required Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for krbtgt/EXAMPLE.COM@EXAMPLE.COM Oct 02 18:09:15 replica1.example.com krb5kdc[3234564](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) 1.2.3.4: ISSUE: authtime 1727885355, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha384-192(20)}, host/replica1.example.com@EXAMPLE.COM for ldap/replica1.example.com@EXAMPLE.COM
I believe this should not be the case, the ticket should be requested once and used as long as it is valid, no?
These host/... -> ldap/... are requests from SSSD on the replica1. They are not related to ldap/.. service own operations. But the fact you see multitude of these requests here is a side-effect of LDAP server not completing the authentication with the client (in this case LDAP client is that SSSD on the replica1).
LDAP server does not need to request a Kerberos ticket to authenticate incoming connections. It needs access to its own keytab. It will only request a ticket when it becomes a client itself -- that happens when it initiates replication to other IPA replica.
The 'permission denied' part is definitely telling us that LDAP server cannot access its own keytab.
Hey, thanks for all the help so far!
I've investigated a bit further and it seems to me, that maybe there is a mismatch in credentials/secrets used for sasl between the replicas? But maybe, that is a different issue from the replication not being able to be established (or the same issue but with different symptoms). However, I've looked up the krbPrincipalKey for ldap/replica1.example.com@EXAMPLE.COM on both replica1 and replica2 and they do not seem to differ. But again, I am not sure, if that is relevant.
[root@replica1 ~]# KRB5_TRACE=/dev/stderr ldapsearch -Y GSSAPI -h replica1.example.com -b 'cn=users,cn=accounts,dc=example,dc=com' '(objectClass=ipaNTUserAttrs)' ipaNTHash SASL/GSSAPI authentication started [3200] 1728215799.000066: ccselect module realm chose cache KCM:0 with client principal admin@IPA.CDN77.EU for server principal ldap/replica1.example.com@EXAMPLE.COM [3200] 1728215799.000067: Getting credentials admin@EXAMPLE.COM -> ldap/replica1.example.com@EXAMPLE.COM using ccache KCM:0 [3200] 1728215799.000068: Retrieving admin@EXAMPLE.COM -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:0 with result: -1765328243/Matching credential not found [3200] 1728215799.000069: Retrieving admin@EXAMPLE.COM -> ldap/replica1.example.com@EXAMPLE.COM from KCM:0 with result: 0/Success [3200] 1728215799.000070: Creating authenticator for admin@EXAMPLE.COM -> ldap/replica1.example.com@EXAMPLE.COM, seqnum 230523842, subkey aes256-sha2/1619, session key aes256-sha2/E915 ldap_sasl_interactive_bind: Invalid credentials (49)
From this, it seems that the root can access the keytab just fine, but is still failing to establish a connection.
There is also error in ipa healthcheck, which I think also point to some credentials mismatch: - exception: 'Insufficient access: Invalid credentials' traceback: > Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1096, in error_handler yield File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1267, in gssapi_bind self.conn.sasl_interactive_bind_s( File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 270, in sasl_interactive_bind_s return self._ldap_call(self._l.sasl_interactive_bind_s,who,auth,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls),sasl_flags) File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call result = func(*args,**kwargs) ldap.INVALID_CREDENTIALS: {'result': 49, 'desc': 'Invalid credentials', 'ctrls': []}
During handling of the above exception, another exception occurred:
Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/ipahealthcheck/core/core.py", line 56, in run_plugin for result in plugin.check(): File "/usr/lib/python3.9/site-packages/ipahealthcheck/core/plugin.py", line 18, in wrapper for result in f(*args, **kwds): File "/usr/lib/python3.9/site-packages/ipahealthcheck/ipa/dna.py", line 32, in check agmt = replication.ReplicationManager(api.env.realm, api.env.host) File "/usr/lib/python3.9/site-packages/ipaserver/install/replication.py", line 268, in __init__ self.conn.gssapi_bind() File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1267, in gssapi_bind self.conn.sasl_interactive_bind_s( File "/usr/lib64/python3.9/contextlib.py", line 137, in __exit__ self.gen.throw(typ, value, traceback) File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1124, in error_handler raise errors.ACIError(info="%s %s" % (info, desc)) ipalib.errors.ACIError: Insufficient access: Invalid credentials
Also, due to some circumstances, I was not yet able to provide long term reverse DNS entry for the replicas. I am not sure, if this was not a cause for some internal mechanism (like kerberos) assigning different hostname somewhere.
freeipa-users@lists.fedorahosted.org