<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">The step described here (<a href="http://cockpit-project.org/guide/latest/sso.html" target="_blank">http://cockpit-project.org/guide/latest/sso.html</a>) are exactly the steps I do to configure FreeIPA to SSO with kerberos.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">If I create a kerberos ticket with &quot;kinit admin&quot;, when I go to <a href="http://ipasrv/ipa/ui" target="_blank">http://ipasrv/ipa/ui</a> with firefox from my desktop (ipa client), I am logged in without username/password.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">But when I go to <a href="http://ipasrv:9090" target="_blank">http://ipasrv:9090</a> with firefox (cockpit is installed on the ipa server), cockpit asks me for a username and password.<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">And I log in as root.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">On the ipa server, I can run <br><br><span style="font-family:monospace,monospace">$ getent passwd <a href="mailto:smith@example.com" target="_blank">smith@example.com</a><br>smith:*:1002:1025:John Smith:/home/smith:/bin/bash<br><br>$ host -t SRV  _kerberos._<a href="http://udp.example.com" target="_blank">udp.example.com</a><br>_kerberos._<a href="http://udp.example.com" target="_blank">udp.example.com</a> has SRV record 0 100 88 <a href="http://zaira.example.com" target="_blank">zaira.example.com</a>.</span><br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">On my desktop, firefox is configured<code><span style="font-family:arial,helvetica,sans-serif"> like this</span>:<br><br><span style="font-family:monospace,monospace">network.negotiate-auth.trusted-uris    user set     string     .<a href="http://example.com" target="_blank">example.com</a></span></code><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">So I must be missing something.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Regards,</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Fuji<br clear="all"></div>
</div>