<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Can you explain what the curl command does?<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">And what about the version number 2.101? Is this the ipa version?<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><pre><code># curl -s --negotiate -u : <a href="https://f0.cockpit.lan/ipa/json" target="_blank">https://f0.cockpit.lan/ipa/json</a> \
        --header &#39;Referer: <a href="https://f0.cockpit.lan/ipa" target="_blank">https://f0.cockpit.lan/ipa</a>&#39; \
        --header &quot;Content-Type: application/json&quot; \
        --header &quot;Accept: application/json&quot; \
        --data &#39;{&quot;params&quot;: [[&quot;HTTP/my-server.cockpit.lan@COCKPIT.LAN&quot;], {&quot;raw&quot;: false, &quot;all&quot;: false, &quot;version&quot;: &quot;2.101&quot;, &quot;force&quot;: true, &quot;no_members&quot;: false}], &quot;method&quot;: &quot;service_add&quot;, &quot;id&quot;: 0}&#39;</code></pre><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Fuji<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 22, 2015 at 2:24 PM, Stef Walter <span dir="ltr">&lt;<a href="mailto:stefw@redhat.com" target="_blank">stefw@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 22.10.2015 12:11, Fujisan wrote:<br>
&gt; The step described here<br>
&gt; (<a href="http://cockpit-project.org/guide/latest/sso.html" rel="noreferrer" target="_blank">http://cockpit-project.org/guide/latest/sso.html</a>) are exactly the steps<br>
&gt; I do to configure FreeIPA to SSO with kerberos.<br>
&gt;<br>
&gt; If I create a kerberos ticket with &quot;kinit admin&quot;, when I go to<br>
&gt; <a href="http://ipasrv/ipa/ui" rel="noreferrer" target="_blank">http://ipasrv/ipa/ui</a> with firefox from my desktop (ipa client), I am<br>
&gt; logged in without username/password.<br>
&gt;<br>
&gt; But when I go to <a href="http://ipasrv:9090" rel="noreferrer" target="_blank">http://ipasrv:9090</a> with firefox (cockpit is installed<br>
&gt; on the ipa server), cockpit asks me for a username and password.<br>
&gt; And I log in as root.<br>
&gt;<br>
&gt; On the ipa server, I can run<br>
&gt;<br>
</span>&gt; $ getent passwd <a href="mailto:smith@example.com" target="_blank">smith@example.com</a> &lt;mailto:<a href="mailto:smith@example.com" target="_blank">smith@example.com</a>&gt;<br>
<span>&gt; smith:*:1002:1025:John Smith:/home/smith:/bin/bash<br>
&gt;<br>
</span>&gt; $ host -t SRV  _kerberos._<a href="http://udp.example.com" rel="noreferrer" target="_blank">udp.example.com</a> &lt;<a href="http://udp.example.com" rel="noreferrer" target="_blank">http://udp.example.com</a>&gt;<br>
&gt; _kerberos._<a href="http://udp.example.com" rel="noreferrer" target="_blank">udp.example.com</a> &lt;<a href="http://udp.example.com" rel="noreferrer" target="_blank">http://udp.example.com</a>&gt; has SRV record 0 100<br>
&gt; 88 <a href="http://zaira.example.com" rel="noreferrer" target="_blank">zaira.example.com</a> &lt;<a href="http://zaira.example.com" rel="noreferrer" target="_blank">http://zaira.example.com</a>&gt;.<br>
<span>&gt;<br>
&gt; On my desktop, firefox is configured|like this:<br>
&gt;<br>
&gt; network.negotiate-auth.trusted-uris    user set     string<br>
</span>&gt; .<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> &lt;<a href="http://example.com" rel="noreferrer" target="_blank">http://example.com</a>&gt;|<br>
<span>&gt;<br>
&gt; So I must be missing something.<br>
<br>
</span>There&#39;s some further info here:<br>
<br>
<a href="https://github.com/cockpit-project/cockpit/blob/master/HACKING.md#setting-up-single-sign-on" rel="noreferrer" target="_blank">https://github.com/cockpit-project/cockpit/blob/master/HACKING.md#setting-up-single-sign-on</a><br>
<br>
Does that help?<br>
<br>
Stef<br>
<br>
_______________________________________________<br>
cockpit-devel mailing list<br>
<a href="mailto:cockpit-devel@lists.fedorahosted.org" target="_blank">cockpit-devel@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/cockpit-devel" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/cockpit-devel</a><br>
</blockquote></div><br></div></div>