<html><head><style type="text/css"></style></head><body><div style="font-family:Courier New,courier,monaco,monospace,sans-serif;font-size:12pt"><div>I am somewhat confused here. Can someone explain the technical relationship between kerberos and ldap. I understand the relationship overview but not so much is going on behind the scenes. Why would I have no trouble using the 'admin' account, but then kpasswd is unable to bind to ldap when changing a regular user account? </div><div style="font-family: Courier New,courier,monaco,monospace,sans-serif; font-size: 12pt;"> <div style="font-family: arial,helvetica,sans-serif; font-size: 13px;"><hr size="1">From: Simo Sorce <ssorce@redhat.com> To: Dumbo Q <dumboq@yahoo.com> Cc: freeipa-users@redhat.com Sent: Wednesday, June 3, 2009 6:09:53 PM Subject: Re: [Freeipa-users] Trouble with new installation On Wed, 2009-06-03 at 13:42 -0700, Dumbo Q wrote: > I am trying to get a feel for redhat ipa, but i am not having much > luck. > > I am trying to set a password for a new user that i created earlier > today, but ipa-password just hangs. not sure what is going on.. or > where to look. > > Here is what i did, followed by the only messages that popped up in > log. I let it hang for 15 minutes.. > > [root@auth01 ~]# klist > Ticket cache: FILE:/tmp/krb5cc_0 > Default principal: <a ymailto="mailto:admin@MYDOM.COM" href="mailto:admin@MYDOM.COM">admin@MYDOM.COM</a> > > Valid starting Expires Service principal > 06/03/09 16:01:41 06/04/09 16:01:35 krbtgt/<a ymailto="mailto:MYDOM.COM@MYDOM.COM" href="mailto:MYDOM.COM@MYDOM.COM">MYDOM.COM@MYDOM.COM</a> > 06/03/09 16:01:58 06/04/09 16:01:35 HTTP/<a ymailto="mailto:auth01.mydom.com@MYDOM.COM" href="mailto:auth01.mydom.com@MYDOM.COM">auth01.mydom.com@MYDOM.COM</a> > > > Kerberos 4 ticket cache: /tmp/tkt0 > klist: You have no tickets cached > [root@auth01 ~]# ipa-passwd test > Changing password for <a ymailto="mailto:test@MYDOM.COM" href="mailto:test@MYDOM.COM">test@MYDOM.COM</a> > New Password: > Confirm Password: > > > Jun 03 16:30:47 <a target="_blank" href="http://auth01.mydom.com">auth01.mydom.com</a> krb5kdc[4001](info): TGS_REQ (1 > etypes {18}) 10.30.1.53: ISSUE: authtime 1244059301, etypes {rep=18 > tkt=18 ses=18}, <a ymailto="mailto:admin@MYDOM.COM" href="mailto:admin@MYDOM.COM">admin@MYDOM.COM</a> for krbtgt/<a ymailto="mailto:MYDOM.COM@MYDOM.COM" href="mailto:MYDOM.COM@MYDOM.COM">MYDOM.COM@MYDOM.COM</a> > Jun 03 16:30:47 auth01.mydom.com krb5kdc[4001](info): TGS_REQ (1 > etypes {18}) 10.30.1.53: ISSUE: authtime 1244059301, etypes {rep=18 > tkt=18 ses=18}, <a ymailto="mailto:admin@MYDOM.COM" href="mailto:admin@MYDOM.COM">admin@MYDOM.COM</a> for krbtgt/<a ymailto="mailto:MYDOM.COM@MYDOM.COM" href="mailto:MYDOM.COM@MYDOM.COM">MYDOM.COM@MYDOM.COM</a> Can you run any other admin command ? Looks like either a DNS resolution problem or a firewall dropping packets. Simo. -- Simo Sorce * Red Hat, Inc * New York </div></div></div> </body></html>