I am a newbie in IPA and was experimenting it on my couple of VMs before considering it for production level. Installation went fine, however, I am getting the kerberos key expiration error at firefox. I am running firefox on the same machine where I have installed/configured ipa-server. On googling and some help in IRC I checked documentation to trouble shoot it as this appear to be a known problem. Moreover, I did follow <a href="http://freeipa.org/page/InstallAndDeploy">http://freeipa.org/page/InstallAndDeploy</a> <a href="http://freeipa.org/page/TroubleshootingGuide">http://freeipa.org/page/TroubleshootingGuide</a> Fire fox logs 1977841888[7fc789f5b040]: leaving nsAuthGSSAPI::GetNextToken [rv=80004005] -1977841888[7fc789f5b040]: using REQ_DELEGATE -1977841888[7fc789f5b040]: service = <a href="http://ipaserver.example.com">ipaserver.example.com</a> -1977841888[7fc789f5b040]: using negotiate-gss -1977841888[7fc789f5b040]: entering nsAuthGSSAPI::nsAuthGSSAPI() -1977841888[7fc789f5b040]: entering nsAuthGSSAPI::Init() -1977841888[7fc789f5b040]: nsHttpNegotiateAuth::GenerateCredentials() [challenge=Negotiate] -1977841888[7fc789f5b040]: entering nsAuthGSSAPI::GetNextToken() -1977841888[7fc789f5b040]: gss_init_sec_context() failed: Unspecified GSS failure. Minor code may provide more information SPNEGO cannot find mechanisms to negotiate -1977841888[7fc789f5b040]: leaving nsAuthGSSAPI::GetNextToken [rv=80004005] [root@ds var]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: <a href="mailto:admin@EXAMPLE.COM">admin@EXAMPLE.COM</a> Valid starting Expires Service principal 05/14/12 13:50:32 05/15/12 13:50:30 krbtgt/<a href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a> 05/14/12 13:53:58 05/15/12 13:50:30 HTTP/<a href="mailto:ipaserver.example.com@EXAMPLE.COM">ipaserver.example.com@EXAMPLE.COM</a> 05/14/12 13:54:13 05/15/12 13:50:30 ldap/<a href="mailto:ipaserver.example.com@EXAMPLE.COM">ipaserver.example.com@EXAMPLE.COM</a> [root@ds var]# Output of ldapsearch -Y GSSAPI -b "dc=example,dc=com" uid=admin at <a href="http://fpaste.org/9hXX/">http://fpaste.org/9hXX/</a> I am not sure what I am missing though. Appreciate any help. Thanks Chandan