<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hi Rob,</span></div><div><span>I was just thinking it's very unlikely the university would block http connections from inside, but not ssh from outside. but </span><span>I'll contact our ITS anyways.</span></div><div><span>BTW, I am new to this LDAP and Kerberos thing, and I just followed the steps outlined here </span>https://docs.fedoraproject.org/en-US/Fedora/16/html/FreeIPA_Guide/Installing_the_IPA_Client_on_Linux.html</div><div>There may be some steps that are obvious to people know these things and they are not listed in the document, then I could have missed them.</div><div>Thanks,</div><div>George</div><div><br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman,new york,times,serif;
font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Petr Viktorin <pviktori@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, June 18, 2012 1:28 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] is not an IPA v2 Server.<br> </font> </div> <br>
george he wrote:<br>> Hello Rob,<br>><br>> Yes, I did the configuration earlier today. And I did kinit too.<br>> It seems the web UI loads really slowly - the circular thing can turn<br>> for minutes. So maybe I wasn't patient enough to let the page load.<br><br>A fair bit of javascript is loaded the very first time you visit IPA, <br>that can be slow. Otherwise it should be relatively quick. Not minutes <br>anyway.<br><br>> I can ssh to the server and the client from my home, so I don't think<br>> there's another firewall blocking the connection.<br><br>Different ports and that isn't the client talking to the server, it is <br>you talking to the client and to the server. This is definitely some <br>sort of networking problem, though "no route to host" is rather odd <br>since you can ping. You might also look at the iptables configuration on <br>the client.<br><br>rob<br><br>> Thanks,<br>> George<br>><br>>
------------------------------------------------------------------------<br>> *From:* Rob Crittenden <<a ymailto="mailto:rcritten@redhat.com" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>><br>> *To:* george he <<a ymailto="mailto:george_he7@yahoo.com" href="mailto:george_he7@yahoo.com">george_he7@yahoo.com</a>><br>> *Cc:* Petr Viktorin <<a ymailto="mailto:pviktori@redhat.com" href="mailto:pviktori@redhat.com">pviktori@redhat.com</a>>;<br>> "<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>" <<a ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br>> *Sent:* Monday, June 18, 2012 11:51 AM<br>> *Subject:* Re: [Freeipa-users] is not an IPA v2 Server.<br>><br>> george he
wrote:<br>> > Hello all,<br>> ><br>> > Here is some other information.<br>> > I'm setting this up for a lab in a university. The university has its<br>> > own kerberos server (and DNS server, which I use).<br>> > I'm not sure whether anybody has set a kerberos server for the<br>> > department, or some other labs used the department sub-domain.<br>> > But I'm sure the realm name is unique.<br>> ><br>> > When I open the web UI on the server (firefox 13.0), I almost<br>> always get<br>> > this error:<br>> > Your Kerberos ticket is no longer valid. Please run kinit and<br>> then click<br>> >
'Retry'. If this is your first time running the IPA Web UI follow<br>> these<br>> > directions<br>> <<a href="https://cns2.psych.yale.edu/ipa/config/unauthorized.html" target="_blank">https://cns2.psych.yale.edu/ipa/config/unauthorized.html</a>> to<br>> > configure your browser.<br>> > Or you can use form-based authentication<br>> > <<a href="https://cns2.psych.yale.edu/ipa/ui/#" target="_blank">https://cns2.psych.yale.edu/ipa/ui/#</a>>.<br>> > but I can use the form based authentication sometimes, not always.<br>><br>> You need to configure the browser to do Kerberos single sign-on.<br>> There should be a link in the failure message to take you to a page<br>> to help you configure this. You also need to have done a
kinit.<br>><br>> I'm not sure why forms-based auth work work only sometimes,<br>> additional details would be needed.<br>><br>> I'm not sure why the server would be pingable from your client but<br>> HTTP doesn't work. There may be another firewall blocking the<br>> packets on your network.<br>><br>> rob<br>><br>><br><br><br><br> </div> </div> </blockquote></div> </div></body></html>