<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body bgcolor="#FFFFFF" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">I pursued that idea myself earlier but when getting the huge warranty void message when accessing a shell + that the file system was read-only i gave up.
<div>I will definitely look at it again and read the information you provided, thank you for your help. <br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF998757" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> freeipa-users-bounces@redhat.com [freeipa-users-bounces@redhat.com] on behalf of Sigbjorn Lie [sigbjorn@nixtra.com]<br>
<b>Sent:</b> Tuesday, December 18, 2012 21:48<br>
<b>To:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> Re: [Freeipa-users] Problem generating Oracle ZFS Storage Appliance host and nfs principals and keys to IPA/Free IPA.<br>
</font><br>
</div>
<div></div>
<div>
<div class="moz-cite-prefix">On 12/18/2012 06:24 AM, Johan Petersson wrote:<br>
</div>
<blockquote type="cite">
<pre>Hi,
Unfortunately i still get the same error from the Appliance even after having added both host and nfs principals in the IPA web interface.
"failed to create principal 'host/zfs1.home@HOME': libkadm5clnt error:
43787522 (Operation requires ``add'' privilege)"
I get the impression that the Appliance does not recognize existing principals since i still get the same create principal error.
So it seems that it does not cope with pre existing principals, at least not from IPA Server.
I will contact Oracle about this issue and see what they say.
Thank you for your help,
Johan.</pre>
</blockquote>
<br>
We have these ZFS Storage Appliances at work too. There is a way to access the root shell of the ZFS Storage Appliance. It's been a long time since I've done it, but a quick googelig turned up this:<br>
<br>
<a class="moz-txt-link-freetext" href="http://weblogs.java.net/blog/kohsuke/archive/2009/01/under_the_hood.html" target="_blank">http://weblogs.java.net/blog/kohsuke/archive/2009/01/under_the_hood.html</a><br>
<br>
Hopefully the "scp" commands still exists when you get access to the shell of the Solaris OS, so you can copy the pre-created keytab into /etc/krb5/krb5.keytab.<br>
<br>
CAUTION! The /etc/krb5/krb5.keytab is by default shared between the CIFS server and the NFS server. This file will already contain the keytab for the CIFS/SMB service if you have already joined the ZFS Storage Appliance to AD. In which case copy the pre-created
keytab from IPA into /etc/krb5/krb5.keytab-IPA, and use ktutil to merge the two files together.
<br>
<br>
I see I've kept the keytab from my AD in the beginning of the file and added the keytab from IPA to the end of the file. I do recall there being some significance to doing it this way.<br>
<br>
I've written this howto for NexentaStor a while back. Perhaps this will be of some assistance to complete the configuration of the ZFS Storage Appliance too?
<br>
<br>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/archives/freeipa-users/2011-July/msg00033.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2011-July/msg00033.html</a><br>
<br>
Please let me know how you get on.<br>
<br>
<br>
<br>
Regards,<br>
Siggi<br>
<br>
</div>
</div>
</div>
</div>
</body>
</html>