<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 07/28/2014 02:39 PM, Joseph, Matthew (EXP) wrote: </div> <blockquote cite="mid:9621CE4454B9514B9E709C1719B2B9430770C5@HCXDSPM1.ca.lmco.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> Weird, when I do kdestroy it prompts me for a password to do the ipa-replica-manage list command and I supply the password but it states invaloud crednetials.<o:p></o:p> When I do kinit and supply the password it works.<o:p></o:p> They use the same account/password don’t they?<o:p></o:p> </div> </blockquote> Actually, I think not :-) If I do not have a ticket (admin) then it prompts for the Directory Manager password and that depends on how you've set it during the installation. If you get a ticket as admin, the it doesn't prompt for the Directory Manager password - doesn't need it as admin has broader permissions. If you have no ticket, and is failing on the Directory Manager password when prompted, then Directory Manager must have a different password. -m <blockquote cite="mid:9621CE4454B9514B9E709C1719B2B9430770C5@HCXDSPM1.ca.lmco.com" type="cite"> <div class="WordSection1"> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a class="moz-txt-link-freetext" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Mark Heslin Sent: Monday, July 28, 2014 3:27 PM To: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: EXTERNAL: Re: [Freeipa-users] IPA Replica Issues<o:p></o:p> </div> </div> <o:p> </o:p> <div> On 07/28/2014 02:12 PM, Mark Heslin wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <div> On 07/28/2014 12:46 PM, Joseph, Matthew (EXP) wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hello,<o:p></o:p> <o:p></o:p> I’m currently running into some issues with my replica server.<o:p></o:p> I noticed it wasn’t getting any updates from the master server so I tried to do a force-sync but it states that it is an “invalid password” which I know it is not the case.<o:p></o:p> <o:p></o:p> I tried doing an ipa-replica-manager list replica_server but it gives me the SASL(-13) authentication failure: GSSAPI Failure: gss_accept_sec_context, ‘desc’ Invalid Credentials<o:p></o:p> <o:p></o:p> I’ve tried doing a kdestroy and have it prompt me for the password but again, same error.<o:p></o:p> <o:p></o:p> Any idea what this would be?<o:p></o:p> Thanks,<o:p></o:p> <o:p></o:p> Matt<o:p></o:p> <o:p></o:p> </blockquote> Joe, Are you actually getting a valid Kerberos ticket - on the surface it would not appear so. Also, the command is 'ipa-replica-manage list': Example: # ipa-replica-manage list idm-srv1.example.com: master idm-srv2.example.com: master -m <o:p></o:p> </blockquote> Joe, I forgot to add, you should be able to do this without a Kerberos ticket but you'll need to specify the Directory Mnager password: Example: # ipa-replica-manage list Directory Manager password: ******** idm-srv1.example.com: master idm-srv2.example.com: master # klist klist: No credentials cache found (ticket cache KEYRING:persistent:0:0) I'm runnning RHEL 7 - not sure whether or not this behavior is different on earlier versions. -m <o:p></o:p> </div> </blockquote> </body> </html>