<div dir="ltr">Hi!, I'm installing a Zimbra server to authenticate using SSO against FreeIPA. When when trying to access I'm getting an error which makes me think that probably I forget set something else in FreeIPA configuration. Because I'm a newbie with using FreeIPA. And when I configured SSO with existing Kerberos installation it worked. So surely the mistake is mine to configure something on FreeIPA. I tell some details about it but if you need more information y can share it with all you. As a client to access via GSSAPI use Thunderbird. The error I get: "The Kerberos/GSSAPI ticket was not accepted by the IMAP server <a href="mailto:usuipa@fi.example.com">usuipa@fi.example.com</a>. Please check that you are logged in to the Kerberos/GSSAPI realm". Steps to Reproduce in FreeIPA: 1) I add the entry to the imap service by Identity Management. In Services HBAC add imap/<a href="mailto:fi.example.com@FI.EXAMPLE.COM">fi.example.com@FI.EXAMPLE.COM</a>. By clicking on it. I get the following information about status: - Key current Kerberos Service provided - Service Certificate: Certificate not valid 2) I got the keytab which is then used in the installation of Zimbra as follows: ipa-getkeytab <a href="http://freeipafi.example.com">freeipafi.example.com</a> -p -s imap / <a href="http://zimbrafreeipa.fi.example.com">zimbrafreeipa.fi.example.com</a> -k /tmp/keytab/ticket.keytab Thanks for any help or clarification. Greetings!. -- <div class="gmail_signature">Maria José</div> </div>