<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:14px"><div id="yui_3_16_0_1_1416958531287_7660" dir="ltr"><span id="yui_3_16_0_1_1416958531287_7767">ohh sorry I didn't said that I was using the freeipa server on this problem, anyway thanks for the replies :) and before </span></div><div id="yui_3_16_0_1_1416958531287_7660" dir="ltr"><span><br></span></div><div id="yui_3_16_0_1_1416958531287_7660" dir="ltr"><span>Thanks, really appreciate it :D</span></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: times new roman, new york, times, serif; font-size: 14px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Monday, November 24, 2014 11:55 PM, Martin Kosek <mkosek@redhat.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">On 11/25/2014 08:12 AM, Rolf Nufable wrote:<br clear="none">> Well I tried to kinit the admin account and then reboot the server.. then after that it worked, admin account could then log in the ipa web ui.. but does this mean that everytime I want to log in to the UI i need to kinit manually?<br clear="none">> <br clear="none">> Sent from Yahoo Mail on Android<br clear="none"><br clear="none">Well, you need to have a ticket on your client machine (the one with the<br clear="none">browser) to be able to authenticate via Kerberos. You can check that with<br clear="none"><br clear="none"># klist<br clear="none"><br clear="none">To get the ticket, you can either run the kinit manually as you said or let<br clear="none">SSSD to get it for you as you authenticate/login to your client machine. AFAIK,<br clear="none">this is default behavior.<div class="yqt5835093048" id="yqtfd94132"><br clear="none"><br clear="none">Martin<br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>