<div dir="ltr">Thanks Alexander. Reviewing the proxy requirements now.</div><div class="gmail_extra"> <div class="gmail_quote">On Tue, Nov 25, 2014 at 3:32 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, 25 Nov 2014, Dimitar Georgievski wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> My case for HTTP load balancing is little different. Ideally I would like to use a real load balancer (A10 in this case) for balancing HTTP and HTTPS services. Would that be possible? Based on the info in this thread, and Apache configuration for IPA (ipa.conf) the following steps were performed - Added host for <a href="http://sso.example.com" target="_blank">sso.example.com</a> - Added service for HTTP/<a href="http://sso.example.com" target="_blank">sso.example.com</a> - added new entry for HTTP/<a href="http://sso.example.com" target="_blank">sso.example.com</a> to /etc/httpd/conf/ipa.keytab. This keytab is listed in the conf.d/ipa.conf under the Location '/ipa' groups of directives. ipa-getkeytab -s `hostname` -p HTTP/<a href="http://sso.example.com" target="_blank">sso.example.com</a> -k /etc/httpd/conf/ipa.keytab - modifed the conf.d/ipa-rewrite.conf and ipa-pki-proxy.conf to redirect requests to <a href="http://sso.example.com" target="_blank">sso.example.com</a> The login page loads but unfortunately authentication is failing with HTTP 401 (unauthorized) response from the server. I wonder what I am doing wrong. </blockquote> Can you show your /var/log/krb5kdc.log, lines concerning HTTP/<a href="http://sso.example.com" target="_blank">sso.example.com</a> principal at the time you are trying to access IPA UI. FreeIPA limits service principals' ability to impersonate user principals (or any other principals). FreeIPA UI runs as HTTP/ principal and is given permission to impersonate user principal when talking to ldap/ service. This setup is explicit and requires additional configuration for those Kerberos principals which ask for additional access. For more detailed description read my article at <a href="http://vda.li/en/posts/2013/07/29/Setting-up-S4U2Proxy-with-FreeIPA/index.html" target="_blank">http://vda.li/en/posts/2013/07/29/Setting-up-S4U2Proxy-with-FreeIPA/index.html</a> -- / Alexander Bokovoy </blockquote></div> </div>