<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Well, I think I messed up when trying to configure cockpit to use kerberos. </div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">What should I do to fix this? </div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"> I have this on the ipa server: $ klist -k Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 host/zaira2.opera@OPERA 2 host/zaira2.opera@OPERA 2 host/zaira2.opera@OPERA 2 host/zaira2.opera@OPERA 1 nfs/zaira2.opera@OPERA 1 nfs/zaira2.opera@OPERA 1 nfs/zaira2.opera@OPERA 1 nfs/zaira2.opera@OPERA 3 HTTP/zaira2.opera@OPERA 3 HTTP/zaira2.opera@OPERA 3 HTTP/zaira2.opera@OPERA 3 HTTP/zaira2.opera@OPERA </div></div><div class="gmail_extra"> <div class="gmail_quote">On Fri, Oct 2, 2015 at 3:45 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Fri, 02 Oct 2015, Fujisan wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> More info: I can initiate a ticket: $ kdestroy $ kinit admin but cannot view user admin: $ ipa user-show admin ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json" rel="noreferrer" target="_blank">https://zaira2.opera/ipa/json</a>': Unauthorized $ ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ipa_memcached Service: RUNNING httpd Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful /var/log/messages: Oct 2 14:48:55 zaira2 [sssd[ldap_child[4991]]]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Decrypt integrity check failed. Unable to create GSSAPI-encrypted LDAP connection. </blockquote></div></div> What did you do? This and the log below about HTTP/zaira2.opera@OPERA show that you have different keys in LDAP and in your keytab files for host/zaira2.opera and HTTP/zaira2.opera principals. This might happen if somebody removed the principals from LDAP (ipa service-del/ipa service-add, or ipa host-del/ipa host-add) so that they become non-synchronized with whatever you have in the keytab files.<div class="HOEnZb"><div class="h5"> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On Fri, Oct 2, 2015 at 2:26 PM, Fujisan <<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hello, I cannot login to the web UI anymore. The password or username you entered is incorrect. Log says: Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): AS_REQ (9 etypes {18 17 16 23 25 26 1 3 2}) <a href="http://10.0.21.18" rel="noreferrer" target="_blank">10.0.21.18</a>: NEEDED_PREAUTH: HTTP/zaira2.opera@OPERA for krbtgt/OPERA@OPERA, Additional pre-authentication required Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): closing down fd 12 Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): AS_REQ (9 etypes {18 17 16 23 25 26 1 3 2}) <a href="http://10.0.21.18" rel="noreferrer" target="_blank">10.0.21.18</a>: PREAUTH_FAILED: HTTP/zaira2.opera@OPERA for krbtgt/OPERA@OPERA, Decrypt integrity check failed Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): closing down fd 12 I have no idea what went wrong. What can I do? Regards, Fuji </blockquote></blockquote> </div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote> -- / Alexander Bokovoy </blockquote></div> </div>