<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">I just noticed I can log in to the web UI with user admin and his password.<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">But when I try to configure firefox to use kerberos, I click on "Install Kerberos Configuration Firefox Extension" button, a message appears saying "Firefox prevented this site from asking you to install software on your computer", so I click on the "Allow" button and then another message appears "The add-on downloaded from this site could not be installed because it appears to be corrupt.".<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">And the ipa commands are still not working.<br><span style="font-family:monospace,monospace">$ ipa user-show admin<br>ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json">https://zaira2.opera/ipa/json</a>': Unauthorized</span><br><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 5, 2015 at 12:13 PM, Fujisan <span dir="ltr"><<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">I uninstalled the ipa server and reinstalled it. Then restored the backup.<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">And then the following:<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br><span style="font-family:monospace,monospace">$ keyctl list @s<br>3 keys in keyring:<br>437165764: --alswrv 0 65534 keyring: _uid.0<br>556579409: --alswrv 0 0 user: ipa_session_cookie:host/zaira2.opera@OPERA<br>286806445: ---lswrv 0 65534 keyring: _persistent.0<br>$ keyctl purge 556579409<br>purged 0 keys<br>$ keyctl reap<br>0 keys reaped<span class=""><br>$ ipa user-show admin<br>ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json" target="_blank">https://zaira2.opera/ipa/json</a>': Unauthorized<br></span>$ keyctl list @s<br>3 keys in keyring:<br>437165764: --alswrv 0 65534 keyring: _uid.0<br>556579409: --alswrv 0 0 user: ipa_session_cookie:host/zaira2.opera@OPERA<br>286806445: ---lswrv 0 65534 keyring: _persistent.0</span><br><br></div><div class="gmail_extra"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">It doesn't seem to purge or to reap.</div><div><div class="h5"><br><br><br><div class="gmail_quote">On Mon, Oct 5, 2015 at 9:17 AM, Fujisan <span dir="ltr"><<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-family:arial,helvetica,sans-serif">Good morning, <br><br>Any suggestion what I should do?</div><br><div style="font-family:arial,helvetica,sans-serif">I still have<span><br><br>$ ipa user-show admin<br>ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json" target="_blank">https://zaira2.opera/ipa/json</a>': Unauthorized<br><br><br></span></div><div style="font-family:arial,helvetica,sans-serif">Regards.<br></div><div><div><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 2, 2015 at 5:04 PM, Fujisan <span dir="ltr"><<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-family:arial,helvetica,sans-serif">I only have this:<br><br>$ keyctl list @s<br>1 key in keyring:<br>641467419: --alswrv 0 65534 keyring: _uid.0<br>$<br><br><br></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 2, 2015 at 5:01 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>On Fri, 02 Oct 2015, Fujisan wrote:<br> </span><span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> I forgot to mention that<br> <br> $ ipa user-show admin<br> ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json" rel="noreferrer" target="_blank">https://zaira2.opera/ipa/json</a>': Unauthorized<br> </blockquote></span> This is most likely because of the cached session to your server.<br> <br> You can check if keyctl list @s<br> returns you something like<br> [root@m1 ~]# keyctl list @s<br> 2 keys in keyring:<br> 496745412: --alswrv 0 65534 keyring: _uid.0<br> 215779962: --alswrv 0 0 user: <a href="mailto:ipa_session_cookie%3Aadmin@EXAMPLE.COM" target="_blank">ipa_session_cookie:admin@EXAMPLE.COM</a><br> <br> If so, then notice the key number (215779962) for the session cookie,<br> and do:<br> keyctl purge 215779962<br> keyctl reap<br> <br> This should make a next 'ipa ...' command run to ask for new cookie.<br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span> <br> On Fri, Oct 2, 2015 at 4:44 PM, Fujisan <<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>> wrote:<br> <br> </span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span> I still cannot login to the web UI.<br> <br> Here is what I did:<br> <br></span> 1. mv /etc/krb5.keytab /etc/krb5.keytab.save<br> 2. kinit admin<br> Password for admin@OPERA:<br> 3. ipa-getkeytab -s zaira2.opera -p host/zaira2.opera@OPERA -k<br> /etc/krb5.keytab<br> 4. systemctl restart sssd.service<br> 5. mv /etc/httpd/conf/ipa.keytab /etc/httpd/conf/ipa.keytab.save<br> 6. ipa-getkeytab -s zaira2.opera -p HTTP/zaira2.opera@OPERA -k<br> /etc/httpd/conf/ipa.keytab<br> 7. systemctl restart httpd.service<div><div><br> <br> The log says now:<br> <br> Oct 02 16:40:56 zaira2.opera krb5kdc[9065](info): AS_REQ (9 etypes {18 17<br> 16 23 25 26 1 3 2}) <a href="http://10.0.21.18" rel="noreferrer" target="_blank">10.0.21.18</a>: NEEDED_PREAUTH: HTTP/zaira2.opera@OPERA<br> for krbtgt/OPERA@OPERA, Additional pre-authentication required<br> <br> <br> <br> On Fri, Oct 2, 2015 at 4:25 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>><br> wrote:<br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> On Fri, 02 Oct 2015, Fujisan wrote:<br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Well, I think I messed up when trying to configure cockpit to use<br> kerberos.<br> <br> What should I do to fix this?<br> <br> I have this on the ipa server:<br> $ klist -k<br> Keytab name: FILE:/etc/krb5.keytab<br> KVNO Principal<br> ----<br> <br> --------------------------------------------------------------------------<br> 2 host/zaira2.opera@OPERA<br> 2 host/zaira2.opera@OPERA<br> 2 host/zaira2.opera@OPERA<br> 2 host/zaira2.opera@OPERA<br> 1 nfs/zaira2.opera@OPERA<br> 1 nfs/zaira2.opera@OPERA<br> 1 nfs/zaira2.opera@OPERA<br> 1 nfs/zaira2.opera@OPERA<br> 3 HTTP/zaira2.opera@OPERA<br> 3 HTTP/zaira2.opera@OPERA<br> 3 HTTP/zaira2.opera@OPERA<br> 3 HTTP/zaira2.opera@OPERA<br> <br> You can start by:<br> </blockquote> 0. backup every file mentioned below<br> 1. Move /etc/krb5.keytab somewhere<br> 2. kinit as admin<br> 3. ipa-getkeytab -s `hostname` -p host/`hostname` -k /etc/krb5.keytab<br> 4. restart SSSD<br> 5. Move /etc/httpd/conf/ipa.keytab somewhere<br> 6. ipa-getkeytab -s `hostname` -p HTTP/`hostname` -k<br> /etc/httpd/conf/ipa.keytab<br> 7. Restart httpd<br> <br> Every time you run 'ipa-getkeytab', Kerberos key for the service<br> specified by you is replaced on the server side so that keys in the<br> keytabs become unusable.<br> <br> I guess cockpit instructions were for something that was not supposed to<br> run on IPA master. On IPA master there are already all needed services<br> (host/ and HTTP/) and their keytabs are in place.<br> <br> <br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> On Fri, Oct 2, 2015 at 3:45 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>><br> wrote:<br> <br> On Fri, 02 Oct 2015, Fujisan wrote:<br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> More info:<br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> I can initiate a ticket:<br> $ kdestroy<br> $ kinit admin<br> <br> but cannot view user admin:<br> $ ipa user-show admin<br> ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json" rel="noreferrer" target="_blank">https://zaira2.opera/ipa/json</a>':<br> Unauthorized<br> <br> $ ipactl status<br> Directory Service: RUNNING<br> krb5kdc Service: RUNNING<br> kadmin Service: RUNNING<br> named Service: RUNNING<br> ipa_memcached Service: RUNNING<br> httpd Service: RUNNING<br> pki-tomcatd Service: RUNNING<br> smb Service: RUNNING<br> winbind Service: RUNNING<br> ipa-otpd Service: RUNNING<br> ipa-dnskeysyncd Service: RUNNING<br> ipa: INFO: The ipactl command was successful<br> <br> /var/log/messages:<br> Oct 2 14:48:55 zaira2 [sssd[ldap_child[4991]]]: Failed to initialize<br> credentials using keytab [MEMORY:/etc/krb5.keytab]: Decrypt integrity<br> check<br> failed. Unable to create GSSAPI-encrypted LDAP connection.<br> <br> What did you do?<br> </blockquote> <br> This and the log below about HTTP/zaira2.opera@OPERA show that you have<br> different keys in LDAP and in your keytab files for host/zaira2.opera<br> and HTTP/zaira2.opera principals. This might happen if somebody removed<br> the principals from LDAP (ipa service-del/ipa service-add, or ipa<br> host-del/ipa host-add) so that they become non-synchronized with<br> whatever you have in the keytab files.<br> <br> <br> On Fri, Oct 2, 2015 at 2:26 PM, Fujisan <<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>> wrote:<br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> Hello,<br> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> I cannot login to the web UI anymore.<br> <br> The password or username you entered is incorrect.<br> <br> Log says:<br> <br> Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): AS_REQ (9 etypes<br> {18 17<br> 16 23 25 26 1 3 2}) <a href="http://10.0.21.18" rel="noreferrer" target="_blank">10.0.21.18</a>: NEEDED_PREAUTH:<br> HTTP/zaira2.opera@OPERA<br> for krbtgt/OPERA@OPERA, Additional pre-authentication required<br> Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): closing down fd 12<br> Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): preauth<br> (encrypted_timestamp) verify failure: Decrypt integrity check failed<br> Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): AS_REQ (9 etypes<br> {18 17<br> 16 23 25 26 1 3 2}) <a href="http://10.0.21.18" rel="noreferrer" target="_blank">10.0.21.18</a>: PREAUTH_FAILED:<br> HTTP/zaira2.opera@OPERA<br> for krbtgt/OPERA@OPERA, Decrypt integrity check failed<br> Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): closing down fd 12<br> <br> <br> I have no idea what went wrong.<br> <br> What can I do?<br> <br> Regards,<br> Fuji<br> <br> <br> <br> --<br> </blockquote></blockquote> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <br> <br> </blockquote> <br> --<br> / Alexander Bokovoy<br> <br> <br> </blockquote></blockquote> --<br> / Alexander Bokovoy<br> <br> </blockquote> <br> <br> </div></div></blockquote></blockquote><div><div> <br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> -- <br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> </blockquote> <br> <br> -- <br> / Alexander Bokovoy<br> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div></div></div></div> </blockquote></div><br></div></div></div></div> </blockquote></div><br></div>