<div dir="ltr"> Hi, I seem to having some issue trying to install the IPA client (version 4.4.0) on Centos 7 using DNS. I can get a working install by issuing the —server flags, but I would rather do it using SRV so we can issue the command via salt to multiple servers, and should we add another replicant. We will only need to update the SRV records rather than updating all our client servers. I am running this command, $>ipa-client-install --force-ntpd --mkhomedir --principal admin --realm=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> --domain <a href="http://uk.internal.mydomain.com">uk.internal.mydomain.com</a> --unattended -w superhard But I keep getting this. Discovery was successful! Client hostname: <a href="http://portalwaf2.uk">portalwaf2.uk</a> Realm: <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> DNS Domain: <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> IPA Server: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> BaseDN: dc=uk,dc=internal,dc=mydomain,dc=com Synchronizing time with KDC... Attempting to sync time using ntpd. Will timeout after 15 seconds Successfully retrieved CA cert Subject: CN=Certificate Authority,O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Issuer: CN=Certificate Authority,O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Valid From: Fri Feb 17 12:09:04 2017 UTC Valid Until: Tue Feb 17 12:09:04 2037 UTC Enrolled in IPA realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Created /etc/ipa/default.conf New SSSD config will be created Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> trying <a href="https://ipa1.uk.internal.mydomain.com/ipa/json">https://ipa1.uk.internal.mydomain.com/ipa/json</a> Traceback (most recent call last): File "/usr/sbin/ipa-client-install", line 3128, in <module> sys.exit(main()) File "/usr/sbin/ipa-client-install", line 3109, in main rval = install(options, env, fstore, statestore) File "/usr/sbin/ipa-client-install", line 2818, in install api.finalize() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 707, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 422, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 585, in load_plugins for package in self.packages: File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 919, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 118, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 543, in get_package schema = Schema(client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 387, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 413, in _fetch client.connect(verbose=False) File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in connect conn = self.create_connection(*args, **kw) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 931, in create_connection raise errors.KerberosError(message=unicode(krberr)) ipalib.errors.KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm "<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a>" Installation log: 2017-03-02T15:38:32Z DEBUG /usr/sbin/ipa-client-install was invoked with options: {'domain': '<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>', 'force': False, 'krb5_offline_passwords': True, 'ip_addresses': [], 'configure_firefox': False, 'primary': False, 'realm_name': '<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a>', 'force_ntpd': True, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'no_nisdomain': False, 'nisdomain': None, 'ca_cert_file': None, 'principal': 'admin', 'keytab': None, 'hostname': None, 'request_cert': False, 'trust_sshfp': False, 'no_ac': False, 'unattended': True, 'all_ip_addresses': False, 'location': None, 'sssd': True, 'ntp_servers': None, 'kinit_attempts': 5, 'dns_updates': False, 'conf_sudo': True, 'conf_ssh': True, 'force_join': True, 'firefox_dir': None, 'server': None, 'prompt_password': False, 'permit': False, 'debug': False, 'preserve_sssd': False, 'mkhomedir': True, 'uninstall': False} 2017-03-02T15:38:32Z DEBUG missing options might be asked for interactively later 2017-03-02T15:38:32Z DEBUG IPA version 4.4.0-14.el7.centos.4 2017-03-02T15:38:32Z DEBUG [IPA Discovery] 2017-03-02T15:38:32Z DEBUG Starting IPA discovery with domain=<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>, servers=None, hostname=<a href="http://portalwaf2.uk">portalwaf2.uk</a> 2017-03-02T15:38:32Z DEBUG Search for LDAP SRV record in <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _ldap._<a href="http://tcp.freeipa.uk.internal.mydomain.com">tcp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 389 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 389 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG [Kerberos realm search] 2017-03-02T15:38:32Z DEBUG Kerberos realm forced 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _kerberos._<a href="http://udp.freeipa.uk.internal.mydomain.com">udp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 88 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 88 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG [LDAP server check] 2017-03-02T15:38:32Z DEBUG Verifying that <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> (realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a>) is an IPA server 2017-03-02T15:38:32Z DEBUG Init LDAP connection to: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG Search LDAP server for IPA base DN 2017-03-02T15:38:32Z DEBUG Check if naming context 'dc=uk,dc=internal,dc=mydomain,dc=com' is for IPA 2017-03-02T15:38:32Z DEBUG Naming context 'dc=uk,dc=internal,dc=mydomain,dc=com' is a valid IPA context 2017-03-02T15:38:32Z DEBUG Search for (objectClass=krbRealmContainer) in dc=uk,dc=internal,dc=mydomain,dc=com (sub) 2017-03-02T15:38:32Z DEBUG Found: cn=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a>,cn=kerberos,dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z DEBUG Discovery result: Success; server=<a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>, domain=<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>, kdc=<a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>,<a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>, basedn=dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z DEBUG Validated servers: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG will use discovered domain: <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG Start searching for LDAP SRV record in "<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>" (Validating DNS Discovery) and its sub-domains 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _ldap._<a href="http://tcp.freeipa.uk.internal.mydomain.com">tcp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 389 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 389 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS validated, enabling discovery 2017-03-02T15:38:32Z DEBUG will use discovered server: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO Discovery was successful! 2017-03-02T15:38:32Z DEBUG will use discovered realm: <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG will use discovered basedn: dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z INFO Client hostname: <a href="http://portalwaf2.uk">portalwaf2.uk</a> 2017-03-02T15:38:32Z DEBUG Hostname source: Machine's FQDN 2017-03-02T15:38:32Z INFO Realm: <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Realm source: Discovered from LDAP DNS records in <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO DNS Domain: <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS Domain source: Discovered LDAP SRV records from <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO IPA Server: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG IPA Server source: Discovered from LDAP DNS records in <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO BaseDN: dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z DEBUG BaseDN source: From IPA server ldap://<a href="http://ipa1.uk.internal.mydomain.com:389">ipa1.uk.internal.mydomain.com:389</a> 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Process finished, return code=5 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=realm not found 2017-03-02T15:38:32Z INFO Synchronizing time with KDC... 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _ntp._<a href="http://udp.freeipa.uk.internal.mydomain.com">udp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 123 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 123 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z INFO Attempting to sync time using ntpd. Will timeout after 15 seconds 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/timeout 15 /usr/sbin/ntpd -qgc /tmp/tmplUZ6sG 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=ntpd: time set -1.083636s 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl get_persistent @s 0 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=540282011 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Enabling persistent keyring CCACHE 2017-03-02T15:38:32Z DEBUG Writing Kerberos configuration to /tmp/tmpEVHPqI: 2017-03-02T15:38:32Z DEBUG #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> = { kdc = <a href="http://ipa1.uk.internal.mydomain.com:88">ipa1.uk.internal.mydomain.com:88</a> master_kdc = <a href="http://ipa1.uk.internal.mydomain.com:88">ipa1.uk.internal.mydomain.com:88</a> admin_server = <a href="http://ipa1.uk.internal.mydomain.com:749">ipa1.uk.internal.mydomain.com:749</a> kpasswd_server = <a href="http://ipa1.uk.internal.mydomain.com:464">ipa1.uk.internal.mydomain.com:464</a> default_domain = <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://portalwaf2.uk">portalwaf2.uk</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> .uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Initializing principal <a href="mailto:admin@UK.INTERNAL.MYDOMAIN.COM">admin@UK.INTERNAL.MYDOMAIN.COM</a> using password 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/kinit <a href="mailto:admin@UK.INTERNAL.MYDOMAIN.COM">admin@UK.INTERNAL.MYDOMAIN.COM</a> -c /tmp/krbccxpYNsC/ccache 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=Password for <a href="mailto:admin@UK.INTERNAL.MYDOMAIN.COM">admin@UK.INTERNAL.MYDOMAIN.COM</a>: 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG trying to retrieve CA cert via LDAP from <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG flushing ldap://<a href="http://ipa1.uk.internal.mydomain.com:389">ipa1.uk.internal.mydomain.com:389</a> from SchemaCache 2017-03-02T15:38:32Z DEBUG retrieving schema for SchemaCache url=ldap://<a href="http://ipa1.uk.internal.mydomain.com:389">ipa1.uk.internal.mydomain.com:389</a> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x1fb8ab8> 2017-03-02T15:38:32Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Issuer: CN=Certificate Authority,O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Valid From: Fri Feb 17 12:09:04 2017 UTC Valid Until: Tue Feb 17 12:09:04 2037 UTC 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/sbin/ipa-join -s <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> -b dc=uk,dc=internal,dc=mydomain,dc=com -h <a href="http://portalwaf2.uk">portalwaf2.uk</a> -f 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z INFO Enrolled in IPA realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=kdestroy 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Initializing principal host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a> using keytab /etc/krb5.keytab 2017-03-02T15:38:32Z DEBUG using ccache /etc/ipa/.dns_ccache 2017-03-02T15:38:32Z DEBUG Attempt 1/5: success 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2017-03-02T15:38:32Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2017-03-02T15:38:32Z INFO Created /etc/ipa/default.conf 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2017-03-02T15:38:32Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf' doesn't exist 2017-03-02T15:38:32Z INFO New SSSD config will be created 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2017-03-02T15:38:32Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2017-03-02T15:38:32Z INFO Configured sudoers in /etc/nsswitch.conf 2017-03-02T15:38:32Z INFO Configured /etc/sssd/sssd.conf 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2017-03-02T15:38:32Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl get_persistent @s 0 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=540282011 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Enabling persistent keyring CCACHE 2017-03-02T15:38:32Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2017-03-02T15:38:32Z DEBUG #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> = { pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://portalwaf2.uk">portalwaf2.uk</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> .uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z INFO Configured /etc/krb5.conf for IPA realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl search @s user ipa_session_cookie:host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Process finished, return code=1 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=keyctl_search: Required key not available 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/certutil -d /tmp/tmpKqp0s3 -N -f /tmp/tmp8JvkBZ 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/certutil -d /tmp/tmpKqp0s3 -A -n CA certificate 1 -t C,, 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl search @s user ipa_session_cookie:host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Process finished, return code=1 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=keyctl_search: Required key not available 2017-03-02T15:38:32Z DEBUG failed to find session_cookie in persistent storage for principal 'host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a>' 2017-03-02T15:38:32Z INFO trying <a href="https://ipa1.uk.internal.mydomain.com/ipa/json2017-03-02T15:38:32Z">https://ipa1.uk.internal.mydomain.com/ipa/json2017-03-02T15:38:32Z</a> DEBUG /usr/sbin/ipa-client-install was invoked with options: {'domain': '<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>', 'force': False, 'krb5_offline_passwords': True, 'ip_addresses': [], 'configure_firefox': False, 'primary': False, 'realm_name': '<a href="http://UK.INTERNAL.mydomain.COM">UK.INTERNAL.mydomain.COM</a>', 'force_ntpd': True, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'no_nisdomain': False, 'nisdomain': None, 'ca_cert_file': None, 'principal': 'admin', 'keytab': None, 'hostname': None, 'request_cert': False, 'trust_sshfp': False, 'no_ac': False, 'unattended': True, 'all_ip_addresses': False, 'location': None, 'sssd': True, 'ntp_servers': None, 'kinit_attempts': 5, 'dns_updates': False, 'conf_sudo': True, 'conf_ssh': True, 'force_join': True, 'firefox_dir': None, 'server': None, 'prompt_password': False, 'permit': False, 'debug': False, 'preserve_sssd': False, 'mkhomedir': True, 'uninstall': False} 2017-03-02T15:38:32Z DEBUG missing options might be asked for interactively later 2017-03-02T15:38:32Z DEBUG IPA version 4.4.0-14.el7.centos.4 2017-03-02T15:38:32Z DEBUG [IPA Discovery] 2017-03-02T15:38:32Z DEBUG Starting IPA discovery with domain=<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>, servers=None, hostname=<a href="http://portalwaf2.uk">portalwaf2.uk</a> 2017-03-02T15:38:32Z DEBUG Search for LDAP SRV record in <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _ldap._<a href="http://tcp.freeipa.uk.internal.mydomain.com">tcp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 389 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 389 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG [Kerberos realm search] 2017-03-02T15:38:32Z DEBUG Kerberos realm forced 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _kerberos._<a href="http://udp.freeipa.uk.internal.mydomain.com">udp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 88 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 88 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG [LDAP server check] 2017-03-02T15:38:32Z DEBUG Verifying that <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> (realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a>) is an IPA server 2017-03-02T15:38:32Z DEBUG Init LDAP connection to: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG Search LDAP server for IPA base DN 2017-03-02T15:38:32Z DEBUG Check if naming context 'dc=uk,dc=internal,dc=mydomain,dc=com' is for IPA 2017-03-02T15:38:32Z DEBUG Naming context 'dc=uk,dc=internal,dc=mydomain,dc=com' is a valid IPA context 2017-03-02T15:38:32Z DEBUG Search for (objectClass=krbRealmContainer) in dc=uk,dc=internal,dc=mydomain,dc=com (sub) 2017-03-02T15:38:32Z DEBUG Found: cn=<a href="http://UK.INTERNAL.mydomain.COM">UK.INTERNAL.mydomain.COM</a>,cn=kerberos,dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z DEBUG Discovery result: Success; server=<a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>, domain=<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>, kdc=<a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>,<a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>, basedn=dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z DEBUG Validated servers: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG will use discovered domain: <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG Start searching for LDAP SRV record in "<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a>" (Validating DNS Discovery) and its sub-domains 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _ldap._<a href="http://tcp.freeipa.uk.internal.mydomain.com">tcp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 389 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 389 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS validated, enabling discovery 2017-03-02T15:38:32Z DEBUG will use discovered server: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO Discovery was successful! 2017-03-02T15:38:32Z DEBUG will use discovered realm: <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG will use discovered basedn: dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z INFO Client hostname: <a href="http://portalwaf2.uk">portalwaf2.uk</a> 2017-03-02T15:38:32Z DEBUG Hostname source: Machine's FQDN 2017-03-02T15:38:32Z INFO Realm: <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Realm source: Discovered from LDAP DNS records in <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO DNS Domain: <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS Domain source: Discovered LDAP SRV records from <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO IPA Server: <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG IPA Server source: Discovered from LDAP DNS records in <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z INFO BaseDN: dc=uk,dc=internal,dc=mydomain,dc=com 2017-03-02T15:38:32Z DEBUG BaseDN source: From IPA server ldap://<a href="http://ipa1.uk.internal.mydomain.com:389">ipa1.uk.internal.mydomain.com:389</a> 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Process finished, return code=5 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=realm not found 2017-03-02T15:38:32Z INFO Synchronizing time with KDC... 2017-03-02T15:38:32Z DEBUG Search DNS for SRV record of _ntp._<a href="http://udp.freeipa.uk.internal.mydomain.com">udp.freeipa.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG DNS record found: 40 0 123 <a href="http://ipa2.uk.internal.mydomain.com">ipa2.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z DEBUG DNS record found: 60 0 123 <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a>. 2017-03-02T15:38:32Z INFO Attempting to sync time using ntpd. Will timeout after 15 seconds 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/timeout 15 /usr/sbin/ntpd -qgc /tmp/tmplUZ6sG 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=ntpd: time set -1.083636s 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl get_persistent @s 0 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=540282011 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Enabling persistent keyring CCACHE 2017-03-02T15:38:32Z DEBUG Writing Kerberos configuration to /tmp/tmpEVHPqI: 2017-03-02T15:38:32Z DEBUG #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> dns_lookup_realm = false dns_lookup_kdc = false rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> = { kdc = <a href="http://ipa1.uk.internal.mydomain.com:88">ipa1.uk.internal.mydomain.com:88</a> master_kdc = <a href="http://ipa1.uk.internal.mydomain.com:88">ipa1.uk.internal.mydomain.com:88</a> admin_server = <a href="http://ipa1.uk.internal.mydomain.com:749">ipa1.uk.internal.mydomain.com:749</a> kpasswd_server = <a href="http://ipa1.uk.internal.mydomain.com:464">ipa1.uk.internal.mydomain.com:464</a> default_domain = <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://portalwaf2.uk">portalwaf2.uk</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> .uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Initializing principal <a href="mailto:admin@UK.INTERNAL.MYDOMAIN.COM">admin@UK.INTERNAL.MYDOMAIN.COM</a> using password 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/kinit <a href="mailto:admin@UK.INTERNAL.MYDOMAIN.COM">admin@UK.INTERNAL.MYDOMAIN.COM</a> -c /tmp/krbccxpYNsC/ccache 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=Password for <a href="mailto:admin@UK.INTERNAL.MYDOMAIN.COM">admin@UK.INTERNAL.MYDOMAIN.COM</a>: 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG trying to retrieve CA cert via LDAP from <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> 2017-03-02T15:38:32Z DEBUG flushing ldap://<a href="http://ipa1.uk.internal.mydomain.com:389">ipa1.uk.internal.mydomain.com:389</a> from SchemaCache 2017-03-02T15:38:32Z DEBUG retrieving schema for SchemaCache url=ldap://<a href="http://ipa1.uk.internal.mydomain.com:389">ipa1.uk.internal.mydomain.com:389</a> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x1fb8ab8> 2017-03-02T15:38:32Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Issuer: CN=Certificate Authority,O=<a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> Valid From: Fri Feb 17 12:09:04 2017 UTC Valid Until: Tue Feb 17 12:09:04 2037 UTC 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/sbin/ipa-join -s <a href="http://ipa1.uk.internal.mydomain.com">ipa1.uk.internal.mydomain.com</a> -b dc=uk,dc=internal,dc=mydomain,dc=com -h <a href="http://portalwaf2.uk">portalwaf2.uk</a> -f 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=<a href="http://UK.INTERNAL.mydomain.COM">UK.INTERNAL.mydomain.COM</a> 2017-03-02T15:38:32Z INFO Enrolled in IPA realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=kdestroy 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Initializing principal host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a> using keytab /etc/krb5.keytab 2017-03-02T15:38:32Z DEBUG using ccache /etc/ipa/.dns_ccache 2017-03-02T15:38:32Z DEBUG Attempt 1/5: success 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2017-03-02T15:38:32Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2017-03-02T15:38:32Z INFO Created /etc/ipa/default.conf 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2017-03-02T15:38:32Z DEBUG -> Not backing up - '/etc/sssd/sssd.conf' doesn't exist 2017-03-02T15:38:32Z INFO New SSSD config will be created 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2017-03-02T15:38:32Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2017-03-02T15:38:32Z INFO Configured sudoers in /etc/nsswitch.conf 2017-03-02T15:38:32Z INFO Configured /etc/sssd/sssd.conf 2017-03-02T15:38:32Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2017-03-02T15:38:32Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl get_persistent @s 0 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout=540282011 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Enabling persistent keyring CCACHE 2017-03-02T15:38:32Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2017-03-02T15:38:32Z DEBUG #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> = { pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://freeipa.uk.internal.mydomain.com">freeipa.uk.internal.mydomain.com</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> <a href="http://portalwaf2.uk">portalwaf2.uk</a> = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> .uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> uk = <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z INFO Configured /etc/krb5.conf for IPA realm <a href="http://UK.INTERNAL.MYDOMAIN.COM">UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl search @s user ipa_session_cookie:host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Process finished, return code=1 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=keyctl_search: Required key not available 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/certutil -d /tmp/tmpKqp0s3 -N -f /tmp/tmp8JvkBZ 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=/usr/bin/certutil -d /tmp/tmpKqp0s3 -A -n CA certificate 1 -t C,, 2017-03-02T15:38:32Z DEBUG Process finished, return code=0 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr= 2017-03-02T15:38:32Z DEBUG Starting external process 2017-03-02T15:38:32Z DEBUG args=keyctl search @s user ipa_session_cookie:host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a> 2017-03-02T15:38:32Z DEBUG Process finished, return code=1 2017-03-02T15:38:32Z DEBUG stdout= 2017-03-02T15:38:32Z DEBUG stderr=keyctl_search: Required key not available 2017-03-02T15:38:32Z DEBUG failed to find session_cookie in persistent storage for principal 'host/<a href="mailto:portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM">portalwaf2.uk@UK.INTERNAL.MYDOMAIN.COM</a>' 2017-03-02T15:38:32Z INFO trying <a href="https://ipa1.uk.internal.mydomain.com/ipa/json">https://ipa1.uk.internal.mydomain.com/ipa/json</a> Running ipa-getcert list returns: Number of certificates and requests being tracked: 0. DNS records: SRV record for FreeIPA _<a href="http://kerberos.freeipa.uk">kerberos.freeipa.uk</a> IN TXT "<a href="http://FREEIPA.UK.INTERNAL.MYDOMAIN.COM">FREEIPA.UK.INTERNAL.MYDOMAIN.COM</a>" _ldap._tcp IN SRV 60 0 389 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 389 <a href="http://ipa2.uk">ipa2.uk</a> _ldap._<a href="http://tcp.freeipa.uk">tcp.freeipa.uk</a> IN SRV 60 0 389 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 389 <a href="http://ipa2.uk">ipa2.uk</a> _ldaps._<a href="http://tcp.freeipa.uk">tcp.freeipa.uk</a> IN SRV 60 0 636 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 636 <a href="http://ipa2.uk">ipa2.uk</a> _kerberos._<a href="http://tcp.freeipa.uk">tcp.freeipa.uk</a> IN SRV 60 0 464 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 464 <a href="http://ipa2.uk">ipa2.uk</a> _http._<a href="http://tcp.freeipa.uk">tcp.freeipa.uk</a> IN SRV 60 0 80 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 80 <a href="http://ipa2.uk">ipa2.uk</a> _https._<a href="http://tcp.freeipa.uk">tcp.freeipa.uk</a> IN SRV 60 0 443 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 442 <a href="http://ipa2.uk">ipa2.uk</a> _kerberos-adm._<a href="http://tcp.freeipa.uk">tcp.freeipa.uk</a> IN SRV 60 0 749 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 749 <a href="http://ipa2.uk">ipa2.uk</a> _kerberos-master._<a href="http://udp.freeipa.uk">udp.freeipa.uk</a> IN SRV 0 0 88 <a href="http://ipa1.uk">ipa1.uk</a> _kerberos._<a href="http://udp.freeipa.uk">udp.freeipa.uk</a> IN SRV 60 0 88 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 88 <a href="http://ipa2.uk">ipa2.uk</a> _kpasswd._<a href="http://udp.freeipa.uk">udp.freeipa.uk</a> IN SRV 60 0 464 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 464 <a href="http://ipa2.uk">ipa2.uk</a> _ntp._<a href="http://udp.freeipa.uk">udp.freeipa.uk</a> IN SRV 60 0 123 <a href="http://ipa1.uk">ipa1.uk</a> IN SRV 40 0 123 <a href="http://ipa2.uk">ipa2.uk</a> Not sure what Im getting wrong.<div><div class="gmail_signature"><div dir="ltr">-- <table border="0" cellpadding="0" cellspacing="0" style="font-size:12.8px;font-family:"times new roman""><tbody><tr><td>Regards</td></tr><tr height="15"><td colspan="2"> </td></tr><tr><td colspan="2">Mick</td></tr></tbody></table></div></div></div> </div>