I fixed my problems with ipa* functions by modifying /etc/hosts so that my FQDN entry is first, and the localhost entry is not first. I am guessing this is where most other people will have their problems. Can we modify the FAQ to include this recommendation? I am having issues getting access to the web page outside of the machine with freeipa installed. Should I be able to get a ticket by accessing the web interface? In both IE and Firefox, I am unable to bring up any pages after getting prompted. In IE, it is blank, and Firefox I get Kerberos authentication failed. This is another noob question, but perhaps it will be helpful for the FAQ. My O'Reilly book on Kerberos is on its way. :) Thanks! -Mark <div class="gmail_quote">On Mon, May 19, 2008 at 9:00 AM, <<a href="mailto:freeipa-devel-request@redhat.com">freeipa-devel-request@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Send Freeipa-devel mailing list submissions to <a href="mailto:freeipa-devel@redhat.com">freeipa-devel@redhat.com</a> To subscribe or unsubscribe via the World Wide Web, visit <a href="https://www.redhat.com/mailman/listinfo/freeipa-devel" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-devel</a> or, via email, send a message with subject or body 'help' to <a href="mailto:freeipa-devel-request@redhat.com">freeipa-devel-request@redhat.com</a> You can reach the person managing the list at <a href="mailto:freeipa-devel-owner@redhat.com">freeipa-devel-owner@redhat.com</a> When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeipa-devel digest..." Today's Topics: 1. Re: freeIPA + Fedora 9 + xen , can't get passed ipa-finduser admin (Rob Crittenden) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 May 2008 11:39:45 -0400 From: Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> Subject: Re: [Freeipa-devel] freeIPA + Fedora 9 + xen , can't get passed ipa-finduser admin To: Jaakan Shorter <<a href="mailto:jaakanshorter@gmail.com">jaakanshorter@gmail.com</a>> Cc: <a href="mailto:freeipa-devel@redhat.com">freeipa-devel@redhat.com</a> Message-ID: <<a href="mailto:48319F41.7040707@redhat.com">48319F41.7040707@redhat.com</a>> Content-Type: text/plain; charset="iso-8859-1" Jaakan Shorter wrote: > here's an update ( I replaced the domain name with test ) > let me know if you need anymore info > > ipa-server-install --uninstall > rm -f /var/kerberos/krb5kdc/kpasswd.keytab > stopped the kerberos service ( --uninstall switch didn't stop it. I > thought it should set it back to old state ) > yum update ( 1.0.6 version came out over the weekend for FC-9 ) > rebooted > ipa-server-install --setup-bind -N Yes, this should be fixed in the tip. [ snip ] > May 19 09:31:08 <a href="http://freeIPA.test.net" target="_blank">freeIPA.test.net</a> krb5kdc[1758](info): set up 4 sockets > May 19 09:31:08 <a href="http://freeIPA.test.net" target="_blank">freeIPA.test.net</a> krb5kdc[1759](info): commencing operation > May 19 09:32:02 <a href="http://freeIPA.test.net" target="_blank">freeIPA.test.net</a> krb5kdc[1759](info): AS_REQ (7 etypes > {18 17 16 23 1 3 2}) <a href="http://192.168.1.25" target="_blank">192.168.1.25</a>: NEEDED_PREAUTH: <a href="mailto:admin@TEST.NET">admin@TEST.NET</a> for > krbtgt/<a href="http://TEST.NET" target="_blank">TEST.NET</a>@<a href="http://TEST.NET" target="_blank">TEST.NET</a>, Additional pre-authentication required > May 19 09:32:24 <a href="http://freeIPA.test.net" target="_blank">freeIPA.test.net</a> krb5kdc[1759](info): AS_REQ (7 etypes > {18 17 16 23 1 3 2}) <a href="http://192.168.1.25" target="_blank">192.168.1.25</a>: ISSUE: authtime 1211203944, etypes > {rep=18 tkt=18 ses=18}, <a href="mailto:admin@TEST.NET">admin@TEST.NET</a> for krbtgt/<a href="http://TEST.NET" target="_blank">TEST.NET</a>@<a href="http://TEST.NET" target="_blank">TEST.NET</a> > May 19 09:32:54 <a href="http://freeIPA.test.net" target="_blank">freeIPA.test.net</a> krb5kdc[1759](info): TGS_REQ (7 > etypes {18 17 16 23 1 3 2}) <a href="http://192.168.1.25" target="_blank">192.168.1.25</a>: UNKNOWN_SERVER: authtime > 1211203944, <a href="mailto:admin@TEST.NET">admin@TEST.NET</a> for HTTP/<a href="http://freeipa.test.net" target="_blank">freeipa.test.net</a>@<a href="http://TEST.NET" target="_blank">TEST.NET</a>, Server > not found in Kerberos database > May 19 09:32:54 <a href="http://freeIPA.test.net" target="_blank">freeIPA.test.net</a> krb5kdc[1759](info): TGS_REQ (7 > etypes {18 17 16 23 1 3 2}) <a href="http://192.168.1.25" target="_blank">192.168.1.25</a>: UNKNOWN_SERVER: authtime > 1211203944, <a href="mailto:admin@TEST.NET">admin@TEST.NET</a> for HTTP/<a href="http://freeipa.test.net" target="_blank">freeipa.test.net</a>@<a href="http://TEST.NET" target="_blank">TEST.NET</a>, Server > not found in Kerberos database Service principals are created for the IPA servers at install time. There must be some (perhaps subtle) difference in what was created at install time and what it is trying to use. Try this command to see what service principals exist: $ ldapsearch -LLL -x -b "cn=kerberos,dc=test,dc=net" objectclass=krbPrincipalAux dn rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature Url : <a href="https://www.redhat.com/archives/freeipa-devel/attachments/20080519/db294115/smime.bin" target="_blank">https://www.redhat.com/archives/freeipa-devel/attachments/20080519/db294115/smime.bin</a> ------------------------------ _______________________________________________ Freeipa-devel mailing list <a href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/freeipa-devel" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-devel</a> End of Freeipa-devel Digest, Vol 12, Issue 33 ********************************************* </blockquote></div>