[Freeipa-users] Unable to authenticate a client user against IPA

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/10/2011 06:30 PM, Steven Jones wrote:
> My problem is "To troubleshoot we need logs. There are all sorts of
> logs and configuration files on the server and on the client."
> 
> Thats just it.....I dont know where to look.....its simply not
> documented....so what I need is for someone to tell me what logs you
> need....and how to make the system log reliably...... for instance
> debug_level = 9 in the sssd.conf still produces 0 length logs on
> client1....so there is nothing to report....
> 

If that's happening, then it likely means that SSSD was never started
(or not restarted after adding debug_level=9; SSSD doesn't autodetect
this change). Please try 'service sssd restart'

> It may well be my problems stems from trying to use RHEL6 svr and KVM
> with fedora 14 clients inside it which I am finding very flaky....I
> may need to blow it away and move the test bed to vmware ESXi.....
> 
> Or maybe indeed I am serially doing something wrong.....
> 
> I am trying again to setup client 3, what selinux is telling me is
> ipa-submit is trying to open krb5.keytab....
> 
> I will test and maybe turn selinux off, if i can figur eout how!
> 

As root, run 'setenforce 0'. This will set SELinux into "permissive"
mode. It will still report SELinux errors, but it won't prevent the
functionality. Please keep an eye on any such errors and report them to us.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk157WkACgkQeiVVYja6o6M3oACeIb9tbVL8A7PMWcbrqfQedykZ
cnUAoJGIa9lvGbPJbg1fecogYYwU4VWk
=E+gl
-----END PGP SIGNATURE-----