[Freeipa-users] sudden ipa errors.

[Nathan Lager]

On 09/19/2012 11:34 AM, Rob Crittenden wrote:
> Nathan Lager wrote:
>> 
>> On 09/19/2012 10:37 AM, Rob Crittenden wrote:
>>> Lager, Nathan T. wrote:
>>>> 
>>>> ----- Original Message -----
>>>>> From: "Rob Crittenden" <rcritten at redhat.com> To: "Nathan
>>>>> Lager" <lagern at lafayette.edu> Cc: freeipa-users at redhat.com
>>>>> Sent: Tuesday, September 18, 2012 5:17:00 PM Subject: Re: 
>>>>> [Freeipa-users] sudden ipa errors.
>>>>> 
>>>>> Ok, what are the permissions on the keytab, 
>>>>> /etc/httpd/conf/ipa.keytab? They should be apache:apache
>>>>> mode 0600.
>>>> 
>>>> [lagern at caroline0 PROD ~]$ ls -lZ /etc/httpd/conf/ipa.keytab 
>>>> -rw-------. apache apache 
>>>> unconfined_u:object_r:httpd_config_t:s0 
>>>> /etc/httpd/conf/ipa.keytab
>>>> 
>>>>> 
>>>>> Are you in SELinux enforcing mode? Can you try in
>>>>> permissive to see if that works?
>>>> I was enforcing at the start of all of this, but ive since 
>>>> switched to permissive for troubleshooting.  It hasnt made a 
>>>> difference.
>>> 
>>> Are you getting an HTTP service principal in the client?
>>> 
>>> $ kdestroy $ kinit admin $ ipa user-show admin <fail> $ klist
>>> -fea
>>> 
>>> Lets try to skip s4u2proxy. Does this work:
>>> 
>>> $ ipa --delegate user-show admin
>>> 
>>> Unfortunately the major and minor error codes are as generic as
>>> can be so they aren't any help at all.
>>> 
>>> rob
>> 
>> Here's the output. The --delegate still failed.
>> 
>> [root at caroline0 PROD ~]# klist -fea Ticket cache:
>> FILE:/tmp/krb5cc_0 Default principal:
>> lagern at SYSTEMS.LAFAYETTE.EDU
>> 
>> Valid starting     Expires            Service principal 09/19/12
>> 11:23:03  09/20/12 11:22:52 
>> krbtgt/SYSTEMS.LAFAYETTE.EDU at SYSTEMS.LAFAYETTE.EDU Flags: FIA,
>> Etype (skey, tkt): aes256-cts-hmac-sha1-96, 
>> aes256-cts-hmac-sha1-96 Addresses: (none) 09/19/12 11:23:11
>> 09/20/12 11:22:52 
>> HTTP/caroline0.lafayette.edu at SYSTEMS.LAFAYETTE.EDU Flags: FAT,
>> Etype (skey, tkt): aes256-cts-hmac-sha1-96, 
>> aes256-cts-hmac-sha1-96 Addresses: (none) [root at caroline0 PROD
>> ~]# ipa --delegate user-show admin ipa: ERROR: cannot connect to 
>> u'http://caroline0.lafayette.edu/ipa/xml': Internal Server Error 
>> [root at caroline0 PROD ~]#
> 
> Is it the same major/minor error in gss_acquire_cred()?
> 
> Does GSSAPI over LDAP work?
> 
> $ ldapsearch -Y GSSAPI -h ipa.example.com -b 
> cn=users,cn=accounts,dc=example,dc=com admin
> 
This appears to work.

[root at caroline0 PROD ~]# ldapsearch -Y GSSAPI -h
caroline0.lafayette.edu -b
cn=users,cn=accounts,dc=systems,dc=lafayette,dc=edu admin
SASL/GSSAPI authentication started
SASL username: lagern at SYSTEMS.LAFAYETTE.EDU
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=users,cn=accounts,dc=systems,dc=lafayette,dc=edu> with
scope subtree
# filter: (objectclass=*)
# requesting: admin
#

# users, accounts, systems.lafayette.edu
dn: cn=users,cn=accounts,dc=systems,dc=lafayette,dc=edu

# admin, users, accounts, systems.lafayette.edu
dn: uid=admin,cn=users,cn=accounts,dc=systems,dc=lafayette,dc=edu

<-- a bunch of other users here -->

# search result
search: 4
result: 0 Success

# numResponses: 10
# numEntries: 9

> rob
> 
> 

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Nathan Lager, RHCSA, RHCE (#110-011-426)
System Administrator
11 Pardee Hall
Lafayette College, Easton, PA 18042