[Freeipa-users] IPA versions for small scale hope-to-be-production use on CentOS 7?

[List dedicated to discussions about use, configuration and deployment of the IPA server.]

On Tue, Dec 06, 2016 at 11:45:18AM -0500, List dedicated to discussions about use, configuration and deployment of the IPA server. wrote:
> 
> It's certainly some sort of TGT ticket issue; I just need to find the proper
> bits of log to sanitize and post back to this list. I'll do that under
> another thread though to keep this one clean. Trying to figure out if
> upgrading to 4.3 or even 4.4 would be "wise" on a CentOS-7 system we hope to
> put into production once the password checking problem is resolved for SSH
> users.

I would prefer to look at the sanitize krb5_child.log file first before
saying if updating might help or not. There is one case related to
enterprise principal and alternative domain suffixes on the AD side
where updating to 4.4 would help. But there are other cases related to
ticket validation where updating won't help at all.

bye,
Sumit

> 
> List dedicated to discussions about use, configuration and deployment of the
> IPA server. wrote:
> > In the latter case it might be some general issue with password
> > authentication and the krb5_child.log file with debug_level=10 in the
> > [domain/...] section of sssd.conf might help to find the reason (maybe
> > ticket validation?).
> 
> -- 
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project