[Freeipa-users] Using different HTTP/ principal for FreeIPA WebUI

[Jan Pazdziora]

Hello,

I'm setting up two FreeIPA replicas with load balancer in front of
them per

	https://www.adelton.com/freeipa/freeipa-behind-load-balancer

Things work when authenticating with login and password.

I then want to enable GSSAPI/Negotiate for the WebUI. For that, I
create host and service for the load balancer (webipa.example.com
and HTTP/webipa.example.com), I add the principal to the
ipa-http-delegation rule via

	ipa servicedelegationrule-add-member ipa-http-delegation --principals=HTTP/webipa.example.com

and I fetch the keytab for the principal on the backend nodes.
When I replace the original /etc/httpd/conf/ipa.keytab file with
the new keytab with just the keys for HTTP/webipa.example.com, I can
authenticate with my Firefox via Kerberos.

However, I'm afraid that by removing the original keys for
HTTP/ipa1.int.example.com (resp.  HTTP/ipa2.int.example.com)
principal from /etc/httpd/conf/ipa.keytab, I might break something,
at least the ability to access those backend machines via GSSAPI
directly (not via the load balancer).

When I add the frontend keys to the original keytab file with ktutil
with

	read_kt /etc/httpd/conf/frontend.keytab
	write_kt /etc/httpd/conf/ipa.keytab
	quit

authentication fails with

	ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Matching credential not found (filename: /var/run/ipa_memcached/krbcc_1222))

When I try to start with the frontend.keytab content by copying it
over to ipa.keytab and append the backend keyts to that file -- then
I can Kerberos-authenticate via the frontend but not with going to the
backend URL directly.

So it looks like only the first principal in the keytab is considered
at whatever stage which fails during the GSSAPI authentication.

Any hints as to how to debug the setup further would be appreciated.
This is with freeipa-server-4.4.4-1.fc25.

Thank you,

-- 
Jan Pazdziora
Senior Principal Software Engineer, Identity Management Engineering, Red Hat