<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> </head> <body bgcolor="#ffffff" text="#000000"> I had this same issue and eventually figured out I'd installed the x86_64 version of ipa_client but the i386 version of cyrus-sasl-gssapi. You can check this by issuing the following command: rpm -qa --qf "%{n}-%{v}-%{r}.%{arch}\n"|grep gss Hopefully that helps! Jem <pre style="margin: 0em;">Ivan Levchenko wrote: </pre> <blockquote style="border-left: 0.2em solid rgb(85, 85, 238); margin: 0em; padding-left: 0.85em;"> <pre style="margin: 0em;">On Mon, Sep 29, 2008 at 5:55 PM, Rob Crittenden <rcritten redhat com> wrote: </pre> <blockquote style="border-left: 0.2em solid rgb(85, 85, 238); margin: 0em; padding-left: 0.85em;"> <pre style="margin: 0em;">Did you have a kerberos ticket before running ipa-getkeytab? You need to do a kinit before running this. </pre> </blockquote> <pre style="margin: 0em;">Yes, I did kinit for admin, and klist shows that I have a ticket. </pre> <blockquote style="border-left: 0.2em solid rgb(85, 85, 238); margin: 0em; padding-left: 0.85em;"> <pre style="margin: 0em;">I'm not sure what you mean by "enter them manually" when logging on as an ipa user. </pre> </blockquote> <pre style="margin: 0em;">i.e. when i ssh to the box, it prompts me for a password and authenticates via pam (which checks against the ipa server), and i get logged in successfully using the user that is defined on the ipa server. </pre> </blockquote> <tt>Log into which box? The IPA server or another server? If not the IPA </tt><tt>server, does this other server have a host service principal and has </tt><tt>sshd been restarted? </tt><tt>Using the -v argument with ssh will show you more details on what </tt><tt>authentication methods it is trying. </tt> <blockquote style="border-left: 0.2em solid rgb(85, 85, 238); margin: 0em; padding-left: 0.85em;"> <blockquote style="border-left: 0.2em solid rgb(85, 85, 238); margin: 0em; padding-left: 0.85em;"> <pre style="margin: 0em;">You will want to look on the IPA server in /var/log/krb5kdc.log and/or /var/log/dirsrv/slapd-INSTANCE/error for more information. </pre> </blockquote> <pre style="margin: 0em;">I was just tailing those two files while running the ipa-getkeytab command.. nothing.... also checked any other even remotely relevant log files (messages, secure...) - nothing... </pre> </blockquote> <tt>I'm not sure how that is possible. The error you reported from </tt><tt>ipa-getkeytab is returned if an LDAP GSSAPI bind to the IPA LDAP server </tt><tt>fails. </tt> <pre style="margin: 0em;">You can try a similar operation by doing something like: % ldapsearch -Y GSSAPI -h ipa.freeipa.org -b "dc=freeipa,dc=org" uid=admin rob </pre> </body> </html>