<html><head><style type="text/css"></style></head><body><div style="font-family:Courier New,courier,monaco,monospace,sans-serif;font-size:12pt"><div>That had me thinking that maybe the user was not allowed to access the specific machine. I've gone through the docs a few times, and cannot find where my problem may be. As a a test i created the following file dn: uid=test,cn=users,cn=accounts,dc=mydom,dc=com changetype: modify replace: krbPasswordExpiration krbPasswordExpiration: 20090605194542Z [root@auth01 ~]# ldapmodify -h localhost -xv -D cn="Directory Manager" -W -f /root/testexpire.ldif ldap_initialize( ldap://localhost ) Enter LDAP Password: replace krbPasswordExpiration: 20090605194542Z modifying entry "uid=test,cn=users,cn=accounts,dc=mydom,dc=com" modify complete The test user was now able to login to the server as i had hoped. I ran the 'passwd' command, entered my kerb pass, then picked a new pass. /var/log/messages again said: Jun 4 15:58:40 auth01 kpasswd[18390]: Unable to bind to ldap server Jun 4 15:58:40 auth01 kpasswd[18390]: Server Error while performing LDAP password change what could be going wrong here?? i also tried running kinit, and then changing the passwd with the same results. - Stumped. </div><div style="font-family: Courier New,courier,monaco,monospace,sans-serif; font-size: 12pt;"> <div style="font-family: arial,helvetica,sans-serif; font-size: 13px;"><hr size="1">From: Christian Horn <chorn@fluxcoil.net> To: Dumbo Q <dumboq@yahoo.com> Cc: Simo Sorce <ssorce@redhat.com>; freeipa-users@redhat.com Sent: Thursday, June 4, 2009 12:49:58 PM Subject: Re: [Freeipa-users] Trouble with new installation On Thu, Jun 04, 2009 at 09:36:39AM -0700, Dumbo Q wrote: > I am somewhat confused here. Can someone explain the technical > relationship between kerberos and ldap. I understand the > relationship overview but not so much is going on behind the > scenes. You should read on authorizations vs. authentication, kerberos and ldap basics. Introduction is i.e. here: <a target="_blank" href="http://fluxcoil.net/files/a_sysadmins_guide_to_authentication_and_authorization__chhorn__current.pdf">http://fluxcoil.net/files/a_sysadmins_guide_to_authentication_and_authorization__chhorn__current.pdf</a> Doesnt hurt to have both ldap and kerberos used in separate environments/separated bevore using both from IPA. Debugging both for itself is interesting sometimes ;) Christian </div></div></div> </body></html>