<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Arial; font-size: 12pt; color: #000000'><font class="Apple-style-span" face="Arial" style="font-size: 12pt; color: rgb(0, 0, 0); ">Hello</font><div style="font-family: Arial; font-size: 12pt; color: rgb(0, 0, 0); "><br></div><div style="font-family: Arial; color: rgb(0, 0, 0); "><font class="Apple-style-span" size="2">Just try to add Scientific Linux 6 (RHEL 6) into the freeipa. Sorry to say that but after reading a lot of the documentation I found that the most of it is obselete or just wrong. For Sample:</font></div><div style="font-family: Arial; font-size: 12pt; color: rgb(0, 0, 0); "><meta http-equiv="content-type" content="text/html; charset=utf-8">in <a href="http://freeipa.org/docs/2.0.0/Client_Setup_Guide/en-US/html/#chap-Client_Configuration_Guide-Configuring_Fedora_as_an_IPA_Client">http://freeipa.org/docs/2.0.0/Client_Setup_Guide/en-US/html/#chap-Client_Configurat
ion_Guide-Configuring_Fedora_as_an_IPA_Client</a></div><div style="color: rgb(0, 0, 0); "><font class="Apple-style-span" face="Arial" size="2">the command: </font><span class="Apple-style-span" style="font-family: 'liberation mono', 'bitstream vera mono', 'dejavu mono', monospace; font-size: 12px; font-weight: bold; line-height: 15px; white-space: nowrap; ">ipa-addservice </span><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap; "><font class="Apple-style-span" face="arial, helvetica, sans-serif" size="2">is nowhere avialable. </font></span></div><div style="color: rgb(0, 0, 0); "><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap; "><font class="Apple-style-span" face="arial, helvetica, sans-serif" size="2"><br></font></span></div><div style="color: rgb(0, 0, 0); "><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap; "><font class="Apple-style-span" face="arial, helvetica, sans-serif" si
ze="2">Currently I try to get a keytab file for the afs service made via web interface using:</font></span></div><div style="color: rgb(0, 0, 0); "><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap; "><font class="Apple-style-span" face="arial, helvetica, sans-serif" size="2"><br></font></span></div><div><font class="Apple-style-span" face="arial, helvetica, sans-serif" size="2"><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap;">ipa-getkeytab -s freeipa.[domain] -p afs/afs.[domain]@[REALM] -k /tmp/afs.keytab</span></font></div><div><font class="Apple-style-span" face="arial, helvetica, sans-serif" size="2"><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap;">all I get is: </span></font>Operation failed! unsupported extended operation</div><div>Note: Replaced the original domain and realm with placeholders.</div><div><br></div><div>The client is: ipa-client-2.0-9.el6.i686</div><div>The
server is: freeipa-server-2.0.0.rc3-0.fc14.i686</div><div><br></div><div>First, I had to made the kerberos principal key for host and afs-service by hand on command line. Why?</div><div>Second why can I not get this key out of the web interface to add it to the afs service? I can only see the option to delete this key in the section services. The ipa-getkeytab also fails (see above)</div><div>Third: The documentation contains no section to add a RHEL6/SL client to free ipa. Why?</div><div>Fourth: The default principal set to kadmin is wrong, its set to admin/admin@REALM instead of admin@REALM (seems to be wrong on all kerberos implementations)</div><div>Fifth: Running ipa-client-install works only with the </div><div>_ldap._tcp.[Domain] SRV 10 10 389 [server]</div><div><div>_kerberos._tcp.[Domain] SRV 0 0 88 [server]</div></div><div>in the dns zone.</div><div>The informations in: <a href="http:
//freeipa.org/page/DNS_Location_Discovery">http://freeipa.org/page/DNS_Location_Discovery</a> are completely wrong. The entries for _ldap and _kerberos are not related to <span class="Apple-style-span" style="color: rgb(85, 85, 85); font-family: monospace; white-space: pre; ">_network </span>which not even exist in bind9 they are related to a domain/zone.</div><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div>Sixth: the ipa-client install doesn't generate a keytab file for the host principal and does not extract the ca cert from the ipa server for the ldap communication with the server.</div><div><br></div><div>Looks all really confusing to me. </div><div><font class="Apple-style-span" face="arial, helvetica, sans-serif" size="2"><span class="Apple-style-span" style="line-height: 15px; white-space: nowrap;
">So whats the correct steps to add a freeipa 2.0 client and a service such as nfs/afs/smb etc. to a freeipa 2.0 server on Fedora 14?</span></font></div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="font-family: Arial; font-size: 12pt; color: rgb(0, 0, 0); "><br></div><div style="font-family: Arial; font-size: 12pt; color: rgb(0, 0, 0); "><div>Regards</div><div><br></div><div>Roland</div><div><br></div><div><br></div><div><br></div><span><font size="2">------------------------------------------------------------------------------------------------------------------------------<br>Diejenigen, die ihre Freiheit zugunsten der Sicherheit aufgeben, <br>werden am Ende keines von beiden haben - und verdienen es auch nicht. <br>(Benjamin Franklin) </font><font size="2"><br>------------------------------------------------------------------------------------------------------------------------------</font><span name="x"></span><br></span></div></div></
body></html>