<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 11/11/2011 03:52 PM, Boris Epstein wrote:
<blockquote
cite="mid:CADeF1XHj+0vSAeL7MNO5XTgRuZ6WfQ6K==GmQHyFkh94bNLPaQ@mail.gmail.com"
type="cite">Hello all,
<div><br>
</div>
<div>I've got my FreeIPA seemingly running on a Fedora 16 machine
but I can not log into it from a browser as I get the "Your
kerberos ticket is no longer valid." message. So the question
is: is there a good guide on how to set up the Kerberos
components involved?</div>
</blockquote>
<br>
You will get this error for numerous reasons. If any of the
security mechanisms are not in place, tht is the only error message
that will get through.<br>
<br>
1. You need to accept the CA cert<br>
2. You need to accept the server cert...this will be automatic if
you have the CA cert.<br>
3. You need to configure your browser and accept the config potions
that allow ticket forwarding<br>
<br>
<br>
All this is done by clicking through the options from the link in
the same window as the Kerberos error message you mention.<br>
<br>
<br>
I'f you've been through all this, then the problem is likely that
you do not have Kerberos set up on the machine running the browser,
or you do not have a ticket. Assuming the browser is running on the
IPA server, running kinit will be sufficient.<br>
<br>
<br>
If you installed IPA on a machine that has no X server, and you need
to run the browser on a remote machine to talk to it, please follow
the steps to set up the remote machine as an ipa-client. That will
get the Kerberos ticket set up for you.<br>
<br>
<br>
<blockquote
cite="mid:CADeF1XHj+0vSAeL7MNO5XTgRuZ6WfQ6K==GmQHyFkh94bNLPaQ@mail.gmail.com"
type="cite">
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div>Boris.</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
</body>
</html>