<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 05/14/2012 05:09 PM, Chandan Kumar wrote: <blockquote cite="mid:CAD=CKMDvgV=tO289-v9N8Er-eBFfqDd=qT83y-F2wh-s7ALhPw@mail.gmail.com" type="cite">I am a newbie in IPA and was experimenting it on my couple of VMs before considering it for production level. Installation went fine, however, I am getting the kerberos key expiration error at firefox. I am running firefox on the same machine where I have installed/configured ipa-server. On googling and some help in IRC I checked documentation to trouble shoot it as this appear to be a known problem. Moreover, I did follow <a moz-do-not-send="true" href="http://freeipa.org/page/InstallAndDeploy">http://freeipa.org/page/InstallAndDeploy</a> <a moz-do-not-send="true" href="http://freeipa.org/page/TroubleshootingGuide">http://freeipa.org/page/TroubleshootingGuide</a> Fire fox logs 1977841888[7fc789f5b040]: leaving nsAuthGSSAPI::GetNextToken [rv=80004005] -1977841888[7fc789f5b040]: using REQ_DELEGATE -1977841888[7fc789f5b040]: service = <a moz-do-not-send="true" href="http://ipaserver.example.com">ipaserver.example.com</a> -1977841888[7fc789f5b040]: using negotiate-gss -1977841888[7fc789f5b040]: entering nsAuthGSSAPI::nsAuthGSSAPI() -1977841888[7fc789f5b040]: entering nsAuthGSSAPI::Init() -1977841888[7fc789f5b040]: nsHttpNegotiateAuth::GenerateCredentials() [challenge=Negotiate] -1977841888[7fc789f5b040]: entering nsAuthGSSAPI::GetNextToken() -1977841888[7fc789f5b040]: gss_init_sec_context() failed: Unspecified GSS failure. Minor code may provide more information SPNEGO cannot find mechanisms to negotiate -1977841888[7fc789f5b040]: leaving nsAuthGSSAPI::GetNextToken [rv=80004005] [root@ds var]# klist Ticket cache: <a class="moz-txt-link-freetext" href="FILE:/tmp/krb5cc_0">FILE:/tmp/krb5cc_0</a> Default principal: <a moz-do-not-send="true" href="mailto:admin@EXAMPLE.COM">admin@EXAMPLE.COM</a> Valid starting Expires Service principal 05/14/12 13:50:32 05/15/12 13:50:30 krbtgt/<a moz-do-not-send="true" href="mailto:EXAMPLE.COM@EXAMPLE.COM">EXAMPLE.COM@EXAMPLE.COM</a> 05/14/12 13:53:58 05/15/12 13:50:30 HTTP/<a moz-do-not-send="true" href="mailto:ipaserver.example.com@EXAMPLE.COM">ipaserver.example.com@EXAMPLE.COM</a> 05/14/12 13:54:13 05/15/12 13:50:30 ldap/<a moz-do-not-send="true" href="mailto:ipaserver.example.com@EXAMPLE.COM">ipaserver.example.com@EXAMPLE.COM</a> [root@ds var]# Output of ldapsearch -Y GSSAPI -b "dc=example,dc=com" uid=admin at <a moz-do-not-send="true" href="http://fpaste.org/9hXX/">http://fpaste.org/9hXX/</a> I am not sure what I am missing though. Appreciate any help. Thanks Chandan </blockquote> Are you running FF on windows? Which version of IPA are you using? <blockquote cite="mid:CAD=CKMDvgV=tO289-v9N8Er-eBFfqDd=qT83y-F2wh-s7ALhPw@mail.gmail.com" type="cite"> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>