<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Hello Rob,</span></div><div><span><br></span></div><div><span>Yes, I did the configuration earlier today. And I did kinit too.</span></div><div><span>It seems the web UI loads really slowly - the circular thing can turn for minutes. So maybe I wasn't patient enough to let the page load.</span></div><div><br><span></span></div><div><span>I can ssh to the server and the client from my home, so I don't think there's another firewall blocking the connection.</span></div><div><br><span></span></div><div><span>Thanks,</span></div><div><span>George<br></span></div><div><span></span></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Petr Viktorin <pviktori@redhat.com>; "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, June 18, 2012 11:51 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] is not an IPA v2 Server.<br> </font> </div> <br> george he wrote:<br>> Hello all,<br>> <br>> Here is some other information.<br>> I'm setting this up for a lab in a university. The university has its<br>> own kerberos server (and DNS server, which I use).<br>> I'm not sure whether anybody has set a kerberos server for the<br>> department, or some other labs used the department sub-domain.<br>> But I'm sure the realm name is unique.<br>> <br>> When I open the web UI on the server (firefox 13.0), I almost always get<br>> this error:<br>> Your Kerberos ticket is no longer valid. Please run kinit and then click<br>> 'Retry'. If this is your first time running the IPA Web UI follow these<br>> directions <<a href="https://cns2.psych.yale.edu/ipa/config/unauthorized.html" target="_blank">https://cns2.psych.yale.edu/ipa/config/unauthorized.html</a>> to<br>> configure your browser.<br>> Or you can use form-based authentication<br>> <<a href="https://cns2.psych.yale.edu/ipa/ui/#" target="_blank">https://cns2.psych.yale.edu/ipa/ui/#</a>>.<br>> but I can use the form based authentication sometimes, not always.<br><br>You need to configure the browser to do Kerberos single sign-on. There should be a link in the failure message to take you to a page to help you configure this. You also need to have done a kinit.<br><br>I'm not sure why forms-based auth work work only sometimes, additional details would be needed.<br><br>I'm not sure why the server would be pingable from your client but HTTP doesn't work. There may be another firewall blocking the packets on your network.<br><br>rob<br><br><br> </div> </div> </blockquote></div> </div></body></html>