<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">This fixed in. That makes perfect sense, but nothing in the log made me think that this was the problem.<div><br></div><div>There was an auth_to_local rule setup, which I saved, which did not work. Is this a bug that we need to open a ticket for? Seems like installer is putting an inadequate regular expression in the rule.</div><div><br></div><div>Thanks!</div><div>Brian</div><div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br></div></span>
</div>
<br><div><div>On Feb 18, 2013, at 7:35 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Brian Cook wrote:<br><blockquote type="cite">More info - attached var/log/secure, and sshd_config.<br><br>Password authentication works, just gssapi fails. in the securecrt provided I have disabled password auth as an option<br></blockquote><br>Create a .k5login in the home directory of your user. What I did was log in as <a href="mailto:Administratory@AD.EXAMPLE.COM">Administratory@AD.EXAMPLE.COM</a> using the password, create .k5login containing that principal, log out, then I was able to log back in using SSO.<br><br>You should be able to add something like this to /etc/krb5.conf if you have a lot of users you want to do SSO:<br><br> auth_to_local = RULE:[1:$1@$0](^.*@TRUSTED.DOMAIN$)<a href="mailto:s/@TRUSTED.DOMAIN">s/@TRUSTED.DOMAIN</a>/@trusted.domain/<br> auth_to_local = DEFAULT<br><br>See 'info krb5-admin "Configuration Files" "krb5.conf" "realms (krb5.conf)"' for more details and examples for auth_to_local.<br><br>rob<br><br><blockquote type="cite"><br><br><br><br><br><br><br>On Feb 18, 2013, at 3:58 PM, Brian Cook <<a href="mailto:bcook@redhat.com">bcook@redhat.com</a>> wrote:<br><br><blockquote type="cite">I am trying to ssh from Windows - > IPA server using GSS-API. I've tried putty, which provides very little debug out. I then downloaded securecrt which provides more output.<br><br>On the server side, I just see postponed gss-with-mic and then a failure message. I'm attaching the output from securecrt. Any help would be greatly appreciated.<br><br>Thanks,<br>Brian<br><br><securecrt-out.rtf>_______________________________________________<br>Freeipa-users mailing list<br><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>https://www.redhat.com/mailman/listinfo/freeipa-users<br></blockquote><br><br><br>_______________________________________________<br>Freeipa-users mailing list<br><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>https://www.redhat.com/mailman/listinfo/freeipa-users<br><br></blockquote><br></blockquote></div><br></div></body></html>