<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'> <hr id="zwchr"><blockquote id="DWT1410" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px; color: rgb(0, 0, 0); font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;">From: "Dmitri Pal" <dpal@redhat.com> To: freeipa-users@redhat.com Sent: Thursday, 25 July, 2013 11:35:32 PM Subject: Re: [Freeipa-users] still failing to get a RHEL 5 client to join, LDAP bind issue? On 07/25/2013 03:51 PM, Armstrong, Kenneth Lawrence wrote: <blockquote cite="mid:1374781887.4302.15.camel@localhost.localdomain"> I am still having issues trying to get a RHEL 5.9 client to join a RHEL 6.4 IdM domain. All packages on both systems updated. First problem is this: ipa-client-install --server lnxrealmtest01.liberty.edu --domain lnxrealmtest.liberty.edu --enable-dns-updates Which fails with: root : ERROR Cannot obtain CA certificate '<a class="moz-txt-link-freetext">ldap://lnxrealmtest01.liberty.edu</a>' doesn't have a certificate. Installation failed. Rolling back changes. IPA client is not configured on this system. All of the appropriate ports are open on the IdM server, and I verified this by telnetting to all of them. I worked around this by running this: wget -O /etc/ipa/ca.crt <a href="http://lnxrealmtest01.liberty.edu/ipa/config/ca.crt" target="_blank"> http://lnxrealmtest01.liberty.edu/ipa/config/ca.crt</a> Then ran: ipa-client-install --server lnxrealmtest01.lnxrealmtest.liberty.edu --domain lnxrealmtest.liberty.edu --enable-dns-updates --no-ntp --ca-cert-file=/etc/ipa/ca.crt And I was having better results, so apparently the RHEL 5.9 ipa-client-install does not want to download my cert. </blockquote> This rings the bell. It sounds like a known issue for 5.9 openssl libraries. Rob can you add details please? <blockquote id="DWT1409" cite="mid:1374781887.4302.15.camel@localhost.localdomain"> On to the next problem: User authorized to enroll computers: admin Synchronizing time with KDC... Password for <a href="mailto:admin@LNXREALMTEST.LIBERTY.EDU" target="_blank">admin@LNXREALMTEST.LIBERTY.EDU</a>: Joining realm failed: SASL Bind failed Local error (-2) ! child exited with 9 Installation failed. Rolling back changes. </blockquote> </blockquote>Run ipa-client-install with "-d" debug flag to get more information. I've had the same issue due to DNS reverse for the server not being correct (check the krb log in the server) <blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px; color: rgb(0, 0, 0); font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><blockquote cite="mid:1374781887.4302.15.camel@localhost.localdomain"> It is the same user that I use to login to the web interface, and I am 100% positive that I am not entering the password incorrectly. So why else would the admin user not be able to bind to my IdM setup? -Kenny <fieldset class="mimeAttachmentHeader"></fieldset> <pre>_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/" target="_blank">www.redhat.com/carveoutcosts/</a> </pre> _______________________________________________ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users</blockquote> -- <div>Eduardo Mínguez Pérez Infrastructure Consultant (RHCE, RHCSA) Red Hat - Spain Mobile: +34 629803049 (CET/CEST) E-mail: eminguez@redhat.com </div></div></body></html>