<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 11/07/2013 12:59 PM, Dean Hunter wrote: <blockquote cite="mid:1383847188.19912.44.camel@host.hunter.org" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="GENERATOR" content="GtkHTML/4.6.6"> On Thu, 2013-11-07 at 12:36 -0500, Dmitri Pal wrote: <blockquote type="CITE"> On 11/07/2013 12:21 PM, Dean Hunter wrote: <blockquote type="CITE"> On Thu, 2013-11-07 at 09:44 +0200, Alexander Bokovoy wrote: <blockquote type="CITE"> <pre>On Wed, 06 Nov 2013, Dean Hunter wrote: >After building a new VM and configuring the IPA 3.3.2 client, Gnome >seems to only perform a local log-in until the system is rebooted. SSH >works with IPA, but not Gnome. Is this correct? Is there anything less >disruptive than a reboot that I can do? </pre> </blockquote> <blockquote type="CITE"> <pre>Restart gdm.service? I'm not sure how gdm handles PAM auth. </pre> </blockquote> I have tried: <blockquote> <tt>ipa-client-install ...</tt> <tt>systemctl restart gdm.service</tt> </blockquote> but the behavior remains the same. The Gnome log in screen accepts the user name, pauses about 25 seconds, then displays the log in screen again without any messages or indication of a problem. This is the same behavior I see when entering an incorrect local user name before configuring IPA. <pre>_______________________________________________ Freeipa-users mailing list <a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </pre> </blockquote> Can it be a DIR cache issue and the fact that the directory can't is not created at proper time? </blockquote> Which directory, please? </blockquote> If you are hitting the DIR cache issue (which I am not sure is the case this is why I asked about AVCs) then the directory we are talking about is /var/run/usr/<uid> This directory should be created by kerberos library when it tries to authenticate a user. But it might not be able to since a parent directory /var/run/usr might not be created yet. This is one of the reasons why we decided not to continue the path of DIR cache but switched to using Kernel based ccache. <blockquote cite="mid:1383847188.19912.44.camel@host.hunter.org" type="cite"> <blockquote type="CITE"> Do you see any AVCs? </blockquote> </blockquote> Question still stands. <blockquote cite="mid:1383847188.19912.44.camel@host.hunter.org" type="cite"> <blockquote type="CITE"> <pre>-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a moz-do-not-send="true" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> _______________________________________________ Freeipa-users mailing list <a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </pre> </blockquote> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>