<div dir="ltr">The ldap/serverB keytab was renewed with the ipa-getkeytab command, but not put into place. Since the existing keytab in /etc/dirsrv/ds.keytab was no longer valid, replication stopped. I've since exported it a couple more times from each of the servers in an attempt to get it working again, but none of the keytabs work. I can, however, auth to the kerberos server using the latest keytab file using kinit -kt /etc/dirsrv/ds.keytab ldap/serverB. I've verified permissions on the keytab file. <div>
<br></div><div>Now, when I attempt to start replication, it gives me this in the error log ...</div><div><br></div><div><div>[20/Nov/2013:16:29:40 -0400] set_krb5_creds - Could not get initial credentials for principal [ldap/<a href="mailto:en5013.dev.ca1.sfmc.co@SFMC.CO">en5013.dev.ca1.sfmc.co@SFMC.CO</a>] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328174 (Generic preauthentication failure)</div>
<div>[20/Nov/2013:16:29:40 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_497' not found)) errno 0 (Success)</div>
<div>[20/Nov/2013:16:29:40 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: error -2 (Local error)</div><div>[20/Nov/2013:16:29:40 -0400] NSMMReplicationPlugin - agmt="cn=<a href="http://meTodv5002-en1.dev.ca1.sfmc.co">meTodv5002-en1.dev.ca1.sfmc.co</a>" (dv5002-en1:389): Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_497' not found))</div>
</div><div><br></div><div>Over and over and over again. I can auth to the server with a standard bind, but GSSAPI auth will not function.</div><div><br></div><div>I've even attempted to su to the dirsrv user and run a kinit using the ds.keytab file and setting the cache to /tmp/krb5cc_497, but it just compplains that the permissions on the cache credentials file are incorrect.</div>
<div><br></div><div>I've also attempted to remove the replica from the working server, but I get an authentication error when it attempts to contact the non-functional server ..</div><div><br></div><div><div># ipa-replica-manage del <a href="http://en5013.dev.ca1.sfmc.co">en5013.dev.ca1.sfmc.co</a></div>
<div>Connection to '<a href="http://en5013.dev.ca1.sfmc.co">en5013.dev.ca1.sfmc.co</a>' failed: Invalid credentials SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown error)</div>
<div>Unable to delete replica '<a href="http://en5013.dev.ca1.sfmc.co">en5013.dev.ca1.sfmc.co</a>'</div></div><div><br></div><div><br></div><div>Terry</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Nov 20, 2013 at 4:21 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">Terry Soucy wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I have the keytab with the oldest version number shown in the kvno<br>
command, but when I put that into place, I get no joy.<br>
</blockquote>
<br></div>
A lot more details are required. Did you change or renew the keytab? Did it suddenly stop working, and when?<br>
<br>
Logs? /var/log/dirsrv/slapd-REALM/<u></u>error and access. /var/log/krb5kdc.log.<br>
<br>
rob<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<br>
Terry<br>
<br>
<br>
On Wed, Nov 20, 2013 at 4:05 PM, Terry Soucy <<a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a><br></div><div class="im">
<mailto:<a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a>><u></u>> wrote:<br>
<br>
The service principal ldap/serverB was exported but not put into<br>
place at /etc/dirsrv/ds.keytab. Replication started failing, dns<br>
couldn't connect, the work generally started coming to an end. I've<br>
re-exported the service principal to a keytab file. If I export from<br>
serverA using the ipa-getkeytab file, I get one version number. If I<br>
export from server B, I get an older version number. When I use the<br>
kvno command, I get an even older number.<br>
<br>
Terry<br>
<br>
<br>
On Wed, Nov 20, 2013 at 3:56 PM, Rich Megginson <<a href="mailto:rmeggins@redhat.com" target="_blank">rmeggins@redhat.com</a><br></div><div class="im">
<mailto:<a href="mailto:rmeggins@redhat.com" target="_blank">rmeggins@redhat.com</a>>> wrote:<br>
<br>
On 11/20/2013 12:37 PM, Terry Soucy wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I am currently having the following issue.<br>
<br>
Running Redhat IPA on RHEL6.3 (ipa-server-3.0.0.25) in a basic<br>
two server multimaster setup.<br>
<br>
Servers A is running fine, but Server B is out of sync. More<br>
specifically, the ldap service principal is out of sync<br>
between the two servers, which is leading to no replication,<br>
etc, etc. I need to sync the ldap/serverB service principal on<br>
Server A with the ldap/serverB service principal on Server B.<br>
Is there a way to do that, or am I looking at a re-init of<br>
server B?<br>
</blockquote>
<br>
I'm not sure what you mean by "the ldap service principal is out<br>
of sync between the two servers"?<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
<br>
Terry<br>
<br>
--<br>
Terry Soucy - Systems Engineer<br>
Salesforce MarketingCloud - <a href="http://www.salesforce.com" target="_blank">http://www.salesforce.com</a><br></div>
(o) <a href="tel:506.631.7445" value="+15066317445" target="_blank">506.631.7445</a> <tel:<a href="tel:506.631.7445" value="+15066317445" target="_blank">506.631.7445</a>> (c) <a href="tel:506.609.3247" value="+15066093247" target="_blank">506.609.3247</a><br>
<tel:<a href="tel:506.609.3247" value="+15066093247" target="_blank">506.609.3247</a>> | (e) <a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a><br>
<mailto:<a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a>><br>
<br>
<br>
______________________________<u></u>_________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.<u></u>com</a>><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br>
</blockquote><div class="im">
<br>
<br>
<br>
<br>
--<br>
Terry Soucy - Systems Engineer<br>
Salesforce MarketingCloud - <a href="http://www.salesforce.com" target="_blank">http://www.salesforce.com</a><br></div>
(o) <a href="tel:506.631.7445" value="+15066317445" target="_blank">506.631.7445</a> <tel:<a href="tel:506.631.7445" value="+15066317445" target="_blank">506.631.7445</a>> (c) <a href="tel:506.609.3247" value="+15066093247" target="_blank">506.609.3247</a><br>
<tel:<a href="tel:506.609.3247" value="+15066093247" target="_blank">506.609.3247</a>> | (e) <a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a><br>
<mailto:<a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a>><div class="im"><br>
<br>
<br>
<br>
<br>
--<br>
Terry Soucy - Systems Engineer<br>
Salesforce MarketingCloud - <a href="http://www.salesforce.com" target="_blank">http://www.salesforce.com</a><br>
(o) <a href="tel:506.631.7445" value="+15066317445" target="_blank">506.631.7445</a> (c) <a href="tel:506.609.3247" value="+15066093247" target="_blank">506.609.3247</a> | (e) <a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a><br>
</div>
<mailto:<a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a>><div class="im"><br>
<br>
<br>
______________________________<u></u>_________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br>
<br>
</div></blockquote>
<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Terry Soucy - Systems Engineer<br>Salesforce MarketingCloud - <a href="http://www.salesforce.com" target="_blank">http://www.salesforce.com</a><br>
(o) 506.631.7445 (c) 506.609.3247 | (e) <a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a></div>
</div>