<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 01/28/2014 05:29 PM, Steve Severance wrote:
<blockquote
cite="mid:CAC05afEAbvCO8EjyN9GCJVDkxEOb=s+4vPD3_u=iV5DocwjBHg@mail.gmail.com"
type="cite">
<div dir="ltr">Hi Everyone,<br>
<div><br>
</div>
<div>I have deployed freeipa inside our production network. I
want to be able to access the web ui so I am attempting to add
it to our nginx edge machine. I can pass the requests upstream
just fine but I am unable to login using a username/password.
I have enabled password authentication in the kerberos section
of the freeipa httpd config file. In the logs it looks like
the authentication succeeds and a ticket is issued. I assume
that the cookie that is returned (ipa_session) has the
authentication information in it. The subsequent call to get
json data fails and I am prompted to login again.</div>
<div><br>
</div>
<div>I found this thread (<a moz-do-not-send="true"
href="https://www.redhat.com/archives/freeipa-users/2013-August/msg00080.html">https://www.redhat.com/archives/freeipa-users/2013-August/msg00080.html</a>)
which has instructions on adding <a moz-do-not-send="true"
href="http://ipa.mydomain.com">ipa.mydomain.com</a> to the
keytab. When I call ipa-getkeytab it hangs for a bit before
returning: <font face="arial, helvetica, sans-serif"><span
style="color:rgb(51,51,51);font-size:13px;text-align:justify">ldap_sasl_bind(SIMPLE):
Can't contact LDAP server (-1)</span> </font></div>
<div><font face="arial, helvetica, sans-serif"><br>
</font></div>
<div><font face="arial, helvetica, sans-serif">Digging into this
if I run: </font><span
style="color:rgb(51,51,51);font-size:13px;text-align:justify"><font
face="arial, helvetica, sans-serif">ldapsearch -d 1 -v -H
<a class="moz-txt-link-freetext" href="ldaps://">ldaps://</a><a moz-do-not-send="true"
href="http://ldap.mydomain.com">ldap.mydomain.com</a> </font></span></div>
<div><span
style="color:rgb(51,51,51);font-size:13px;text-align:justify"><font
face="arial, helvetica, sans-serif"><br>
</font></span></div>
<div><span
style="color:rgb(51,51,51);font-size:13px;text-align:justify"><font
face="arial, helvetica, sans-serif">I get:</font></span></div>
<div><span style="font-family:arial,helvetica,sans-serif">ldap_sasl_interactive_bind_s:
Unknown authentication method (-6)</span><br>
</div>
<div><font face="arial, helvetica, sans-serif">
<div> additional info: SASL(-4): no mechanism
available:</div>
<div><br>
</div>
<div>So we seem to have a SASL problem. If I run ldapsearch
with -x simple authentication works just fine.</div>
<div><br>
</div>
<div>Do I need to do something special to enable SASL so I
can get the keytab? The ipa-getkeytab command does not
seem to have an option to use simple authentication.</div>
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div>Steve</div>
</font></div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
To be able to help a small diagram would be really helpful.<br>
The error above indicates that there is an entity that tries to
connect to the LDAP using Kerberos GSSAPI and can't because it
either does not have kerberos identity or keys or it is
misconfigured and can't get to them. The diagram of request flow
would help to troubleshoot the issue.<br>
<br>
What version of FreeIPA you are using? What platform? <br>
<br>
<blockquote
cite="mid:CAC05afEAbvCO8EjyN9GCJVDkxEOb=s+4vPD3_u=iV5DocwjBHg@mail.gmail.com"
type="cite">
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>