<div dir="ltr">Hi Dmitri,<div><br></div><div>I am using Free Ipa 3.1.5 on Fedora 18. The design basically looks like the following. All of this is hosted at AWS in our VPC. The nginx</div><div class="gmail_extra"> box is on a web addressable subnet while the FreeIPA box is on a private subnet that is not internet accessible. My goal is to be able to use the web UI from our office without having to invest in a hardware VPN connection. So nginx basically just acts as a reverse proxy and created the connection on the users behalf to the ipa server. I can login into other machines I have both in our private data center and in AWS using ipa and that works great as far as I can tell.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Any more information I can supply? Thanks.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Steve<br><br><div class="gmail_quote">On Wed, Jan 29, 2014 at 4:18 AM, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div><div class="h5">
On 01/28/2014 05:29 PM, Steve Severance wrote:
<blockquote type="cite">
<div dir="ltr">Hi Everyone,<br>
<div><br>
</div>
<div>I have deployed freeipa inside our production network. I
want to be able to access the web ui so I am attempting to add
it to our nginx edge machine. I can pass the requests upstream
just fine but I am unable to login using a username/password.
I have enabled password authentication in the kerberos section
of the freeipa httpd config file. In the logs it looks like
the authentication succeeds and a ticket is issued. I assume
that the cookie that is returned (ipa_session) has the
authentication information in it. The subsequent call to get
json data fails and I am prompted to login again.</div>
<div><br>
</div>
<div>I found this thread (<a href="https://www.redhat.com/archives/freeipa-users/2013-August/msg00080.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2013-August/msg00080.html</a>)
which has instructions on adding <a href="http://ipa.mydomain.com" target="_blank">ipa.mydomain.com</a> to the
keytab. When I call ipa-getkeytab it hangs for a bit before
returning: <font face="arial, helvetica, sans-serif"><span style="color:rgb(51,51,51);font-size:13px;text-align:justify">ldap_sasl_bind(SIMPLE):
Can't contact LDAP server (-1)</span> </font></div>
<div><font face="arial, helvetica, sans-serif"><br>
</font></div>
<div><font face="arial, helvetica, sans-serif">Digging into this
if I run: </font><span style="color:rgb(51,51,51);font-size:13px;text-align:justify"><font face="arial, helvetica, sans-serif">ldapsearch -d 1 -v -H
<a>ldaps://</a><a href="http://ldap.mydomain.com" target="_blank">ldap.mydomain.com</a> </font></span></div>
<div><span style="color:rgb(51,51,51);font-size:13px;text-align:justify"><font face="arial, helvetica, sans-serif"><br>
</font></span></div>
<div><span style="color:rgb(51,51,51);font-size:13px;text-align:justify"><font face="arial, helvetica, sans-serif">I get:</font></span></div>
<div><span style="font-family:arial,helvetica,sans-serif">ldap_sasl_interactive_bind_s:
Unknown authentication method (-6)</span><br>
</div>
<div><font face="arial, helvetica, sans-serif">
<div> additional info: SASL(-4): no mechanism
available:</div>
<div><br>
</div>
<div>So we seem to have a SASL problem. If I run ldapsearch
with -x simple authentication works just fine.</div>
<div><br>
</div>
<div>Do I need to do something special to enable SASL so I
can get the keytab? The ipa-getkeytab command does not
seem to have an option to use simple authentication.</div>
<div><br>
</div>
<div>Thanks.</div>
<div><br>
</div>
<div>Steve</div>
</font></div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
<br></div></div>
To be able to help a small diagram would be really helpful.<br>
The error above indicates that there is an entity that tries to
connect to the LDAP using Kerberos GSSAPI and can't because it
either does not have kerberos identity or keys or it is
misconfigured and can't get to them. The diagram of request flow
would help to troubleshoot the issue.<br>
<br>
What version of FreeIPA you are using? What platform? <br><div class="im">
<br>
<blockquote type="cite">
<pre>_______________________________________________
Freeipa-users mailing list
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
</div><span class="HOEnZb"><font color="#888888"><pre cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a href="http://www.redhat.com/carveoutcosts/" target="_blank">www.redhat.com/carveoutcosts/</a>
</pre>
</font></span></div>
<br>_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br></blockquote></div><div><br></div>
</div></div>