<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Sorry. I'm running the latest one, 4.1.4. </div><div class="gmail_extra"> <div class="gmail_quote">On Fri, Oct 2, 2015 at 3:27 PM, Martin Babinsky <<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 10/02/2015 02:52 PM, Fujisan wrote: </div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"> More info: I can initiate a ticket: $ kdestroy $ kinit admin but cannot view user admin: $ ipa user-show admin ipa: ERROR: cannot connect to '<a href="https://zaira2.opera/ipa/json" rel="noreferrer" target="_blank">https://zaira2.opera/ipa/json</a>': Unauthorized $ ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ipa_memcached Service: RUNNING httpd Service: RUNNING pki-tomcatd Service: RUNNING smb Service: RUNNING winbind Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful /var/log/messages: Oct 2 14:48:55 zaira2 [sssd[ldap_child[4991]]]: Failed to initialize credentials using keytab [MEMORY:/etc/krb5.keytab]: Decrypt integrity check failed. Unable to create GSSAPI-encrypted LDAP connection. On Fri, Oct 2, 2015 at 2:26 PM, Fujisan <<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a> </div></div> <mailto:<a href="mailto:fujisan43@gmail.com" target="_blank">fujisan43@gmail.com</a>>> wrote: Hello, I cannot login to the web UI anymore. The password or username you entered is incorrect. Log says: Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): AS_REQ (9 etypes {18 17 16 23 25 26 1 3 2}) 10.0.21.18 <<a href="http://10.0.21.18" rel="noreferrer" target="_blank">http://10.0.21.18</a>>: NEEDED_PREAUTH: HTTP/zaira2.opera@OPERA for krbtgt/OPERA@OPERA, Additional pre-authentication required Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): closing down fd 12 Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): AS_REQ (9 etypes {18 17 16 23 25 26 1 3 2}) 10.0.21.18 <<a href="http://10.0.21.18" rel="noreferrer" target="_blank">http://10.0.21.18</a>>: PREAUTH_FAILED: HTTP/zaira2.opera@OPERA for krbtgt/OPERA@OPERA, Decrypt integrity check failed Oct 02 14:22:57 zaira2.opera krb5kdc[3225](info): closing down fd 12 I have no idea what went wrong. What can I do? Regards, Fuji </blockquote> What version of FreeIPA are you running? -- Martin^3 Babinsky </blockquote></div> </div></div>