<html><body>Hi Martin, Good points Web UI Cannot authenticate to Web UI<ul><li type="disc">Make sure that the user can authenticate in CLI, e.g. with kinit $USER --> yes the user can ssh to FreeIPA hosts, and can call kinit without error.<li type="disc">Make sure that httpd, dirsrv and ipa_memcached services on the affected FreeIPA server are running. --> httpd, slapd and memcached all running (proved by pgrep -l)<li type="disc">Make sure there are no related <a href="http://selinuxproject.org/page/NB_AL">SELinux AVCs</a> -- SELinux is disabled<li type="disc">Make sure that cookies are enabled on the client browser --> enabled<li type="disc">Make sure that the time on the FreeIPA server is up to date and there is no (significant) clock skew (<a href="https://www.redhat.com/archives/freeipa-users/2015-April/msg00605.html">freeipa-users thread</a>) --> no clock skew<li type="disc">Search for any related errors in /var/log/httpd/error_log --> no errors today</ul> Chris <img width="16" height="16" src="cid:1__=8FBBF5DEDFA78F8A8f9e8a93df938690918c8FB@" border="0" alt="Inactive hide details for Martin Kosek ---02.02.2016 09:53:11---On 02/02/2016 09:49 AM, Christopher Lamb wrote: >">Martin Kosek ---02.02.2016 09:53:11---On 02/02/2016 09:49 AM, Christopher Lamb wrote: > From: Martin Kosek <mkosek@redhat.com> To: Christopher Lamb/Switzerland/IBM@IBMCH, freeipa-users@redhat.com Cc: Alexander Bokovoy <abokovoy@redhat.com> Date: 02.02.2016 09:53 Subject: Re: [Freeipa-users] Fw: [Centos7.2 Freeipa 4.2] browser : your session has expired <hr width="100%" size="2" align="left" noshade style="color:#8091A5; "> <tt>On 02/02/2016 09:49 AM, Christopher Lamb wrote: > > > Sorry, Notes is playing up, and sent the last before I could type any text! > > The POST /ipa/session/login_password is successful. > > but the POST /ipa/session/json and GET /ipa/session/login_kerberos both > give 401 unathorized > > Chris Just to make sure we have covered all possible pit holes we have already gathered on our Troubleshooting page, did check all the advise in this list </tt><tt><a href="http://www.freeipa.org/page/Troubleshooting#Cannot_authenticate_to_Web_UI">http://www.freeipa.org/page/Troubleshooting#Cannot_authenticate_to_Web_UI</a></tt><tt> ? </tt> </body></html>