<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div>I can see this have been discussed a lot here, but I still can't seem to find the correct answer, so bare with me if i'm asking a question already answered.</div><div><br data-mce-bogus="1"></div><div>I'm trying to create a user that can be used for (headless) joining out RHEL clients to IPA</div><div><br data-mce-bogus="1"></div><div>Here is what have been done:</div><div>/etc/krb5.conf and /etc/ipa/ca.crt copied to the client.</div><div><br data-mce-bogus="1"></div><div>a user created on IPA:</div><div><br data-mce-bogus="1"></div><div># ipa user-show joinipa<br> User login: joinipa<br> First name: Host<br> Last name: Adder<br> Home directory: /home/joinipa<br> Login shell: /bin/sh<br> Email address: joinipa@linux.dr.dk<br> UID: 10006<br> GID: 10006<br> Account disabled: False<br> Password: False<br> Member of groups: ipausers<br> Roles: joinipa<br> Kerberos keys available: True</div><div><br data-mce-bogus="1"></div><div>has role joinipa</div><div><br data-mce-bogus="1"></div><div># ipa role-show "joinipa"<br> Role name: joinipa<br> Member users: joinipa<br> Privileges: Host Enrollment</div><div><br data-mce-bogus="1"></div><div>Host Enrollemnt provilege also has the 'System: Add Hosts' permission:</div><div><br data-mce-bogus="1"></div><div># ipa privilege-show "Host Enrollment"<br> Privilege name: Host Enrollment<br> Description: Host Enrollment<br> Permissions: System: Add Hosts, System: Add krbPrincipalName to a Host, System: Enroll a Host, System: Manage Host Certificates,<br> System: Manage Host Enrollment Password, System: Manage Host Keytab<br> Granting privilege to roles: joinipa</div><div><br data-mce-bogus="1"></div><div>Get the keytab from IPA server (run on IPA server):</div><div># ipa-getkeytab -s `hostname` -p joinipa@LINUX.DR.DK -k /tmp/joinipa.keytab</div><div><br data-mce-bogus="1"></div><div>Keytab copied to IPA client:</div><div><br data-mce-bogus="1"></div><div>kinit keytab:</div><div># kinit joinipa@LINUX.DR.DK -kt joinipa.keytab</div><div><br data-mce-bogus="1"></div><div># klist<br>Ticket cache: KEYRING:persistent:0:0<br>Default principal: joinipa@LINUX.DR.DK<br><br>Valid starting Expires Service principal<br>08/11/2016 10:12:33 08/12/2016 10:12:33 krbtgt/LINUX.DR.DK@LINUX.DR.DK</div><div><br data-mce-bogus="1"></div><div>Try to join IPA server:</div><div># ipa-join --server ipa01tst.linux.dr.dk<br>Failed to parse result: Insufficient access rights<br><br>Retrying with pre-4.0 keytab retrieval method...<br>Keytab successfully retrieved and stored in: /etc/krb5.keytab<br>Certificate subject base is: O=LINUX.DR.DK</div><div><br data-mce-bogus="1"></div><div>Host gets created on IPA server, but what makes it fail?</div><div><br data-mce-bogus="1"></div><div>If I try to join again I also get told its already joined:</div><div><br data-mce-bogus="1"></div><div># ipa-join --server ipa01tst.linux.dr.dk<br>Host is already joined.</div><div><br data-mce-bogus="1"></div></div></body></html>