<div dir="ltr"><div class="gmail_extra"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div style="background-color:rgb(255,255,255)"><div><div>IPA Server 1 do not have HTTP as well as ldap principal. Just wondering how do we add HTTP and ldap principal to the delegation list using ldapmodify.</div><div> </div><div>I'm new to IPA, your help is appreciated. </div></div></div></div></div></div></div> <div class="gmail_quote">On Wed, Aug 24, 2016 at 4:32 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Linov Suresh wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Look like our issue is discussed here, and *is **missing one or more memberPrincipal*. <a href="https://www.redhat.com/archives/freeipa-users/2013-April/msg00228.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2013-April/msg00228.html</a> When I tried to add the Principal, I'm getting error, </blockquote> You didn't follow the instructions in the e-mail thread. The problem isn't a principal that doesn't exist, it is a principal not in the delegation list. Do the ldapsearch's and see what is missing (and you'll need to use -Y GSSAPI instead of -x) then add it using ldapmodify. Only under very specific circumstances would I ever recommend using kadmin.local. rob <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> [root@ipa01 ~]# kadmin.local Authenticating as principal admin/<a href="mailto:admin@TELOIP.NET" target="_blank">admin@TELOIP.NET</a> <mailto:<a href="mailto:admin@TELOIP.NET" target="_blank">admin@TELOIP.NET</a>> with password. kadmin.local: addprinc -randkey HTTP/<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a>> WARNING: no policy specified for HTTP/<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a>>; defaulting to no policy add_principal: Principal or policy already exists while creating "HTTP/<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a>>" [root@ipa01 ~]# kadmin.local Authenticating as principal admin/<a href="mailto:admin@TELOIP.NET" target="_blank">admin@TELOIP.NET</a> <mailto:<a href="mailto:admin@TELOIP.NET" target="_blank">admin@TELOIP.NET</a>> with password. kadmin.local: addprinc -randkey ldap/<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a>> WARNING: no policy specified for ldap/<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a>>; defaulting to no policy add_principal: Principal or policy already exists while creating "ldap/<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:ipa02.teloip.net@TELOIP.NET" target="_blank">ipa02.teloip.net@TELOIP.NET</a>>". Could you please help us to fix the "*KDC returned error string: NOT_ALLOWED_TO_DELEGATE*" error? [root@caer ~]# kadmin.local Authenticating as principal admin/<a href="mailto:admin@TELOIP.NET" target="_blank">admin@TELOIP.NET</a> <mailto:<a href="mailto:admin@TELOIP.NET" target="_blank">admin@TELOIP.NET</a>> with password. kadmin.local: addprinc -randkey HTTP/<a href="mailto:neit.teloip.net@TELOIP.NET" target="_blank">neit.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:neit.teloip.net@TELOIP.NET" target="_blank">neit.teloip.net@TELOIP.NET</a>> WARNING: no policy specified for HTTP/<a href="mailto:neit.teloip.net@TELOIP.NET" target="_blank">neit.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:neit.teloip.net@TELOIP.NET" target="_blank">neit.teloip.net@TELOIP.NET</a>>; defaulting to no policy add_principal: Principal or policy already exists while creating "HTTP/<a href="mailto:neit.teloip.net@TELOIP.NET" target="_blank">neit.teloip.net@TELOIP.NET</a> <mailto:<a href="mailto:neit.teloip.net@TELOIP.NET" target="_blank">neit.teloip.net@TELOIP.NET</a>>" On Tue, Aug 16, 2016 at 7:58 AM, Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a> <mailto:<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>> wrote: On 08/16/2016 09:25 AM, Petr Spacek wrote: > On 15.8.2016 20:18, Linov Suresh wrote: >> We have IPA replica set up in RHEL 6.4 and is FreeIPA 3.0.0 >> >> >> We can only add the clients from IPA Server 01, not from IPA Server 02. >> When I tried to add the client from IPA Server 02, getting the error, >> >> >> ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI Error: >> Unspecified GSS failure. Minor code may provide more information (KDC >> returned error string: NOT_ALLOWED_TO_DELEGATE) >> >> SASL/GSSAPI authentication started >> >> SASL <a href="mailto:username%3Avpham@EXAMPLE.NET" target="_blank">username:vpham@EXAMPLE.NET</a> <mailto:<a href="mailto:vpham@EXAMPLE.NET" target="_blank">vpham@EXAMPLE.NET</a>> >> >> SASL SSF: 56 >> >> SASL data security layer installed. >> >> ldap_modify: No such object (32) >> >> additional info: Range Check error >> >> modifying entry "fqdn=<a href="http://cpe-5061747522f9.example.net" rel="noreferrer" target="_blank">cpe-5061747522f9.example.net</a> <<a href="http://cpe-5061747522f9.example.net" rel="noreferrer" target="_blank">http://cpe-5061747522f9.example.net</a>> >> ,cn=computers,cn=accounts,dc=example,dc=net" >> >> >> Could you please help us to fix this? > > We need to see exact steps you did before we can give you any meaningful advice. > > Please have a look at > <a href="http://www.chiark.greenend.org.uk/~sgtatham/bugs.html" rel="noreferrer" target="_blank">http://www.chiark.greenend.org.uk/~sgtatham/bugs.html</a> <<a href="http://www.chiark.greenend.org.uk/~sgtatham/bugs.html" rel="noreferrer" target="_blank">http://www.chiark.greenend.org.uk/~sgtatham/bugs.html</a>> > > It is a very nice document which describes general bug reporting procedure and > best practices. > > We will certainly have a look but we need first see the information :-) > Also, using IPA on RHEL-6.4 is discouraged. This is a really old release and there are known issues (in cert renewals for example). Using at least RHEL-6.8 or, even better, RHEL-7.2 is preferred and would help you avoid known issues and deficiencies (and the newer FreeIPA versions are way cooler anyway). </blockquote> </blockquote></div> </div></div>