<div dir="ltr">Hello,<div><br></div><div>I would apreciate some help to solve my issue on freeipa configuration.</div><div>I've got two host in my configuration h1, and a replica h2.</div><div>On host h2, everithing is working well.</div><div><br></div><div>On host h1, at the start, everything was working well, but since a few day, I start received error when I login from Web UI interface.</div><div><br></div><div>I I do a curl on the login_password uri, I've got a 500 error:</div><div><div>curl -Lksi --data 'user=admin&password=mypass' <a href="https://h1.clae.net/ipa/session/login_password" target="_blank">https://h1.clae.net/ipa/<wbr>session/login_password</a></div></div><div><div>HTTP/1.1 500 Internal Server Error</div><div>Date: Wed, 28 Dec 2016 14:41:33 GMT</div><div>Server: Apache/2.4.25 (Fedora)</div><div>X-Frame-Options: DENY</div><div>Content-Security-Policy: frame-ancestors 'none'</div><div>Content-Length: 610</div><div>Connection: close</div><div>Content-Type: text/html; charset=iso-8859-1</div><div><br></div><div><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"></div><div><html><head></div><div><title>500 Internal Server Error</title></div><div></head><body></div><div><h1>Internal Server Error</h1></div><div><p>The server encountered an internal error or</div><div>misconfiguration and was unable to complete</div><div>your request.</p></div><div><p>Please contact the server administrator at</div><div> root@localhost to inform them of the time this error occurred,</div><div> and the actions you performed just before this error.</p></div><div><p>More information about this error may be available</div><div>in the server error log.</p></div></div><div><br></div><div>The same request on h2 return sucess</div><div><div> curl -Lksi --data 'user=admin&password=mypass' <a href="https://h2.clae.net/ipa/session/login_password" target="_blank">https://h2.clae.net/ipa/<wbr>session/login_password</a></div><div>HTTP/1.1 200 Success</div><div>Date: Wed, 28 Dec 2016 14:43:13 GMT</div><div>Server: Apache/2.4.25 (Fedora)</div><div>X-Frame-Options: DENY</div><div>Content-Security-Policy: frame-ancestors 'none'</div><div>Set-Cookie: ipa_session=<wbr>bdb87cfe758fd050dd69f6c0ca9988<wbr>a3; Domain=<a href="http://kerclaei.clae.net" target="_blank">kerclaei.clae.net</a>; Path=/ipa; Expires=Wed, 28 Dec 2016 15:03:13 GMT; Secure; HttpOnly</div><div>Vary: Accept-Encoding</div><div>Transfer-Encoding: chunked</div><div>Content-Type: text/plain; charset=UTF-8</div></div><div><br></div><div>Looking at the apache log, I can see the following error on h1:</div><div><div><br></div><div>[Wed Dec 28 15:03:38.776075 2016] [wsgi:error] [pid 12804] ipa: DEBUG: WSGI wsgi_dispatch.__call__:</div><div>[Wed Dec 28 15:03:38.776168 2016] [wsgi:error] [pid 12804] ipa: DEBUG: WSGI login_password.__call__:</div><div>[Wed Dec 28 15:03:38.776348 2016] [wsgi:error] [pid 12804] ipa: DEBUG: Obtaining armor ccache: principal=HTTP/<a href="mailto:h1.clae.net@CLAE.NET">h1.clae.net@CLAE.NET</a> keytab=/etc/httpd/conf/ipa.keytab ccache=/var/run/ipa_memcached/krbcc_A_admin</div><div>[Wed Dec 28 15:03:38.776414 2016] [wsgi:error] [pid 12804] ipa: DEBUG: Initializing principal HTTP/<a href="mailto:h1.clae.net@CLAE.NET">h1.clae.net@CLAE.NET</a> using keytab /etc/httpd/conf/ipa.keytab</div><div>[Wed Dec 28 15:03:38.776470 2016] [wsgi:error] [pid 12804] ipa: DEBUG: using ccache /var/run/ipa_memcached/krbcc_A_admin</div><div>[Wed Dec 28 15:03:39.395270 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] mod_wsgi (pid=12804): Exception occurred processing WSGI script '/usr/share/ipa/wsgi.py'.</div><div>[Wed Dec 28 15:03:39.395330 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] Traceback (most recent call last):</div><div>[Wed Dec 28 15:03:39.395358 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] File "/usr/share/ipa/wsgi.py", line 63, in application</div><div>[Wed Dec 28 15:03:39.395397 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] return api.Backend.wsgi_dispatch(environ, start_response)</div><div>[Wed Dec 28 15:03:39.395412 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 262, in __call__</div><div>[Wed Dec 28 15:03:39.395440 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] return self.route(environ, start_response)</div><div>[Wed Dec 28 15:03:39.395453 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 274, in route</div><div>[Wed Dec 28 15:03:39.395477 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] return app(environ, start_response)</div><div>[Wed Dec 28 15:03:39.395491 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 978, in __call__</div><div>[Wed Dec 28 15:03:39.395514 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] self.kinit(user, self.api.env.realm, password, ipa_ccache_name)</div><div>[Wed Dec 28 15:03:39.395527 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 1010, in kinit</div><div>[Wed Dec 28 15:03:39.395564 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] raise CCacheError(message=unicode(e))</div><div>[Wed Dec 28 15:03:39.395589 2016] [wsgi:error] [pid 12804] [remote <a href="http://192.168.254.1:61185">192.168.254.1:61185</a>] CCacheError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638936): Preauthentication failed</div></div><div><br></div><div>I've also notice that running ipa command on h1, the command are running ok, but with strange message about password_callback</div><div><div>ipa user-show admin</div><div>exception in PK11 password callback</div><div>TypeError: password_callback() takes exactly 4 arguments (3 given)</div><div>exception in PK11 password callback</div><div>TypeError: password_callback() takes exactly 4 arguments (3 given)</div><div>exception in PK11 password callback</div><div>TypeError: password_callback() takes exactly 4 arguments (3 given)</div><div> Identifiant de connexion: admin</div><div> Nom: Administrator</div><div> Répertoire personnel: /home/users/admin</div><div> Interpréteur de commande: /bin/bash</div><div> Principal alias: <a href="mailto:admin@CLAE.NET">admin@CLAE.NET</a></div><div> UID: 5000</div><div> GID: 5000</div><div> Compte désactivé: False</div><div> Mot de passe: True</div><div> Membre des groupes: admins, trust admins</div><div> Clés Kerberos disponibles: True</div></div><div><br></div><div>The same command on h2 don't show this messages.</div><div><br></div><div>Can someone help me with this, I take a look on google, but don't find any reference on this, and don't know where to start.</div><div><br></div><div>Regards,</div><div> Laurent.</div><div><br></div></div>