[389-users] use GSSAPI behind a haproxy

Hello! I'm trying setup balancing freeipa with haproxy, using this article: http://directory.fedoraproject.org/docs/389ds/howto/howto-loadbalance-gss..., On this step: ------- On the ldap1 server you should extract this keytab: kinit <account with admins privilige> ipa-getkeytab -s dc.ipa.example.com -p ldap/haproxydemo.ipa.example.com -k /etc/dirsrv/slapd-localhost/ldap.keytab --retrieve Important is the –retrieve flag to prevent the keytab contents changing. ------ First, a got "failed to parse result insufficient access rights" error After: ipa service-allow-retrieve-keytab ldap/haproxydemo.ipa.example.com --groups=admins i get the following error: Failed to parse result: krbPrincipalKey not found So, i run it without -r key. It success. Then, after i'm adding KRB5_KTNAME=/etc/dirsrv/slapd-localhost/ldap.keytab to /etc/sysconfig/dirsrv-<instance> After this freeipa fails to start In my setup - haproxydemo.ipa.example.com - is a haproxy (with ipa client, A/PTR records) ldap1.ipa.example.com (ldap2, ldap3) is a working freeipa replicas Any advices, what am i doing wrong? Host os Fedora server 25 Freeipa VERSION: 4.5.4, API_VERSION: 2.228 rpm -qi 389-ds-base Name : 389-ds-base Version : 1.3.5.18 Release : 1.fc25