[Freeipa-users] Re: kdb5_util: Kerberos database constraints violated while adding entries to the database

On 18/02/2020 10.53, Djan D via FreeIPA-users wrote: > HI > Installed a fresh IPA server on CentOS 6 and all services are up and > running. While trying to create database for the first-time, i am facing > following error. > > * # /usr/sbin/kdb5_util create -r TESTLAB.ORG <http://TESTLAB.ORG> -s > Loading random data > Initializing database '/var/kerberos/krb5kdc/principal' for realm '* > TESTLAB.ORG <http://TESTLAB.ORG> *', > master key name 'K/M@* TESTLAB.ORG <http://TESTLAB.ORG> *' > You will be prompted for the database Master Password. > It is important that you NOT FORGET this password. > Enter KDC database master key: > Re-enter KDC database master key to verify: > * > *kdb5_util: Kerberos database constraints violated while adding entries > to the database * > > Facing the same error while trying to create a principal: > > # kadmin.local -q "add_principal -randkey reader@ TESTLAB.ORG > <http://TESTLAB.ORG> " > Authenticating as principal admin/admin@ TESTLAB.ORG > <http://TESTLAB.ORG> with password. > WARNING: no policy specified for reader@ TESTLAB.ORG > <http://TESTLAB.ORG> ; defaulting to no policy > add_principal: Kerberos database constraints violated while creating > "reader@ TESTLAB.ORG <http://TESTLAB.ORG> ". > > Can anyone point to me the exact reason for the error ? IPA server creates and manages the KRB5 database for you. You must not use any low-level Kerberos tools to interact with the database directly. In order to create a user in IPA, you have to use the command line tools or the web interface. $ kinit admin $ ipa user-add reader Christian -- Christian Heimes Principal Software Engineer, Identity Management and Platform Security Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Laurie Krebs, Michael O'Neill, Thomas Savage