Hi Rob,   The FreeIPA accounts are using LDAP for logins to clients, right?  That’s what I’ve understood.  Is that wrong?

The reason that I am forcing Kerberos realm is that the discovery does not properly configure the krb5.conf, and it fails because it says it can’t contact the KDC for the Realm.  Once I configure krb5.conf with the missing parameters, it works fine.  I use kinit and it finds the real fine.

  Thanks,   Scott Reed   *From: *Rob Crittenden <mailto:rcritten@redhat.com> *Sent: *Friday, May 7, 2021 6:23 PM *To: *FreeIPA users list <mailto:freeipa-users@lists.fedorahosted.org> *Cc: *Steve Reed <mailto:scottmreed@hotmail.com> *Subject: *Re: [Freeipa-users] Problem with Client Installs on Centos 7   Steve Reed via FreeIPA-users wrote: > Hi all, > > I am running Versions 4.8 of the client installations.  I have one machine that installed except it failed to configure the krb5.conf file properly and it fails saying that it can't find the KDC for the realm xyz.com.  I can fix Kerberos by manually editing the kfb5.conf file. Except for the rest  of the machines which won't work for ldap logins, but Kerberos works fine. > > Prior to the installation, I make sure the resolv.conf file is configured properly.  I make sure that the /etc/hosts file has the proper entries for the machine I am installing on and the server.  No extraneous domain names.  Also, I make sure the hostname is fully qualified with the domain name.  I turn off any potential firewalld, iptables or ip6tables services as well. > > This is the installation command: > > ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM > > > 2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log > 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin', 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None, 'unattended': True, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False} > 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos > 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' > 2021-05-07T20:36:19Z DEBUG Starting external process > 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled > 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:19Z DEBUG stdout= > 2021-05-07T20:36:19Z DEBUG stderr= > 2021-05-07T20:36:19Z DEBUG Starting external process > 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service > 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:19Z DEBUG stdout=enabled > > 2021-05-07T20:36:19Z DEBUG stderr= > 2021-05-07T20:36:19Z DEBUG [IPA Discovery] > 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=client1.xyz.com > 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (domain of the hostname) and its sub-domains > 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com > 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. > 2021-05-07T20:36:19Z DEBUG [Kerberos realm search] > 2021-05-07T20:36:19Z DEBUG Kerberos realm forced > 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _kerberos._udp.xyz.com > 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com. > 2021-05-07T20:36:19Z DEBUG [LDAP server check] > 2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM) is an IPA server > 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389 > 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN > 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA > 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context > 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com (sub) > 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com > 2021-05-07T20:36:19Z DEBUG Discovery result: Success; server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com > 2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com > 2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com > 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (Validating DNS Discovery) and its sub-domains > 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com > 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. > 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery > 2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com > 2021-05-07T20:36:19Z INFO Discovery was successful! > 2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM > 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com > 2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com > 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN > 2021-05-07T20:36:19Z INFO Realm: XYZ.COM > 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in idm.xyz.com > 2021-05-07T20:36:19Z INFO DNS Domain: xyz.com > 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from xyz.com (domain of the hostname) > 2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com > 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in idm.xyz.com > 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com > 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389 > 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' > 2021-05-07T20:36:19Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' > 2021-05-07T20:36:19Z DEBUG Starting external process > 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM > 2021-05-07T20:36:19Z DEBUG Process finished, return code=5 > 2021-05-07T20:36:19Z DEBUG stdout= > 2021-05-07T20:36:19Z DEBUG stderr=realm not found > > 2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server. > 2021-05-07T20:36:19Z DEBUG Starting external process > 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 > 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:19Z DEBUG stdout=599779671 > > 2021-05-07T20:36:19Z DEBUG stderr= > 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE > 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T: > 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install > > includedir /etc/krb5.conf.d/ > includedir /var/lib/sss/pubconf/krb5.include.d/ > > [libdefaults] >   default_realm = XYZ.COM >   dns_lookup_realm = false >   dns_lookup_kdc = false >   rdns = false >   dns_canonicalize_hostname = false >   ticket_lifetime = 24h >   forwardable = true >   udp_preference_limit = 0 >   default_ccache_name = KEYRING:persistent:%{uid} > > > [realms] >   XYZ.COM = { >     kdc = idm.xyz.com:88 >     master_kdc = idm.xyz.com:88 >     admin_server = idm.xyz.com:749 >     kpasswd_server = idm.xyz.com:464 >     default_domain = xyz.com >     pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem >     pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem > >   } > > > [domain_realm] >   .xyz.com = XYZ.COM >   xyz.com = XYZ.COM >   client1.xyz.com = XYZ.COM > > > > 2021-05-07T20:36:19Z DEBUG Initializing principal admin(a)XYZ.COM using password > 2021-05-07T20:36:19Z DEBUG Starting external process > 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin(a)XYZ.COM -c /tmp/krbccnj9ncO/ccache > 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:19Z DEBUG stdout=Password for admin(a)XYZ.COM: > > 2021-05-07T20:36:19Z DEBUG stderr= > 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from idm.xyz.com > 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248> > 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert >     Subject:     CN=Certificate Authority,O=XYZ.COM >     Issuer:      CN=Certificate Authority,O=XYZ.COM >     Valid From:  2021-05-06 19:54:28 >     Valid Until: 2041-05-06 19:54:28 > > 2021-05-07T20:36:19Z DEBUG Starting external process > 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b dc=xyz,dc=com -h client1.xyz.com -f > 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:20Z DEBUG stdout= > 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab > Certificate subject base is: O=XYZ.COM > > 2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM > 2021-05-07T20:36:20Z DEBUG Starting external process > 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy > 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:20Z DEBUG stdout= > 2021-05-07T20:36:20Z DEBUG stderr= > 2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com(a)XYZ.COM using keytab /etc/krb5.keytab > 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache > 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success > 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' > 2021-05-07T20:36:20Z DEBUG   -> Not backing up - '/etc/ipa/default.conf' doesn't exist > 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf > 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' > 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' > 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' > 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' > 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf > 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf > 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf' > 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' > 2021-05-07T20:36:20Z DEBUG Starting external process > 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 > 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:20Z DEBUG stdout=599779671 > > 2021-05-07T20:36:20Z DEBUG stderr= > 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE > 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: > 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install > > includedir /etc/krb5.conf.d/ > includedir /var/lib/sss/pubconf/krb5.include.d/ > > [libdefaults] >   default_realm = XYZ.COM >   dns_lookup_realm = true >   dns_lookup_kdc = true >   rdns = false >   dns_canonicalize_hostname = false >   ticket_lifetime = 24h >   forwardable = true >   udp_preference_limit = 0 >   default_ccache_name = KEYRING:persistent:%{uid} > > > [realms] >   XYZ.COM = { >     pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem >     pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem > >   } > > > [domain_realm] >   .xyz.com = XYZ.COM >   xyz.com = XYZ.COM >   client1.xyz.com = XYZ.COM > > > > 2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM > 2021-05-07T20:36:20Z DEBUG Starting external process > 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt > 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:20Z DEBUG stdout= > 2021-05-07T20:36:20Z DEBUG stderr= > 2021-05-07T20:36:20Z DEBUG Starting external process > 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt > 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 > 2021-05-07T20:36:20Z DEBUG stdout= > 2021-05-07T20:36:20Z DEBUG stderr= > 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for principal &#39;host/client1.xyz.com(a)XYZ.COM&#39; > 2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json > 2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504 > 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server 'https://idm.xyz.com/ipa/json' > 2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com) > 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com) > Traceback (most recent call last): >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request >     self.get_auth_info() >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info >     self._handle_exception(e, service=service) >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception >     raise errors.KerberosError(message=unicode(e)) > KerberosError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' > 2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504 > 2021-05-07T20:36:20Z DEBUG   File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute >     return_value = self.run() >   File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run >     return cfgr.run() >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run >     return self.execute() >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute >     for rval in self._executor(): >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner >     exc_handler(exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception >     self._handle_exception(exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception >     six.reraise(*exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner >     step() >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> >     step = lambda: next(self.__gen) >   File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from >     six.reraise(*exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from >     value = gen.send(prev_value) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure >     next(executor) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner >     exc_handler(exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception >     self._handle_exception(exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception >     self.__parent._handle_exception(exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception >     six.reraise(*exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception >     super(ComponentBase, self)._handle_exception(exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception >     six.reraise(*exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner >     step() >   File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> >     step = lambda: next(self.__gen) >   File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from >     six.reraise(*exc_info) >   File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from >     value = gen.send(prev_value) >   File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install >     for unused in self._installer(self.parent): >   File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main >     install(self) >   File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install >     _install(options) >   File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2733, in _install >     api.finalize() >   File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in finalize >     self.__do_if_not_done('load_plugins') >   File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done >     getattr(self, name)() >   File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins >     for package in self.packages: >   File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in packages >     ipaclient.remote_plugins.get_package(self), >   File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package >     plugins = schema.get_package(server_info, client) >   File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package >     schema = Schema(client) >   File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__ >     fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) >   File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch >     schema = client.forward(u'schema', **kwargs)['result'] >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward >     return self._call_command(command, params) >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in _call_command >     return command(*params) >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call >     return self.__request(name, args) >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in __request >     verbose=self.__verbose >= 3, >   File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request >     return self.single_request(host, handler, request_body, verbose) >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request >     self.get_auth_info() >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info >     self._handle_exception(e, service=service) >   File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception >     raise errors.KerberosError(message=unicode(e)) > > 2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' > 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' > 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information > > So, what I found is that the krb5.conf file is partially configured.  I'm not sure what to look for in the sssd.conf file.  I am assuming that since I can't login with an ldap account and it finds the domain that something is not cofigured properly for that either. > > Any thoughts on what is going wrong?  And how I can fix it or work around it?  I'm more worried about not being able to do ldap logins than the Kerberos problem since I have a work around for that. Can you expand on what you mean by ldap logins fail? Is there a reason you're forcing the Kerberos realm and not relying on discovery? rob