12:01 p.m.
I just setup a new FreeIPA server and get an authentication popups on the
page every time it loads and I have to cancel two of them before I get to
the regular IPA web UI login. How can I fix this issue?
--
Kristian Petersen
System Administrator
BYU Dept. of Chemistry and Biochemistry
1:21 p.m.
Hi Kristian,
Which IPA version and which OS?
Could you provide some screenshots of these popups?
do you see errors on httpd? If yes, could you share them?
Are you able to login using kinit in the same server?
On 03/19/2018 02:01 PM, Kristian Petersen via FreeIPA-users wrote:
> I just setup a new FreeIPA server and get an authentication popups on
> the page every time it loads and I have to cancel two of them before I
> get to the regular IPA web UI login. How can I fix this issue?
>
> --
> Kristian Petersen
> System Administrator
> BYU Dept. of Chemistry and Biochemistry
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>
1:36 p.m.
Hi Kristian,
Some links with additional background:
https://www.redhat.com/archives/freeipa-users/2016-December/msg00401.html
https://www.redhat.com/archives/freeipa-users/2016-December/msg00400.html
https://pagure.io/freeipa/issue/5614
https://github.com/modauthgssapi/mod_auth_gssapi/pull/65
I can at least confirm the behavior is the same on default FreeIPA 4.5 with
IE or Chrome on Windows 7, and Firefox also does not create the login
prompt as was pointed out in the previous conversations. With the upstream
patch to mod_auth_gssapi it would be nice if someone more knowledgeable
might be able to re-visit this and offer new recommendations for FreeIPA
admins.
Thanks,
Jacob
On Mon, Mar 19, 2018 at 1:22 PM Felipe Barreto via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hi Kristian,
Which IPA version and which OS?
Could you provide some screenshots of these popups?
do you see errors on httpd? If yes, could you share them?
Are you able to login using kinit in the same server?
On 03/19/2018 02:01 PM, Kristian Petersen via FreeIPA-users wrote:
> I just setup a new FreeIPA server and get an authentication popups on
> the page every time it loads and I have to cancel two of them before I
> get to the regular IPA web UI login. How can I fix this issue?
>
> --
> Kristian Petersen
> System Administrator
> BYU Dept. of Chemistry and Biochemistry
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
3:52 p.m.
Jacob Block via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
I can at least confirm the behavior is the same on default FreeIPA
4.5
with IE or Chrome on Windows 7, and Firefox also does not create the
login prompt as was pointed out in the previous conversations. With
the upstream patch to mod_auth_gssapi it would be nice if someone more
knowledgeable might be able to re-visit this and offer new
recommendations for FreeIPA admins.
Sure thing. Said patch is already present in Fedora, and is in RHEL
starting with RHEL-7.5 [1].
If this is an issue in your environment, then in the mod_auth_gssapi
config, set
BrowserMatch Windows gssapi-no-negotiate
Thanks,
--Robbie
1: https://bugzilla.redhat.com/show_bug.cgi?id=1309041
1:41 p.m.
The IPA server is running RHEL 7.4 and IPA 4.5.0. Below is the screenshot
showing what I am taking about.
The httpd error log shows:
[Mon Mar 19 12:36:15.167308 2018] [auth_gssapi:error] [pid 6351] [client
192.168.80.6:52395] NO AUTH DATA Client did not send any authentication
headers, referer: https://ipa1.cpms.byu.edu/ipa/ui/
On Mon, Mar 19, 2018 at 12:21 PM, Felipe Barreto <fbarreto(a)redhat.com>
wrote:
Hi Kristian,
Which IPA version and which OS?
Could you provide some screenshots of these popups?
do you see errors on httpd? If yes, could you share them?
Are you able to login using kinit in the same server?
On 03/19/2018 02:01 PM, Kristian Petersen via FreeIPA-users wrote:
> I just setup a new FreeIPA server and get an authentication popups on the
> page every time it loads and I have to cancel two of them before I get to
> the regular IPA web UI login. How can I fix this issue?
>
> --
> Kristian Petersen
> System Administrator
> BYU Dept. of Chemistry and Biochemistry
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedo
> rahosted.org
>
>
--
Kristian Petersen
System Administrator
BYU Dept. of Chemistry and Biochemistry
2231
days inactive
2231
days old
freeipa-users@lists.fedorahosted.org
4 comments
4 participants
participants (4)
-
Felipe Barreto -
Jacob Block -
Kristian Petersen -
Robbie Harwood