I found the problem. Someone when one of our servers was created, it’s password (actually Kerberos credentials) didn’t propagate to the other servers.

I pulled the value of krbprincipalkey from the server and used ldapmodify to fix it on the other servers. Now the credentials are the same on all our systems, and things work.

We had a number of issues that happened when not all the old data was deleted before we recreated the server. This looks like yet another symptom.

On Jan 28, 2020, at 5:48:45 PM, Charles Hedrick via FreeIPA-users <freeipa-users@lists.fedorahosted.orgmailto:freeipa-users@lists.fedorahosted.org> wrote:

we just upgraded servers to centos 8.1, by dealing them and recreating them.

On a few systems when I try to use the IPA command I get

ipa: ERROR: No valid Negotiate header in server response

This doesn’t happen on all hosts. The IPA command works fine on the server itself. Since it’s only on some hosts the obvious suspicion is that something is cached from the old server. Any idea what’s going on?

_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.orgmailto:freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.orgmailto:freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...