Well the Web UI is one part of the IPA server. To debug IPA you might want to look at the
SSSD.conf debug_level
(
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/...).
Can you elaborate what you see when trying to log in? If you see the web interface then
the firewall and apache stuff should be good. If you put in the credentials in the web
login form then that another thing. Is the CLI access working on a seperate IPA client?
Since you're on Ubuntu, I'd recommend temp disableing selinux via `setenforce 0`
or something and then restarting the services. I say that to confirm out that selinux
isn't blocking the processing of files due to context being a little different on
debian-based Ubuntu than redhat-based Fedora. That and it's HTTP context mixing up
with SSSD context.