[Freeipa-users] login to host issue

[Patterson, David]

Hello,

IPA version 4.6.8.

Got a host that doesn't allow user logins, but was joined at some point to the
domain.
Everything that I can think of to check appears to be working
                Log into client system with local credentials
                Logs show invalid user attempts
Client Keytab looks valid.....do these ever expire?
                                Ktutil
                                                read_kt /etc/krb5.keytab
                                                list
                                                                Shows the
host/hostname.domain
                                                Quit
                Cannot 'id admin' or 'id' any other user
                Can obtain Kerberos keys for admin
                Can run ipa user-show for any user
                System appears valid in idmweb gui

What did I miss?
                Get a new keytab for the client with ipa-getkeytab?
                Is there some server/client certs I should be checking?

Thanks!

David Patterson