[Freeipa-users] Re: ipa commands run from cron with keytab sometimes failing

[Robbie Harwood]

Roderick Johnstone via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org&gt; writes:

>  [Wed Jun 13 21:30:04.437056 2018] [:error] [pid 29635] ipa: INFO: 401
>
>  Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI 
>  Error: The referenced context has expired (Success) 
This depends slightly on what SASL was trying to do at the time, but
basically, each GSSAPI context has a time for which it is valid.  This
is tied to credential lifetime (akin to ticket lifetime in Kerberos).

It's specific to the application's credentials, which means it's a
problem on the server.  I can't really speak to why the server is
keeping contexts around too long, though.

Thanks,
--Robbie