4:49 p.m.
Hello everyone,
I'm trying to add a CentOS 7 64bit host to our FreeIPA domain.
Client FreeIPA is 4.5.4-10
Server FreeIPA is 4.4.0
Client FreeIPA rpms:
ipa-common-4.5.4-10.el7.centos.3.noarch
python-ipaddress-1.0.16-2.el7.noarch
python2-ipalib-4.5.4-10.el7.centos.3.noarch
ipa-client-4.5.4-10.el7.centos.3.x86_64
ipa-client-common-4.5.4-10.el7.centos.3.noarch
libipa_hbac-1.16.0-19.el7_5.5.x86_64
python-iniparse-0.4-9.el7.noarch
sssd-ipa-1.16.0-19.el7_5.5.x86_64
python2-ipaclient-4.5.4-10.el7.centos.3.noarch
python-libipa_hbac-1.16.0-19.el7_5.5.x86_64
The basic steps to reproduce are:
1. Populate /etc/krb5.conf for IPA.GENERIC.ZONE realm
2. kinit admin # for IPA.GENERIC.ZONE
3. ipa-client-install --mkhomedir --no-ntp --ssh-trust-dns --enable-dns-updates
Here's where the errors start:
Enrolled in IPA realm IPA.GENERIC.ZONE
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.GENERIC.ZONE
trying https://sl1mmgplidm0001.ipa.generic.zone/ipa/json
Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor
(2529638972): KDC returned error string: PROCESS_TGS
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more
information
[root@sl1aosplsecweb2 ~]# less /var/log/ipaclient-install.log
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
3628, in main
install(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
2348, in install
_install(options)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line
2694, in _install
api.finalize()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 714, in
finalize
self.__do_if_not_done('load_plugins')
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 421, in
__do_if_not_done
getattr(self, name)()
File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 592, in
load_plugins
for package in self.packages:
File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 948, in
packages
ipaclient.remote_plugins.get_package(self),
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py",
line 126, in get_package
plugins = schema.get_package(server_info, client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 537, in get_package
schema = Schema(client)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 385, in __init__
fingerprint, ttl = self._fetch(client, ignore_cache=read_failed)
File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py",
line 397, in _fetch
client.connect(verbose=False)
File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 66, in
connect
conn = self.create_connection(*args, **kw)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1034, in
create_connection
command([], {})
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1246, in _call
return self.__request(name, args)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1213, in
__request
verbose=self.__verbose >= 3,
File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request
return self.single_request(host, handler, request_body, verbose)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 677, in
single_request
self.get_auth_info()
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 629, in
get_auth_info
self._handle_exception(e, service=service)
File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 588, in
_handle_exception
raise errors.KerberosError(message=unicode(e))
2018-07-11T21:39:19Z DEBUG The ipa-client-install command failed, exception:
KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more
information, Minor (2529638972): KDC returned error string: PROCESS_TGS
2018-07-11T21:39:19Z ERROR Major (851968): Unspecified GSS failure. Minor code may
provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS
2018-07-11T21:39:19Z ERROR The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
If it would help I can attach the entire ipaclient-install.log file
Thank you for your help
--Jim