11:40 a.m.
I just started working for a new company and they handed me this IPA replication server
with an issue logging on to the web UI. I get errors when we try to login. I have been all
over the web looking for answers. I have check the permission of all the certs and they
are correct all have 0644 on them. I have done strace on the WSGI pids with no answers. I
have no idea if this ever worked from the install since I just started working for the
company last week and the guy who built it is no longer there. I have noticed that since
it cannot authenticate it will not write to ccache in /var/run/ipa/ccaches. Everything
works from the command line with no issue. I can also run kinit admin and put the password
in with no issues. If I run a curl from command it works no issues. Just cant login in
from the browser. I have restart ipa using ipactl restart. All the services are running
just fine. However I noticed in the log file for the install there were errors. I
don't know if this ever worked
or not. This is replicating back to known working servers just fine. I was added and it
shows up in the server.
stderr=kinit: Client 'WELLKNOWN/ANONYMOUS@.example.us' not found in Kerberos
database while getting initial credentials
CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_25969 -X
X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X
X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit
status 1
[root@Server ccaches]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin(a)example.us
Valid starting Expires Service principal
10/06/2020 15:09:44 10/06/2020 20:56:18 HTTP/Server.US
10/05/2020 20:56:30 10/06/2020 20:56:18