WebUI: Login failed due to an unknown reason after upgrade from CentOS 7.3 to 7.4

[Michal Sladek]

Hello,

I am another user who can't log to WebUI after upgrade:
CentOS Linux release 7.4.1708
ipa-server-4.5.0-22.el7.centos.x86_64

I have already enabled the debug and see this in Apache error log:
[Thu Dec 28 17:33:28.198853 2017] [auth_gssapi:error] [pid 4808] [client 10.10.10.13:53343] NO AUTH DATA Client did not send any authentication headers, referer: https://ipa.ph.brotel.cz/ipa/ui/
[Thu Dec 28 17:33:28.233411 2017] [auth_gssapi:error] [pid 4808] [client 10.10.10.13:53343] NO AUTH DATA Client did not send any authentication headers, referer: https://ipa.ph.brotel.cz/ipa/ui/
[Thu Dec 28 17:33:44.935521 2017] [:error] [pid 2979] ipa: DEBUG: WSGI wsgi_dispatch.__call__:
[Thu Dec 28 17:33:44.935646 2017] [:error] [pid 2979] ipa: DEBUG: WSGI login_password.__call__:
[Thu Dec 28 17:33:44.936036 2017] [:error] [pid 2979] ipa: DEBUG: Obtaining armor in ccache /var/run/ipa/ccaches/armor_2979
[Thu Dec 28 17:33:44.936149 2017] [:error] [pid 2979] ipa: DEBUG: Initializing anonymous ccache
[Thu Dec 28 17:33:44.936320 2017] [:error] [pid 2979] ipa: DEBUG: Starting external process
[Thu Dec 28 17:33:44.936418 2017] [:error] [pid 2979] ipa: DEBUG: args=/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_2979 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
[Thu Dec 28 17:33:45.001036 2017] [:error] [pid 2979] ipa: DEBUG: Process finished, return code=0
[Thu Dec 28 17:33:45.001105 2017] [:error] [pid 2979] ipa: DEBUG: stdout=
[Thu Dec 28 17:33:45.001138 2017] [:error] [pid 2979] ipa: DEBUG: stderr=
[Thu Dec 28 17:33:45.001250 2017] [:error] [pid 2979] ipa: DEBUG: Initializing principal admin using password
[Thu Dec 28 17:33:45.001282 2017] [:error] [pid 2979] ipa: DEBUG: Using armor ccache /var/run/ipa/ccaches/armor_2979 for FAST webauth
[Thu Dec 28 17:33:45.001309 2017] [:error] [pid 2979] ipa: DEBUG: Using enterprise principal
[Thu Dec 28 17:33:45.001372 2017] [:error] [pid 2979] ipa: DEBUG: Starting external process
[Thu Dec 28 17:33:45.001401 2017] [:error] [pid 2979] ipa: DEBUG: args=/usr/bin/kinit admin -c /var/run/ipa/ccaches/kinit_2979 -T /var/run/ipa/ccaches/armor_2979 -E
[Thu Dec 28 17:33:45.020263 2017] [:error] [pid 2979] ipa: DEBUG: Process finished, return code=0
[Thu Dec 28 17:33:45.020329 2017] [:error] [pid 2979] ipa: DEBUG: stdout=Password for [e-mail]:
[Thu Dec 28 17:33:45.020333 2017] [:error] [pid 2979]
[Thu Dec 28 17:33:45.020386 2017] [:error] [pid 2979] ipa: DEBUG: stderr=
[Thu Dec 28 17:33:45.020469 2017] [:error] [pid 2979] ipa: DEBUG: Cleanup the armor ccache
[Thu Dec 28 17:33:45.020533 2017] [:error] [pid 2979] ipa: DEBUG: Starting external process
[Thu Dec 28 17:33:45.020600 2017] [:error] [pid 2979] ipa: DEBUG: args=/usr/bin/kdestroy -A -c /var/run/ipa/ccaches/armor_2979
[Thu Dec 28 17:33:45.025960 2017] [:error] [pid 2979] ipa: DEBUG: Process finished, return code=0
[Thu Dec 28 17:33:45.026016 2017] [:error] [pid 2979] ipa: DEBUG: stdout=
[Thu Dec 28 17:33:45.026045 2017] [:error] [pid 2979] ipa: DEBUG: stderr=
[Thu Dec 28 17:33:46.223658 2017] [:error] [pid 2979] ipa: INFO: 401 Unauthorized: No session cookie found

I would be grateful for any suggestions...

Michal

[Michal Sladek]

I have found the problem. I have another name-based virtual server defined in Apache and it seems that the new version of IPA doesn't like it:-(

Michal

[Alexander Bokovoy]

On to, 28 joulu 2017, Michal Sladek via FreeIPA-users wrote:
> I have found the problem. I have another name-based virtual server
> defined in Apache and it seems that the new version of IPA doesn't like
> it:-(

We do not recommend to co-locate IPA master and other services on the
same instance. Apart from a complexity, there are practical concerns of
maintaining a level of security for both involved applications required
for the core infrastructure components.