ipa-server-install fails on fresh install

[John R. Shannon]

Running ipa-server-install I get:

Configuring client side components
Using existing certificate '/etc/ipa/ca.crt'.
Client hostname: auth.test.internal.johnrshannon.com
Realm: TEST.INTERNAL.JOHNRSHANNON.COM
DNS Domain: test.internal.johnrshannon.com
IPA Server: auth.test.internal.johnrshannon.com
BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com

Skipping synchronizing time with NTP server.
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
trying https://auth.test.internal.johnrshannon.com/ipa/json
[try 1]: Forwarding 'schema' to json server
'https://auth.test.internal.johnrshannon.com/ipa/json'
No valid Negotiate header in server response
The ipa-client-install command failed. See
/var/log/ipaclient-install.log for more information
ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
   Configuration of client side components failed!

The system is a fresh, up to date, Fedora 26:

4.12.12-300.fc26.x86_64

configured to include the FREE-IPA repository. FREE-IPA was installed
yesterday with:

dnf install freeipa-*

and running ipa-server-install. I'm not sure how to proceed. I want to
use pkinit.

The log file shows that an exception was raised during the execution of:

2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
--unattended --domain test.internal.johnrshannon.com --server
auth.test.internal.johnrshannon.com --realm
TEST.INTERNAL.JOHNRSHANNON.COM --hostname
auth.test.internal.johnrshannon.com

[Rob Crittenden]

John R. Shannon via FreeIPA-users wrote:
> Running ipa-server-install I get:
>
> Configuring client side components
> Using existing certificate '/etc/ipa/ca.crt'.
> Client hostname: auth.test.internal.johnrshannon.com
> Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> DNS Domain: test.internal.johnrshannon.com
> IPA Server: auth.test.internal.johnrshannon.com
> BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
>
> Skipping synchronizing time with NTP server.
> New SSSD config will be created
> Configured sudoers in /etc/nsswitch.conf
> Configured /etc/sssd/sssd.conf
> trying https://auth.test.internal.johnrshannon.com/ipa/json
> [try 1]: Forwarding 'schema' to json server
> 'https://auth.test.internal.johnrshannon.com/ipa/json'
> No valid Negotiate header in server response
> The ipa-client-install command failed. See
> /var/log/ipaclient-install.log for more information
> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
>    Configuration of client side components failed!
>
> The system is a fresh, up to date, Fedora 26:
>
> 4.12.12-300.fc26.x86_64
>
> configured to include the FREE-IPA repository. FREE-IPA was installed
> yesterday with:
>
> dnf install freeipa-*
>
> and running ipa-server-install. I'm not sure how to proceed. I want to
> use pkinit.
>
> The log file shows that an exception was raised during the execution of:
>
> 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> --unattended --domain test.internal.johnrshannon.com --server
> auth.test.internal.johnrshannon.com --realm
> TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> auth.test.internal.johnrshannon.com

We need to see /var/log/ipaclient-install.log (gzip if its huge).

rob

[John R. Shannon]

Attached in gzip'd form

On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> John R. Shannon via FreeIPA-users wrote:
> > Running ipa-server-install I get:
> >
> > Configuring client side components
> > Using existing certificate '/etc/ipa/ca.crt'.
> > Client hostname: auth.test.internal.johnrshannon.com
> > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > DNS Domain: test.internal.johnrshannon.com
> > IPA Server: auth.test.internal.johnrshannon.com
> > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> >
> > Skipping synchronizing time with NTP server.
> > New SSSD config will be created
> > Configured sudoers in /etc/nsswitch.conf
> > Configured /etc/sssd/sssd.conf
> > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > [try 1]: Forwarding 'schema' to json server
> > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > No valid Negotiate header in server response
> > The ipa-client-install command failed. See
> > /var/log/ipaclient-install.log for more information
> > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> >    Configuration of client side components failed!
> >
> > The system is a fresh, up to date, Fedora 26:
> >
> > 4.12.12-300.fc26.x86_64
> >
> > configured to include the FREE-IPA repository. FREE-IPA was installed
> > yesterday with:
> >
> > dnf install freeipa-*
> >
> > and running ipa-server-install. I'm not sure how to proceed. I want to
> > use pkinit.
> >
> > The log file shows that an exception was raised during the execution of:
> >
> > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> > --unattended --domain test.internal.johnrshannon.com --server
> > auth.test.internal.johnrshannon.com --realm
> > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > auth.test.internal.johnrshannon.com
>
> We need to see /var/log/ipaclient-install.log (gzip if its huge).
>
> rob
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[Rob Crittenden]

John R. Shannon via FreeIPA-users wrote:
> Attached in gzip'd form

We need /var/log/ipaclient-install.log

rob
> On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > John R. Shannon via FreeIPA-users wrote:
> > > Running ipa-server-install I get:
> > >
> > > Configuring client side components
> > > Using existing certificate '/etc/ipa/ca.crt'.
> > > Client hostname: auth.test.internal.johnrshannon.com
> > > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > DNS Domain: test.internal.johnrshannon.com
> > > IPA Server: auth.test.internal.johnrshannon.com
> > > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > >
> > > Skipping synchronizing time with NTP server.
> > > New SSSD config will be created
> > > Configured sudoers in /etc/nsswitch.conf
> > > Configured /etc/sssd/sssd.conf
> > > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > [try 1]: Forwarding 'schema' to json server
> > > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > No valid Negotiate header in server response
> > > The ipa-client-install command failed. See
> > > /var/log/ipaclient-install.log for more information
> > > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > >    Configuration of client side components failed!
> > >
> > > The system is a fresh, up to date, Fedora 26:
> > >
> > > 4.12.12-300.fc26.x86_64
> > >
> > > configured to include the FREE-IPA repository. FREE-IPA was installed
> > > yesterday with:
> > >
> > > dnf install freeipa-*
> > >
> > > and running ipa-server-install. I'm not sure how to proceed. I want to
> > > use pkinit.
> > >
> > > The log file shows that an exception was raised during the execution of:
> > >
> > > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> > > --unattended --domain test.internal.johnrshannon.com --server
> > > auth.test.internal.johnrshannon.com --realm
> > > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > auth.test.internal.johnrshannon.com
> >
> > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> >
> > rob
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[+] Re: ipa-server-install fails on fresh install

[John R. Shannon]

Attached

On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> John R. Shannon via FreeIPA-users wrote:
> > Attached in gzip'd form
>
> We need /var/log/ipaclient-install.log
>
> rob
> > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > John R. Shannon via FreeIPA-users wrote:
> > > > Running ipa-server-install I get:
> > > >
> > > > Configuring client side components
> > > > Using existing certificate '/etc/ipa/ca.crt'.
> > > > Client hostname: auth.test.internal.johnrshannon.com
> > > > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > DNS Domain: test.internal.johnrshannon.com
> > > > IPA Server: auth.test.internal.johnrshannon.com
> > > > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > >
> > > > Skipping synchronizing time with NTP server.
> > > > New SSSD config will be created
> > > > Configured sudoers in /etc/nsswitch.conf
> > > > Configured /etc/sssd/sssd.conf
> > > > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > [try 1]: Forwarding 'schema' to json server
> > > > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > No valid Negotiate header in server response
> > > > The ipa-client-install command failed. See
> > > > /var/log/ipaclient-install.log for more information
> > > > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > >    Configuration of client side components failed!
> > > >
> > > > The system is a fresh, up to date, Fedora 26:
> > > >
> > > > 4.12.12-300.fc26.x86_64
> > > >
> > > > configured to include the FREE-IPA repository. FREE-IPA was installed
> > > > yesterday with:
> > > >
> > > > dnf install freeipa-*
> > > >
> > > > and running ipa-server-install. I'm not sure how to proceed. I want to
> > > > use pkinit.
> > > >
> > > > The log file shows that an exception was raised during the execution of:
> > > >
> > > > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> > > > --unattended --domain test.internal.johnrshannon.com --server
> > > > auth.test.internal.johnrshannon.com --realm
> > > > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > auth.test.internal.johnrshannon.com
> > >
> > > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > >
> > > rob
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[+] Re: ipa-server-install fails on fresh install

[Rob Crittenden]

John R. Shannon via FreeIPA-users wrote:
> Attached

It is failing with "KerberosError: No valid Negotiate header in server
response"

What package version of freeipa-server do you have?

This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
4.5.1

rob
> On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > John R. Shannon via FreeIPA-users wrote:
> > > Attached in gzip'd form
> >
> > We need /var/log/ipaclient-install.log
> >
> > rob
> > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > John R. Shannon via FreeIPA-users wrote:
> > > > > Running ipa-server-install I get:
> > > > >
> > > > > Configuring client side components
> > > > > Using existing certificate '/etc/ipa/ca.crt'.
> > > > > Client hostname: auth.test.internal.johnrshannon.com
> > > > > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > DNS Domain: test.internal.johnrshannon.com
> > > > > IPA Server: auth.test.internal.johnrshannon.com
> > > > > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > >
> > > > > Skipping synchronizing time with NTP server.
> > > > > New SSSD config will be created
> > > > > Configured sudoers in /etc/nsswitch.conf
> > > > > Configured /etc/sssd/sssd.conf
> > > > > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > [try 1]: Forwarding 'schema' to json server
> > > > > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > No valid Negotiate header in server response
> > > > > The ipa-client-install command failed. See
> > > > > /var/log/ipaclient-install.log for more information
> > > > > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > >    Configuration of client side components failed!
> > > > >
> > > > > The system is a fresh, up to date, Fedora 26:
> > > > >
> > > > > 4.12.12-300.fc26.x86_64
> > > > >
> > > > > configured to include the FREE-IPA repository. FREE-IPA was installed
> > > > > yesterday with:
> > > > >
> > > > > dnf install freeipa-*
> > > > >
> > > > > and running ipa-server-install. I'm not sure how to proceed. I want to
> > > > > use pkinit.
> > > > >
> > > > > The log file shows that an exception was raised during the execution of:
> > > > >
> > > > > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> > > > > --unattended --domain test.internal.johnrshannon.com --server
> > > > > auth.test.internal.johnrshannon.com --realm
> > > > > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > auth.test.internal.johnrshannon.com
> > > >
> > > > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > >
> > > > rob
> > > > _______________________________________________
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[+] Re: ipa-server-install fails on fresh install

[John R. Shannon]

freeipa-server-4.5.3-1.fc26.x86_64

On 09/15/17 12:49, Rob Crittenden wrote:
> John R. Shannon via FreeIPA-users wrote:
> > Attached
>
> It is failing with "KerberosError: No valid Negotiate header in server
> response"
>
> What package version of freeipa-server do you have?
>
> This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> 4.5.1
>
> rob
> > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > John R. Shannon via FreeIPA-users wrote:
> > > > Attached in gzip'd form
> > >
> > > We need /var/log/ipaclient-install.log
> > >
> > > rob
> > > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > Running ipa-server-install I get:
> > > > > >
> > > > > > Configuring client side components
> > > > > > Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > Client hostname: auth.test.internal.johnrshannon.com
> > > > > > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > DNS Domain: test.internal.johnrshannon.com
> > > > > > IPA Server: auth.test.internal.johnrshannon.com
> > > > > > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > >
> > > > > > Skipping synchronizing time with NTP server.
> > > > > > New SSSD config will be created
> > > > > > Configured sudoers in /etc/nsswitch.conf
> > > > > > Configured /etc/sssd/sssd.conf
> > > > > > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > [try 1]: Forwarding 'schema' to json server
> > > > > > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > No valid Negotiate header in server response
> > > > > > The ipa-client-install command failed. See
> > > > > > /var/log/ipaclient-install.log for more information
> > > > > > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > >    Configuration of client side components failed!
> > > > > >
> > > > > > The system is a fresh, up to date, Fedora 26:
> > > > > >
> > > > > > 4.12.12-300.fc26.x86_64
> > > > > >
> > > > > > configured to include the FREE-IPA repository. FREE-IPA was installed
> > > > > > yesterday with:
> > > > > >
> > > > > > dnf install freeipa-*
> > > > > >
> > > > > > and running ipa-server-install. I'm not sure how to proceed. I want to
> > > > > > use pkinit.
> > > > > >
> > > > > > The log file shows that an exception was raised during the execution of:
> > > > > >
> > > > > > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> > > > > > --unattended --domain test.internal.johnrshannon.com --server
> > > > > > auth.test.internal.johnrshannon.com --realm
> > > > > > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > auth.test.internal.johnrshannon.com
> > > > >
> > > > > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > >
> > > > > rob
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to [e-mail]
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]

[+] Re: ipa-server-install fails on fresh install

[Alexander Bokovoy]

On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> John R. Shannon via FreeIPA-users wrote:
> > Attached
>
> It is failing with "KerberosError: No valid Negotiate header in server
> response"
>
> What package version of freeipa-server do you have?
>
> This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> 4.5.1

According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.

John, can we see /var/log/httpd/error_log?
> rob
> > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > John R. Shannon via FreeIPA-users wrote:
> > > > Attached in gzip'd form
> > >
> > > We need /var/log/ipaclient-install.log
> > >
> > > rob
> > > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > Running ipa-server-install I get:
> > > > > >
> > > > > > Configuring client side components
> > > > > > Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > Client hostname: auth.test.internal.johnrshannon.com
> > > > > > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > DNS Domain: test.internal.johnrshannon.com
> > > > > > IPA Server: auth.test.internal.johnrshannon.com
> > > > > > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > >
> > > > > > Skipping synchronizing time with NTP server.
> > > > > > New SSSD config will be created
> > > > > > Configured sudoers in /etc/nsswitch.conf
> > > > > > Configured /etc/sssd/sssd.conf
> > > > > > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > [try 1]: Forwarding 'schema' to json server
> > > > > > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > No valid Negotiate header in server response
> > > > > > The ipa-client-install command failed. See
> > > > > > /var/log/ipaclient-install.log for more information
> > > > > > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > >    Configuration of client side components failed!
> > > > > >
> > > > > > The system is a fresh, up to date, Fedora 26:
> > > > > >
> > > > > > 4.12.12-300.fc26.x86_64
> > > > > >
> > > > > > configured to include the FREE-IPA repository. FREE-IPA was installed
> > > > > > yesterday with:
> > > > > >
> > > > > > dnf install freeipa-*
> > > > > >
> > > > > > and running ipa-server-install. I'm not sure how to proceed. I want to
> > > > > > use pkinit.
> > > > > >
> > > > > > The log file shows that an exception was raised during the execution of:
> > > > > >
> > > > > > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install --on-master
> > > > > > --unattended --domain test.internal.johnrshannon.com --server
> > > > > > auth.test.internal.johnrshannon.com --realm
> > > > > > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > auth.test.internal.johnrshannon.com
> > > > >
> > > > > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > >
> > > > > rob
> > > > > _______________________________________________
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to [e-mail]
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to [e-mail]
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to [e-mail]
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[+] Re: ipa-server-install fails on fresh install

[John R. Shannon]

Attached

On 09/15/17 12:58, Alexander Bokovoy wrote:
> On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> > John R. Shannon via FreeIPA-users wrote:
> > > Attached
> >
> > It is failing with "KerberosError: No valid Negotiate header in server
> > response"
> >
> > What package version of freeipa-server do you have?
> >
> > This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> > 4.5.1
>
> According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.
>
> John, can we see /var/log/httpd/error_log?
> > rob
> > > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > > John R. Shannon via FreeIPA-users wrote:
> > > > > Attached in gzip'd form
> > > >
> > > > We need /var/log/ipaclient-install.log
> > > >
> > > > rob
> > > > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > > Running ipa-server-install I get:
> > > > > > >
> > > > > > > Configuring client side components
> > > > > > > Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > > Client hostname: auth.test.internal.johnrshannon.com
> > > > > > > Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > > DNS Domain: test.internal.johnrshannon.com
> > > > > > > IPA Server: auth.test.internal.johnrshannon.com
> > > > > > > BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > > >
> > > > > > > Skipping synchronizing time with NTP server.
> > > > > > > New SSSD config will be created
> > > > > > > Configured sudoers in /etc/nsswitch.conf
> > > > > > > Configured /etc/sssd/sssd.conf
> > > > > > > trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > > [try 1]: Forwarding 'schema' to json server
> > > > > > > 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > > No valid Negotiate header in server response
> > > > > > > The ipa-client-install command failed. See
> > > > > > > /var/log/ipaclient-install.log for more information
> > > > > > > ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > > >
> > > > > > >    Configuration of client side components failed!
> > > > > > >
> > > > > > > The system is a fresh, up to date, Fedora 26:
> > > > > > >
> > > > > > > 4.12.12-300.fc26.x86_64
> > > > > > >
> > > > > > > configured to include the FREE-IPA repository. FREE-IPA was
> > > > > > > installed
> > > > > > > yesterday with:
> > > > > > >
> > > > > > > dnf install freeipa-*
> > > > > > >
> > > > > > > and running ipa-server-install. I'm not sure how to proceed. I
> > > > > > > want to
> > > > > > > use pkinit.
> > > > > > >
> > > > > > > The log file shows that an exception was raised during the
> > > > > > > execution of:
> > > > > > >
> > > > > > > 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install
> > > > > > > --on-master
> > > > > > > --unattended --domain test.internal.johnrshannon.com --server
> > > > > > > auth.test.internal.johnrshannon.com --realm
> > > > > > > TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > > auth.test.internal.johnrshannon.com
> > > > > > >
> > > > > > >
> > > > > >
> > > > > > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > > >
> > > > > > rob
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > To unsubscribe send an email to
> > > > > > [e-mail]
> > > > >
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]

[+] Re: ipa-server-install fails on fresh install

[John R. Shannon]

I upgraded to 4.6.1 today. The same problem persists.

On 09/15/17 13:17, John R. Shannon wrote:
> Attached
>
> On 09/15/17 12:58, Alexander Bokovoy wrote:
> > On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> > > John R. Shannon via FreeIPA-users wrote:
> > > > Attached
> > >
> > > It is failing with "KerberosError: No valid Negotiate header in server
> > > response"
> > >
> > > What package version of freeipa-server do you have?
> > >
> > > This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> > > 4.5.1
> >
> > According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.
> >
> > John, can we see /var/log/httpd/error_log?
> > > rob
> > > > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > Attached in gzip'd form
> > > > >
> > > > > We need /var/log/ipaclient-install.log
> > > > >
> > > > > rob
> > > > > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > >> Running ipa-server-install I get:
> > > > > > >>
> > > > > > >> Configuring client side components
> > > > > > >> Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > >> Client hostname: auth.test.internal.johnrshannon.com
> > > > > > >> Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > >> DNS Domain: test.internal.johnrshannon.com
> > > > > > >> IPA Server: auth.test.internal.johnrshannon.com
> > > > > > >> BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > > >>
> > > > > > >> Skipping synchronizing time with NTP server.
> > > > > > >> New SSSD config will be created
> > > > > > >> Configured sudoers in /etc/nsswitch.conf
> > > > > > >> Configured /etc/sssd/sssd.conf
> > > > > > >> trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > >> [try 1]: Forwarding 'schema' to json server
> > > > > > >> 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > >> No valid Negotiate header in server response
> > > > > > >> The ipa-client-install command failed. See
> > > > > > >> /var/log/ipaclient-install.log for more information
> > > > > > >> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > > >>
> > > > > > >>    Configuration of client side components failed!
> > > > > > >>
> > > > > > >> The system is a fresh, up to date, Fedora 26:
> > > > > > >>
> > > > > > >> 4.12.12-300.fc26.x86_64
> > > > > > >>
> > > > > > >> configured to include the FREE-IPA repository. FREE-IPA was
> > > > > > >> installed
> > > > > > >> yesterday with:
> > > > > > >>
> > > > > > >> dnf install freeipa-*
> > > > > > >>
> > > > > > >> and running ipa-server-install. I'm not sure how to proceed. I
> > > > > > >> want to
> > > > > > >> use pkinit.
> > > > > > >>
> > > > > > >> The log file shows that an exception was raised during the
> > > > > > >> execution of:
> > > > > > >>
> > > > > > >> 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install
> > > > > > >> --on-master
> > > > > > >> --unattended --domain test.internal.johnrshannon.com --server
> > > > > > >> auth.test.internal.johnrshannon.com --realm
> > > > > > >> TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > >> auth.test.internal.johnrshannon.com
> > > > > > >>
> > > > > > >>
> > > > > > >
> > > > > > > We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > > > >
> > > > > > > rob
> > > > > > > _______________________________________________
> > > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > > To unsubscribe send an email to
> > > > > > > [e-mail]
> > > > > > >
> > > > > >
> > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > To unsubscribe send an email to
> > > > > > [e-mail]
> > > > >
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
> > >
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
> > > [e-mail]

[+] Re: ipa-server-install fails on fresh install

[Alexander Bokovoy]

On pe, 22 syys 2017, John R. Shannon via FreeIPA-users wrote:
> I upgraded to 4.6.1 today. The same problem persists.

1. Can you show /etc/pki/ca-trust/source/ipa.p11-kit?

2. Can you show /var/log/ipaupgrade.log?
> On 09/15/17 13:17, John R. Shannon wrote:
> > Attached
> >
> > On 09/15/17 12:58, Alexander Bokovoy wrote:
> > > On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> > > > John R. Shannon via FreeIPA-users wrote:
> > > > > Attached
> > > >
> > > > It is failing with "KerberosError: No valid Negotiate header in server
> > > > response"
> > > >
> > > > What package version of freeipa-server do you have?
> > > >
> > > > This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> > > > 4.5.1
> > >
> > > According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.
> > >
> > > John, can we see /var/log/httpd/error_log?
> > > > rob
> > > > > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > > Attached in gzip'd form
> > > > > >
> > > > > > We need /var/log/ipaclient-install.log
> > > > > >
> > > > > > rob
> > > > > >
> > > > > > >
> > > > > > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > > >> John R. Shannon via FreeIPA-users wrote:
> > > > > > >>> Running ipa-server-install I get:
> > > > > > >>>
> > > > > > >>> Configuring client side components
> > > > > > >>> Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > >>> Client hostname: auth.test.internal.johnrshannon.com
> > > > > > >>> Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > >>> DNS Domain: test.internal.johnrshannon.com
> > > > > > >>> IPA Server: auth.test.internal.johnrshannon.com
> > > > > > >>> BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > > >>>
> > > > > > >>> Skipping synchronizing time with NTP server.
> > > > > > >>> New SSSD config will be created
> > > > > > >>> Configured sudoers in /etc/nsswitch.conf
> > > > > > >>> Configured /etc/sssd/sssd.conf
> > > > > > >>> trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > >>> [try 1]: Forwarding 'schema' to json server
> > > > > > >>> 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > >>> No valid Negotiate header in server response
> > > > > > >>> The ipa-client-install command failed. See
> > > > > > >>> /var/log/ipaclient-install.log for more information
> > > > > > >>> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > > >>>
> > > > > > >>>    Configuration of client side components failed!
> > > > > > >>>
> > > > > > >>> The system is a fresh, up to date, Fedora 26:
> > > > > > >>>
> > > > > > >>> 4.12.12-300.fc26.x86_64
> > > > > > >>>
> > > > > > >>> configured to include the FREE-IPA repository. FREE-IPA was
> > > > > > >>> installed
> > > > > > >>> yesterday with:
> > > > > > >>>
> > > > > > >>> dnf install freeipa-*
> > > > > > >>>
> > > > > > >>> and running ipa-server-install. I'm not sure how to proceed. I
> > > > > > >>> want to
> > > > > > >>> use pkinit.
> > > > > > >>>
> > > > > > >>> The log file shows that an exception was raised during the
> > > > > > >>> execution of:
> > > > > > >>>
> > > > > > >>> 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install
> > > > > > >>> --on-master
> > > > > > >>> --unattended --domain test.internal.johnrshannon.com --server
> > > > > > >>> auth.test.internal.johnrshannon.com --realm
> > > > > > >>> TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > >>> auth.test.internal.johnrshannon.com
> > > > > > >>>
> > > > > > >>>
> > > > > > >>
> > > > > > >> We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > > > >>
> > > > > > >> rob
> > > > > > >> _______________________________________________
> > > > > > >> FreeIPA-users mailing list -- [e-mail]
> > > > > > >> To unsubscribe send an email to
> > > > > > >> [e-mail]
> > > > > > >>
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > > To unsubscribe send an email to
> > > > > > > [e-mail]
> > > > > > >
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > To unsubscribe send an email to
> > > > > > [e-mail]
> > > > >
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]
>
> --
>
> John R. Shannon
> [e-mail]
> [phone]
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]

[+] Re: ipa-server-install fails on fresh install

[John R. Shannon]

Attached

On 09/25/17 07:23, Alexander Bokovoy via FreeIPA-users wrote:
> On pe, 22 syys 2017, John R. Shannon via FreeIPA-users wrote:
> > I upgraded to 4.6.1 today. The same problem persists.
>
> Can you show /etc/pki/ca-trust/source/ipa.p11-kit?
>
> Can you show /var/log/ipaupgrade.log?
> > On 09/15/17 13:17, John R. Shannon wrote:
> > > Attached
> > >
> > > On 09/15/17 12:58, Alexander Bokovoy wrote:
> > > > On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > Attached
> > > > >
> > > > > It is failing with "KerberosError: No valid Negotiate header in server
> > > > > response"
> > > > >
> > > > > What package version of freeipa-server do you have?
> > > > >
> > > > > This seems like https://pagure.io/freeipa/issue/6773 which was
> > > > > fixed in
> > > > > 4.5.1
> > > >
> > > > According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.
> > > >
> > > > John, can we see /var/log/httpd/error_log?
> > > > > rob
> > > > > > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > >> Attached in gzip'd form
> > > > > > >
> > > > > > > We need /var/log/ipaclient-install.log
> > > > > > >
> > > > > > > rob
> > > > > > >
> > > > > > >>
> > > > > > >> On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > > >>> John R. Shannon via FreeIPA-users wrote:
> > > > > > >>>> Running ipa-server-install I get:
> > > > > > >>>>
> > > > > > >>>> Configuring client side components
> > > > > > >>>> Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > >>>> Client hostname: auth.test.internal.johnrshannon.com
> > > > > > >>>> Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > >>>> DNS Domain: test.internal.johnrshannon.com
> > > > > > >>>> IPA Server: auth.test.internal.johnrshannon.com
> > > > > > >>>> BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > > >>>>
> > > > > > >>>> Skipping synchronizing time with NTP server.
> > > > > > >>>> New SSSD config will be created
> > > > > > >>>> Configured sudoers in /etc/nsswitch.conf
> > > > > > >>>> Configured /etc/sssd/sssd.conf
> > > > > > >>>> trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > >>>> [try 1]: Forwarding 'schema' to json server
> > > > > > >>>> 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > >>>> No valid Negotiate header in server response
> > > > > > >>>> The ipa-client-install command failed. See
> > > > > > >>>> /var/log/ipaclient-install.log for more information
> > > > > > >>>> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall):
> > > > > > >>>> ERROR
> > > > > > >>>>
> > > > > > >>>>    Configuration of client side components failed!
> > > > > > >>>>
> > > > > > >>>> The system is a fresh, up to date, Fedora 26:
> > > > > > >>>>
> > > > > > >>>> 4.12.12-300.fc26.x86_64
> > > > > > >>>>
> > > > > > >>>> configured to include the FREE-IPA repository. FREE-IPA was
> > > > > > >>>> installed
> > > > > > >>>> yesterday with:
> > > > > > >>>>
> > > > > > >>>> dnf install freeipa-*
> > > > > > >>>>
> > > > > > >>>> and running ipa-server-install. I'm not sure how to proceed. I
> > > > > > >>>> want to
> > > > > > >>>> use pkinit.
> > > > > > >>>>
> > > > > > >>>> The log file shows that an exception was raised during the
> > > > > > >>>> execution of:
> > > > > > >>>>
> > > > > > >>>> 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install
> > > > > > >>>> --on-master
> > > > > > >>>> --unattended --domain test.internal.johnrshannon.com --server
> > > > > > >>>> auth.test.internal.johnrshannon.com --realm
> > > > > > >>>> TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > >>>> auth.test.internal.johnrshannon.com
> > > > > > >>>>
> > > > > > >>>>
> > > > > > >>>
> > > > > > >>> We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > > > >>>
> > > > > > >>> rob
> > > > > > >>> _______________________________________________
> > > > > > >>> FreeIPA-users mailing list -- [e-mail]
> > > > > > >>> To unsubscribe send an email to
> > > > > > >>> [e-mail]
> > > > > > >>>
> > > > > > >>
> > > > > > >>
> > > > > > >>
> > > > > > >> _______________________________________________
> > > > > > >> FreeIPA-users mailing list -- [e-mail]
> > > > > > >> To unsubscribe send an email to
> > > > > > >> [e-mail]
> > > > > > >>
> > > > > > > _______________________________________________
> > > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > > To unsubscribe send an email to
> > > > > > > [e-mail]
> > > > > > >
> > > > > >
> > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > To unsubscribe send an email to
> > > > > > [e-mail]
> > > > >
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]
> >
> > --
> >
> > John R. Shannon
> > [e-mail]
> > [phone]
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]

[+] Re: ipa-server-install fails on fresh install

[Rob Crittenden]

John R. Shannon wrote:
> I upgraded to 4.6.1 today. The same problem persists.

You get the same error in /var/log/httpd/error_log?

gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS
failure.  Minor code may provide more information ( SPNEGO cannot find
mechanisms to negotiate)]

rob
> On 09/15/17 13:17, John R. Shannon wrote:
> > Attached
> >
> > On 09/15/17 12:58, Alexander Bokovoy wrote:
> > > On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> > > > John R. Shannon via FreeIPA-users wrote:
> > > > > Attached
> > > >
> > > > It is failing with "KerberosError: No valid Negotiate header in server
> > > > response"
> > > >
> > > > What package version of freeipa-server do you have?
> > > >
> > > > This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> > > > 4.5.1
> > >
> > > According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.
> > >
> > > John, can we see /var/log/httpd/error_log?
> > > > rob
> > > > > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > > Attached in gzip'd form
> > > > > >
> > > > > > We need /var/log/ipaclient-install.log
> > > > > >
> > > > > > rob
> > > > > >
> > > > > > >
> > > > > > > On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > > >> John R. Shannon via FreeIPA-users wrote:
> > > > > > >>> Running ipa-server-install I get:
> > > > > > >>>
> > > > > > >>> Configuring client side components
> > > > > > >>> Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > >>> Client hostname: auth.test.internal.johnrshannon.com
> > > > > > >>> Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > >>> DNS Domain: test.internal.johnrshannon.com
> > > > > > >>> IPA Server: auth.test.internal.johnrshannon.com
> > > > > > >>> BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > > >>>
> > > > > > >>> Skipping synchronizing time with NTP server.
> > > > > > >>> New SSSD config will be created
> > > > > > >>> Configured sudoers in /etc/nsswitch.conf
> > > > > > >>> Configured /etc/sssd/sssd.conf
> > > > > > >>> trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > >>> [try 1]: Forwarding 'schema' to json server
> > > > > > >>> 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > >>> No valid Negotiate header in server response
> > > > > > >>> The ipa-client-install command failed. See
> > > > > > >>> /var/log/ipaclient-install.log for more information
> > > > > > >>> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > > >>>
> > > > > > >>>    Configuration of client side components failed!
> > > > > > >>>
> > > > > > >>> The system is a fresh, up to date, Fedora 26:
> > > > > > >>>
> > > > > > >>> 4.12.12-300.fc26.x86_64
> > > > > > >>>
> > > > > > >>> configured to include the FREE-IPA repository. FREE-IPA was
> > > > > > >>> installed
> > > > > > >>> yesterday with:
> > > > > > >>>
> > > > > > >>> dnf install freeipa-*
> > > > > > >>>
> > > > > > >>> and running ipa-server-install. I'm not sure how to proceed. I
> > > > > > >>> want to
> > > > > > >>> use pkinit.
> > > > > > >>>
> > > > > > >>> The log file shows that an exception was raised during the
> > > > > > >>> execution of:
> > > > > > >>>
> > > > > > >>> 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install
> > > > > > >>> --on-master
> > > > > > >>> --unattended --domain test.internal.johnrshannon.com --server
> > > > > > >>> auth.test.internal.johnrshannon.com --realm
> > > > > > >>> TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > >>> auth.test.internal.johnrshannon.com
> > > > > > >>>
> > > > > > >>>
> > > > > > >>
> > > > > > >> We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > > > >>
> > > > > > >> rob
> > > > > > >> _______________________________________________
> > > > > > >> FreeIPA-users mailing list -- [e-mail]
> > > > > > >> To unsubscribe send an email to
> > > > > > >> [e-mail]
> > > > > > >>
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > > To unsubscribe send an email to
> > > > > > > [e-mail]
> > > > > > >
> > > > > > _______________________________________________
> > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > To unsubscribe send an email to
> > > > > > [e-mail]
> > > > >
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]
> > > >
> > > > FreeIPA-users mailing list -- [e-mail]
> > > > To unsubscribe send an email to
> > > > [e-mail]

[+] Re: ipa-server-install fails on fresh install

[John R. Shannon]

I've attached httpd/error_log-20170922.gz

I did not look at that file before, so I can't say that it's changed.

I've also attached the ipaclient-install.log.gz

On 09/25/17 08:56, Rob Crittenden wrote:
> John R. Shannon wrote:
> > I upgraded to 4.6.1 today. The same problem persists.
>
> You get the same error in /var/log/httpd/error_log?
>
> gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS
> failure.  Minor code may provide more information ( SPNEGO cannot find
> mechanisms to negotiate)]
>
> rob
> > On 09/15/17 13:17, John R. Shannon wrote:
> > > Attached
> > >
> > > On 09/15/17 12:58, Alexander Bokovoy wrote:
> > > > On pe, 15 syys 2017, Rob Crittenden via FreeIPA-users wrote:
> > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > Attached
> > > > >
> > > > > It is failing with "KerberosError: No valid Negotiate header in server
> > > > > response"
> > > > >
> > > > > What package version of freeipa-server do you have?
> > > > >
> > > > > This seems like https://pagure.io/freeipa/issue/6773 which was fixed in
> > > > > 4.5.1
> > > >
> > > > According to ipaserver-install.log, it is IPA version 4.5.3-1.fc26.
> > > >
> > > > John, can we see /var/log/httpd/error_log?
> > > > > rob
> > > > > > On 09/15/17 11:54, Rob Crittenden via FreeIPA-users wrote:
> > > > > > > John R. Shannon via FreeIPA-users wrote:
> > > > > > >> Attached in gzip'd form
> > > > > > >
> > > > > > > We need /var/log/ipaclient-install.log
> > > > > > >
> > > > > > > rob
> > > > > > >
> > > > > > >>
> > > > > > >> On 09/15/17 11:39, Rob Crittenden via FreeIPA-users wrote:
> > > > > > >>> John R. Shannon via FreeIPA-users wrote:
> > > > > > >>>> Running ipa-server-install I get:
> > > > > > >>>>
> > > > > > >>>> Configuring client side components
> > > > > > >>>> Using existing certificate '/etc/ipa/ca.crt'.
> > > > > > >>>> Client hostname: auth.test.internal.johnrshannon.com
> > > > > > >>>> Realm: TEST.INTERNAL.JOHNRSHANNON.COM
> > > > > > >>>> DNS Domain: test.internal.johnrshannon.com
> > > > > > >>>> IPA Server: auth.test.internal.johnrshannon.com
> > > > > > >>>> BaseDN: dc=test,dc=internal,dc=johnrshannon,dc=com
> > > > > > >>>>
> > > > > > >>>> Skipping synchronizing time with NTP server.
> > > > > > >>>> New SSSD config will be created
> > > > > > >>>> Configured sudoers in /etc/nsswitch.conf
> > > > > > >>>> Configured /etc/sssd/sssd.conf
> > > > > > >>>> trying https://auth.test.internal.johnrshannon.com/ipa/json
> > > > > > >>>> [try 1]: Forwarding 'schema' to json server
> > > > > > >>>> 'https://auth.test.internal.johnrshannon.com/ipa/json'
> > > > > > >>>> No valid Negotiate header in server response
> > > > > > >>>> The ipa-client-install command failed. See
> > > > > > >>>> /var/log/ipaclient-install.log for more information
> > > > > > >>>> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR
> > > > > > >>>>
> > > > > > >>>>    Configuration of client side components failed!
> > > > > > >>>>
> > > > > > >>>> The system is a fresh, up to date, Fedora 26:
> > > > > > >>>>
> > > > > > >>>> 4.12.12-300.fc26.x86_64
> > > > > > >>>>
> > > > > > >>>> configured to include the FREE-IPA repository. FREE-IPA was
> > > > > > >>>> installed
> > > > > > >>>> yesterday with:
> > > > > > >>>>
> > > > > > >>>> dnf install freeipa-*
> > > > > > >>>>
> > > > > > >>>> and running ipa-server-install. I'm not sure how to proceed. I
> > > > > > >>>> want to
> > > > > > >>>> use pkinit.
> > > > > > >>>>
> > > > > > >>>> The log file shows that an exception was raised during the
> > > > > > >>>> execution of:
> > > > > > >>>>
> > > > > > >>>> 2017-09-15T14:52:27Z DEBUG args=/usr/sbin/ipa-client-install
> > > > > > >>>> --on-master
> > > > > > >>>> --unattended --domain test.internal.johnrshannon.com --server
> > > > > > >>>> auth.test.internal.johnrshannon.com --realm
> > > > > > >>>> TEST.INTERNAL.JOHNRSHANNON.COM --hostname
> > > > > > >>>> auth.test.internal.johnrshannon.com
> > > > > > >>>>
> > > > > > >>>>
> > > > > > >>>
> > > > > > >>> We need to see /var/log/ipaclient-install.log (gzip if its huge).
> > > > > > >>>
> > > > > > >>> rob
> > > > > > >>> _______________________________________________
> > > > > > >>> FreeIPA-users mailing list -- [e-mail]
> > > > > > >>> To unsubscribe send an email to
> > > > > > >>> [e-mail]
> > > > > > >>>
> > > > > > >>
> > > > > > >>
> > > > > > >>
> > > > > > >> _______________________________________________
> > > > > > >> FreeIPA-users mailing list -- [e-mail]
> > > > > > >> To unsubscribe send an email to
> > > > > > >> [e-mail]
> > > > > > >>
> > > > > > > _______________________________________________
> > > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > > To unsubscribe send an email to
> > > > > > > [e-mail]
> > > > > > >
> > > > > >
> > > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > > To unsubscribe send an email to
> > > > > > [e-mail]
> > > > >
> > > > > FreeIPA-users mailing list -- [e-mail]
> > > > > To unsubscribe send an email to
> > > > > [e-mail]

[+] Re: ipa-server-install fails on fresh install

[Matt .]

Does this still exists ? I have the same on a 4.6.1 install, ipa-certupdate seems to fail.

[+] Re: ipa-server-install fails on fresh install

[Matt .]

I can update this with the fact that an install with 4.5.4-0.fc26 goes well on F26!