Hey, I've encountered a replication issue, due to replica not being able to construct gss context.
The result is, that I cannot bind to the replica (let's call it replica1) using gssapi and other replicas cannot establish replication. The directory logs are full of the following: ``` [02/Oct/2024:13:28:46.834250430 +0200] - DEBUG - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToreplica2.example.com" (replica2:389) - Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (No Kerberos credentials available (default cache: KCM:))) ``` I've already checked, if the time is in sync and it should be: ``` [root@replica1 ~]# clockdiff -o replica2.example.com .................................................. host=replica2.example.com rtt=8(0)ms/8ms delta=2ms/2ms Wed Oct 2 14:09:14 2024 ``` I've already checked that keys in keytab have the same kvno: ``` [root@replica2 ~]# kvno host/replica1.example.com host/[email protected]: kvno = 2 ----- [root@replica1 ~]# kvno host/replica1.example.com host/[email protected]: kvno = 2 ----- [root@replica1 ~]# klist -k -t /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 09/02/2024 12:11:19 ldap/[email protected] 2 09/02/2024 12:11:19 ldap/[email protected] 2 09/02/2024 12:11:19 ldap/[email protected] 2 09/02/2024 12:11:19 ldap/[email protected] 2 09/02/2024 12:11:19 ldap/[email protected] 2 09/02/2024 12:11:19 ldap/[email protected] ``` I have not yet tried to get a new keytab with ipa-getkeytab, because I am not sure, how the keytabs are then distributed between peers. ``` VERSION="9.4 (Plow)" VERSION: 4.11.0, API_VERSION: 2.253 (IPA) ``` I am sorry, if I did not provide all relevant logs or if it has an obvious solution. Does anyone has any suggestions? Thanks in advance! Kind regards Jan -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
