On Feb 7, 2012, at 3:39 PM, Rob Crittenden wrote: >>> <snip> >>> Strange. Is your 389-ds instance running? If so can you run this query: >>> >>> ldapsearch -x -b 'cn=services,cn=accounts,dc=sbgrid,dc=org' >>> '(krbprincipalname=*sbgrid-directory*)' >>> >>> I have the feeling that the principals for your IPA server have gone away. >> >> Rather than post all the output, I filtered on the krbPrincipalName >> attribute. Let me know if you want to see more: >> >> dn: >> krbprincipalname=dogtagldap/sbgrid-directory.in.hw...@sbgrid.org,cn=servic >> es,cn=accounts,dc=sbgrid,dc=org >> krbPrincipalName: dogtagldap/sbgrid-directory.in.hw...@sbgrid.org >> >> dn: >> krbprincipalname=ldap/sbgrid-directory.in.hw...@sbgrid.org,cn=services,cn= >> accounts,dc=sbgrid,dc=org >> krbPrincipalName: ldap/sbgrid-directory.in.hw...@sbgrid.org >> >> dn: >> krbprincipalname=HTTP/sbgrid-directory.in.hw...@sbgrid.org,cn=services,cn= >> accounts,dc=sbgrid,dc=org >> krbPrincipalName: HTTP/sbgrid-directory.in.hw...@sbgrid.org >> >> >> >>> Note that when removing a replica it is often necessary to restart its >>> replication partners because sometimes there are old tickets cached. I've >>> never seen a case where principals were actually removed though. >>> >>> What version of IPA are you running, on what distro? >> >> >> CentOS 6.2 >> ipa-server-2.1.3-9.el6.x86_64 >> 389-ds-base-22.214.171.124-1.el6_2.2.x86_64 >> >> Thanks, >> Ian > > Ok, this looks good. Is the krb5kdc process running?
It is indeed: [root@sbgrid-directory dirsrv]# kinit ian Password for i...@sbgrid.org: [root@sbgrid-directory dirsrv]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: i...@sbgrid.org Valid starting Expires Service principal 02/07/12 15:51:02 02/08/12 15:51:00 krbtgt/sbgrid....@sbgrid.org ~irl _______________________________________________ Freeipa-users mailing list Freeipaemail@example.com https://www.redhat.com/mailman/listinfo/freeipa-users