I am trying to write some software that communicates with the FreeIPA server 
from a remote client.

Using Adam Young's helpful blog (
I am successfully able to run this curl on the FreeIPA server itself:

curl -v -H referer:https://myserver.net/ipa -H "Content-Type:application/json" 
-H "Accept:application/json" --negotiate -u : --cacert /etc/ipa/ca.crt -d 
'{"method":"user_find","params":[[""],{}],"id":0}' -X POST 

But when I try and run an similar curl from my client workstation (with 
pre-requisite Kerberos setup):

curl -v -H referer:https://myworkstation.net/ipa -H 
"Content-Type:application/json" -H "Accept:application/json" --negotiate -u : 
--cacert /tmp/ca.crt -d '{"method":"user_find","params":[[""],{}],"id":0}' -X 
POST https://myserver.net/ipa/json

The following error is generated in the Apache logs:

KerberosWSGIExecutioner.__call__: KRB5CCNAME not defined in HTTP request 

Would anyone have any pointers to fix, or a place to start investigating? I am 
assuming there is configuration problem but I have no idea where to begin. I 
believe I've done all the Kerberos setup correctly, but it's hard to tell.

Kind regards,

This message (including any attachments) may contain information that is 
privileged or confidential. If you are not the intended recipient, please 
notify the sender and delete this email immediately from your systems and 
destroy all copies of it. You may not, directly or indirectly, use, disclose, 
distribute, print or copy this email or any part of it if you are not the 
intended recipient
Manage your subscription for the Freeipa-users mailing list:
Go To http://freeipa.org for more info on the project

Reply via email to