On 03/29/2015 10:56 PM, Matt . wrote:
Hi,
I just tot home and typing from my cell so i'm suite short in words
Create keytab for ldap-01.domain
Kinit with that to ldap.domain
Curl against ldap.domain
Get a 301 which I manage from curl (goes well)
Get kerberos ticket error
now I don't kinit anymore so re-use my existing ticket and curl
against ldap-01.domain and I'm accepted and can execute stuff.
My ssl is OK, ticket also it seems.
Hard to say without the logs what is going on. However here is a thought:
If it is trying to get another ticket it might think that the service is
in a different domain.
Client libraries have a feature to detect which ticket to use depending
on the realm the resource belongs to.
May be it is thinking that it is a different realm and thus does not use
the ticket it has.
Thanks M.
Op 30 mrt. 2015 03:50 schreef "Dmitri Pal" <d...@redhat.com
<mailto:d...@redhat.com>>:
On 03/29/2015 04:47 AM, Matt . wrote:
Hi Guys,
Now my Certification issues are solved for using a loadbalancer in
front of my ipa servers I get the following:
Unable to verify your Kerberos credentials
and in my logs:
Additional pre-authentication required.
This happens when I connect throught my loadbalancers, I see
my server
coming ni with the right IP.
When I access my ipa server directly, not using the
loadbalancer IP
between it, my kerberos Ticket is valid.
I get the feeling that when I use my loadbalancers and because
of that
I get a 301 redirect it needs a preauth. I see some issues on
mailinglists but it doesn't fit my situation.
Why wants it the preauth when I already have a valid ticket and my
redirect is followed by CURL and posted the right way ?
Can you describe the sequence?
What do you do?
From the client you try IPA CLI and this is where you see the
problem even with the valid ticket or is the flow different?
I hope someone has an idea.
Thanks,
Matt
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
