----- On Sep 26, 2016, at 1:30 PM, Sumit Bose sb...@redhat.com wrote:
> About the DNS SRV records, did you add matching records for _udp as
> well? I'm not sure if the AD client will fallback to _tcp if they are
> missing or just stop?
Ok, finally got some time to debug this.
tcpdump'ing in the IPA server and logging in, and analyzing the traffic in
wireshark I can see that some KRB5KDC_ERR_PREAUTH_REQUIRED traffic to both of
the KDC's as expected, followed by some AS-REQ and AS-REP, finally followed by
KRB5KRB_ERR-RESPONSE_TOO_BIG, source MAC is a Cisco router despite the server
being HP, so somewhere in the network a Cisco router is breaking our Kerberos.
I'll start hunting a solution somewhere else but IPA......
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project