Re: [Freeipa-users] Unable to access to web ui

2016-06-03 Thread Rob Crittenden 

seli irithyl wrote:

Yes, you're right, I was also surprised by the subject of the error.
I made changes in the /etc/httpd/conf.d/nss.conf file.
I changed
Listen 443 to Listen 8443
and
 to 
as it was in the /etc/httpd/conf.d/nss.conf file before the update.


You have to change it back. mod_nss must listen on 443.

rob



On Fri, Jun 3, 2016 at 3:30 PM, Rob Crittenden > wrote:

seli irithyl wrote:

# getcert list
returns 9 request ID. All 9 are in status "MONITORING" and
expire after
2017.
So no expired certificate.

Number of certificates and requests being tracked: 9.

[snip]

Request ID '20150313092456':
  status: MONITORING
  stuck: no
  key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
  certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
  CA: IPA
  issuer: CN=Certificate Authority,O=BIOINF.LOCAL
  subject: CN=lead.bioinf.local,O=BIOINF.LOCAL
  expires: 2017-03-13 09:24:56 UTC
  key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
  eku: id-kp-serverAuth,id-kp-clientAuth
  pre-save command:
  post-save command: /usr/lib64/ipa/certmonger/restart_httpd
  track: yes
  auto-renew: yes


[ more snip ]

 > Unfortunately when trying to run any ipa command:
 > [root@lead ~]# ipa service-find lead.bioinf.local
 > ipa: ERROR: cert validation failed for
 >

"E=root@lead.bioinf.local,CN=lead.bioinf.local,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--"
 > ((SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.)
 > ipa: ERROR: cannot connect to
'https://lead.bioinf.local/ipa/json':
 > (SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.


Note that the subject of the certmonger-tracked certificate is
different from the subject reported in the error. This looks like a
default mod_ssl-generated certificate to me. Did you tweak your
Apache config?

rob




--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] Unable to access to web ui

2016-06-03 Thread Rob Crittenden 

seli irithyl wrote:

# getcert list
returns 9 request ID. All 9 are in status "MONITORING" and expire after
2017.
So no expired certificate.

Number of certificates and requests being tracked: 9.

[snip]

Request ID '20150313092456':
 status: MONITORING
 stuck: no
 key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
 certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
 CA: IPA
 issuer: CN=Certificate Authority,O=BIOINF.LOCAL
 subject: CN=lead.bioinf.local,O=BIOINF.LOCAL
 expires: 2017-03-13 09:24:56 UTC
 key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
 eku: id-kp-serverAuth,id-kp-clientAuth
 pre-save command:
 post-save command: /usr/lib64/ipa/certmonger/restart_httpd
 track: yes
 auto-renew: yes


[ more snip ]

> Unfortunately when trying to run any ipa command:
> [root@lead ~]# ipa service-find lead.bioinf.local
> ipa: ERROR: cert validation failed for
> 
"E=root@lead.bioinf.local,CN=lead.bioinf.local,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--"
> ((SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.)
> ipa: ERROR: cannot connect to 'https://lead.bioinf.local/ipa/json':
> (SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.


Note that the subject of the certmonger-tracked certificate is different 
from the subject reported in the error. This looks like a default 
mod_ssl-generated certificate to me. Did you tweak your Apache config?


rob

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] Unable to access to web ui

2016-06-03 Thread seli irithyl 
# getcert list
returns 9 request ID. All 9 are in status "MONITORING" and expire after
2017.
So no expired certificate.

Number of certificates and requests being tracked: 9.
Request ID '20150313092422':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/dirsrv/slapd-BIOINF-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/dirsrv/slapd-BIOINF-LOCAL/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/dirsrv/slapd-BIOINF-LOCAL',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=BIOINF.LOCAL
subject: CN=lead.bioinf.local,O=BIOINF.LOCAL
expires: 2017-03-13 09:24:21 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_dirsrv BIOINF-LOCAL
track: yes
auto-renew: yes
Request ID '20150313092456':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate:
type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=BIOINF.LOCAL
subject: CN=lead.bioinf.local,O=BIOINF.LOCAL
expires: 2017-03-13 09:24:56 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
Request ID '20150710083112':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/nssdb',nickname='Server-Cert',token='NSS
Certificate DB'
certificate:
type=NSSDB,location='/etc/pki/nssdb',nickname='Server-Cert',token='NSS
Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=BIOINF.LOCAL
subject: CN=lead.bioinf.local,O=BIOINF.LOCAL
expires: 2017-07-10 08:31:16 UTC
principal name: host/lead.bioinf.local@BIOINF.LOCAL
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command:
track: yes
auto-renew: yes
Request ID '20160106131740':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=BIOINF.LOCAL
subject: CN=CA Audit,O=BIOINF.LOCAL
expires: 2017-03-02 09:24:01 UTC
key usage: digitalSignature,nonRepudiation
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160106131741':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=BIOINF.LOCAL
subject: CN=OCSP Subsystem,O=BIOINF.LOCAL
expires: 2017-03-02 09:24:00 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
eku: id-kp-OCSPSigning
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160106131742':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert
cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=BIOINF.LOCAL
subject: CN=CA Subsystem,O=BIOINF.LOCAL
expires: 2017-03-02 09:24:01 UTC
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command: /usr/lib64/ipa/certmonger/stop_pkicad
post-save command: /usr/lib64/ipa/certmonger/renew_ca_cert
"subsystemCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160106131743':
status: MONITORING
stuck: no
key pair storage:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert
cert-pki-ca',token='NSS Certificate DB',pin set
certificate:
type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert

Re: [Freeipa-users] Unable to access to web ui

2016-06-03 Thread Petr Vobornik 
On 06/03/2016 11:11 AM, seli irithyl wrote:
> Sorry Martin,
> I rebooted the IdM server:
> [root@lead sssd]# ipactl status
> Directory Service: RUNNING
> krb5kdc Service: RUNNING
> kadmin Service: RUNNING
> ipa_memcached Service: RUNNING
> httpd Service: RUNNING
> pki-tomcatd Service: RUNNING
> ipa-otpd Service: RUNNING
> ipa: INFO: The ipactl command was successful
> 
> I checked DNS and it is ok
> 
> I can login from any host.
> 
> Unfortunately when trying to run any ipa command:
> [root@lead ~]# ipa service-find lead.bioinf.local
> ipa: ERROR: cert validation failed for 
> "E=root@lead.bioinf.local,CN=lead.bioinf.local,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--"
>  
> ((SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.)
> ipa: ERROR: cannot connect to 'https://lead.bioinf.local/ipa/json': 
> (SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.
> 
> Is anybody has an idea on where and what to check next ?
> Thx,
> 
> Seli
> 

does
 # getcert list

show any expired certificate?

Do you use IPA with externally signed CA cert? Are they valid?

> 
> 
> On Tue, May 31, 2016 at 8:33 AM, Martin Kosek  > wrote:
> 
> Hello Seli,
> 
> Please reply to mailing list directly so that others can benefit from the
> thread as well.
> 
> Thanks,
> Martin
> 
> On 05/30/2016 06:17 PM, seli irithyl wrote:
>  > Freeipa version : 4.2.0-15.0.1.el7.centos.6.1
>  > FF: 45.1.1
>  > Could this problem be related to mod_ssl and mod_nss for httpd ?
>  > Looking the logs, it seems there are lots of problems, here are some
> parts that
>  > look strange to me (and are probably unrelated) :
>  > 1 sssd:
>  >  1.1 krb5_child.log
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [unpack_buffer]
>  > (0x0100): cmd [249] uid [1713400053] gid [1713400053] validate [true]
> enterprise
>  > principal [false] offline [false] UPN [koto@BIOINF.LOCAL]
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [k5c_setup_fast]
>  > (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to
> [host/lead.bioinf.local@BIOINF.LOCAL]
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
>  > [check_fast_ccache] (0x0200): FAST TGT is still valid.
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832 
> [become_user]
>  > (0x0200): Trying to become user [1713400053][1713400053].
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
>  > [set_lifetime_options] (0x0100): SSSD_KRB5_RENEWABLE_LIFETIME is set 
> to [7d]
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
>  > [set_lifetime_options] (0x0100): SSSD_KRB5_LIFETIME is set to [1d]
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
>  > [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to 
> [true]
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
>  > [sss_krb5_prompter] (0x0020): Cannot handle password prompts.
>  >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [k5c_send_data]
>  > (0x0200): Received error code 0
>  >  1.2 sssd_bioinf.local.log
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [check_ccache_files] (0x0200): Failed to check ccache file
>  > [KEYRING:persistent:1713400031].
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [check_ccache_files] (0x0200): Failed to check ccache file
>  > [KEYRING:persistent:1713400053].
>  >  ...
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [check_and_export_options] (0x0100): No KDC explicitly configured, 
> using
> defaults.
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [check_and_export_options] (0x0100): No kpasswd server explicitly 
> configured,
>  > using the KDC or defaults.
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty!
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [load_backend_module] (0x0200): no module name found in confdb, using 
> [ipa].
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [common_parse_search_base] (0x0100): Search base added:
>  > [SUDO][ou=SUDOers,dc=bioinf,dc=local][SUBTREE][]
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> [check_ipv4_addr]
>  > (0x0200): Loopback IPv4 address 127.0.0.1
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> [check_ipv6_addr]
>  > (0x0200): Loopback IPv6 address ::1
>  >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
>  > [load_backend_module] (0x0200): no module name found in confdb, using 
>

Re: [Freeipa-users] Unable to access to web ui

2016-06-03 Thread seli irithyl 
Sorry Martin,
I rebooted the IdM server:
[root@lead sssd]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
ipa_memcached Service: RUNNING
httpd Service: RUNNING
pki-tomcatd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful

I checked DNS and it is ok

I can login from any host.

Unfortunately when trying to run any ipa command:
[root@lead ~]# ipa service-find lead.bioinf.local
ipa: ERROR: cert validation failed for
"E=root@lead.bioinf.local,CN=lead.bioinf.local,OU=SomeOrganizationalUnit,O=SomeOrganization,L=SomeCity,ST=SomeState,C=--"
((SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.)
ipa: ERROR: cannot connect to 'https://lead.bioinf.local/ipa/json':
(SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid.

Is anybody has an idea on where and what to check next ?
Thx,

Seli



On Tue, May 31, 2016 at 8:33 AM, Martin Kosek  wrote:

> Hello Seli,
>
> Please reply to mailing list directly so that others can benefit from the
> thread as well.
>
> Thanks,
> Martin
>
> On 05/30/2016 06:17 PM, seli irithyl wrote:
> > Freeipa version : 4.2.0-15.0.1.el7.centos.6.1
> > FF: 45.1.1
> > Could this problem be related to mod_ssl and mod_nss for httpd ?
> > Looking the logs, it seems there are lots of problems, here are some
> parts that
> > look strange to me (and are probably unrelated) :
> > 1 sssd:
> >  1.1 krb5_child.log
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [unpack_buffer]
> > (0x0100): cmd [249] uid [1713400053] gid [1713400053] validate [true]
> enterprise
> > principal [false] offline [false] UPN [koto@BIOINF.LOCAL]
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [k5c_setup_fast]
> > (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to
> [host/lead.bioinf.local@BIOINF.LOCAL]
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> > [check_fast_ccache] (0x0200): FAST TGT is still valid.
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [become_user]
> > (0x0200): Trying to become user [1713400053][1713400053].
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> > [set_lifetime_options] (0x0100): SSSD_KRB5_RENEWABLE_LIFETIME is set to
> [7d]
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> > [set_lifetime_options] (0x0100): SSSD_KRB5_LIFETIME is set to [1d]
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> > [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to
> [true]
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> > [sss_krb5_prompter] (0x0020): Cannot handle password prompts.
> >  (Mon May 30 17:18:05 2016) [[sssd[krb5_child[32832
> [k5c_send_data]
> > (0x0200): Received error code 0
> >  1.2 sssd_bioinf.local.log
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [check_ccache_files] (0x0200): Failed to check ccache file
> > [KEYRING:persistent:1713400031].
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [check_ccache_files] (0x0200): Failed to check ccache file
> > [KEYRING:persistent:1713400053].
> >  ...
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [check_and_export_options] (0x0100): No KDC explicitly configured, using
> defaults.
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [check_and_export_options] (0x0100): No kpasswd server explicitly
> configured,
> > using the KDC or defaults.
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [parse_krb5_map_user] (0x0200): Warning: krb5_map_user is empty!
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [load_backend_module] (0x0200): no module name found in confdb, using
> [ipa].
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [common_parse_search_base] (0x0100): Search base added:
> > [SUDO][ou=SUDOers,dc=bioinf,dc=local][SUBTREE][]
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> [check_ipv4_addr]
> > (0x0200): Loopback IPv4 address 127.0.0.1
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> [check_ipv6_addr]
> > (0x0200): Loopback IPv6 address ::1
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [load_backend_module] (0x0200): no module name found in confdb, using
> [ipa].
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [common_parse_search_base] (0x0100): Search base added:
> > [AUTOFS][cn=default,cn=automount,dc=bioinf,dc=local][SUBTREE][]
> >  (Mon May 30 17:16:01 2016) [sssd[be[bioinf.local]]]
> > [load_backend_module] (0x0200): no module name found in confdb, using
> [ipa].
> >  ...
> >  (Mon May 30 17:16:11 2016) [sssd[be[bioinf.local]]]
> > [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse
> domain SID
> > from [(null)]
> >  (Mon May 30 17:16:11 2016)

Re: [Freeipa-users] Unable to access to web ui

2016-05-30 Thread Martin Kosek 
On 05/30/2016 04:36 PM, Martin Basti wrote:
> 
> 
> On 30.05.2016 14:20, seli irithyl wrote:
>> Hi,
>>
>> Since last update, I'am unable to log in to web ui with FF (e.g. blank page)
>> Any idea where too look for ?
>>
>> Best regards,
>>
>> Seli
>>
>>
>>
>>
>>
> Hello,
> 
> can you provide version of the freeIPA, firefox. Does it work from different 
> browser? does it work from private mode?

+ does [CTRL]+F5 helps? Do advise in
http://www.freeipa.org/page/Troubleshooting#Web_UI
help?

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] Unable to access to web ui

2016-05-30 Thread Martin Basti 



On 30.05.2016 14:20, seli irithyl wrote:

Hi,

Since last update, I'am unable to log in to web ui with FF (e.g. blank 
page)

Any idea where too look for ?

Best regards,

Seli






Hello,

can you provide version of the freeIPA, firefox. Does it work from 
different browser? does it work from private mode?


Martin
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

[Freeipa-users] Unable to access to web ui

2016-05-30 Thread seli irithyl 
Hi,

Since last update, I'am unable to log in to web ui with FF (e.g. blank page)
Any idea where too look for ?

Best regards,

Seli
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project