Re: [Freeipa-users] Cannot login with GSSAPI to IPA client

2015-06-17 Thread nathan
On Tue, Jun 16, 2015 at 04:32:31PM -0700, nat...@nathanpeters.com wrote: I have 2 CentOS 6 clients both running FreeIPA client 3.0.0-42 and sssd 1.11.6-30. The server is CentOS 7 / IPA 4.1.3 When I try to log in using MIT kerberos and a valid ticket it works on one client, and fails on the

Re: [Freeipa-users] Crazy Cert problem?

2015-06-17 Thread Rob Crittenden
Janelle wrote: On 6/17/15 6:21 AM, Rob Crittenden wrote: Janelle wrote: On 6/17/15 6:14 AM, Rob Crittenden wrote: Janelle wrote: Hi, Had a server - named ipa001.example.com -- it was a replica. It died. It was re-installed. However, prior to the re-install it was saying the wonderful: TLS

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Piotr Baranowski
- 17 cze 2015 o 16:45, Piotr Baranowski piotr.baranow...@osec.pl napisał(a): - 17 cze 2015 o 16:21, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17 Jun 2015, Piotr Baranowski wrote: - 17 cze 2015 o 15:51, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Rob Crittenden
Piotr Baranowski wrote: - 17 cze 2015 o 15:51, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17 Jun 2015, Piotr Baranowski wrote: - Oryginalna wiadomość - Od: Alexander Bokovoy aboko...@redhat.com So you have two different certificates in use here and your client

Re: [Freeipa-users] CentOS 6.6 Installation Issues

2015-06-17 Thread Randall Harrison
Hey Rob, I tried the install again with Java 1.7 and no joy. Do you recommend a clean install with 1.7? On Jun 17, 2015 6:15 AM, Rob Crittenden rcrit...@redhat.com wrote: Randall Harrison wrote: Hello freeipa! I am having difficulty installing freeipa on a freshly installed CentOS6.6 box.

Re: [Freeipa-users] CentOS 6.6 Installation Issues

2015-06-17 Thread Rob Crittenden
Randall Harrison wrote: Hey Rob, I tried the install again with Java 1.7 and no joy. Do you recommend a clean install with 1.7? Be sure the CA is completely uninstalled. The installer sometimes doesn't record that a CA has been partially installed causing the uninstall to skip it, which

Re: [Freeipa-users] OTP - Google Authenticator - iPhone - Invalid barcode

2015-06-17 Thread Nathaniel McCallum
The change that you made might break other things. On Wed, 2015-06-17 at 22:45 +0530, Prashant Bapat wrote: Hi Nathaniel, I think your patch should work. Please give me a day to test and confirm. However, I changed this section in otptoken.py:

Re: [Freeipa-users] OTP - Google Authenticator - iPhone - Invalid barcode

2015-06-17 Thread Prashant Bapat
Hi Nathaniel, I think your patch should work. Please give me a day to test and confirm. However, I changed this section in otptoken.py: StrEnum('ipatokenotpalgorithm?', cli_name='algo', label=_('Algorithm'), doc=_('Token hash algorithm'),

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
Hello! Thanks, currently I'm trying to re-initialize all our replicas, hope this will fix most issues. WBR, Alexander Frolushkin Cell +79232508764 Work +79232507764 From: thierry bordaz [mailto:tbor...@redhat.com] Sent: Wednesday, June 17, 2015 6:40 PM To: Alexander Frolushkin (SIB) Cc: 'Ludwig

[Freeipa-users] Changing the SSL certificate for the WebUI

2015-06-17 Thread Prashant Bapat
Hi All, There is a way to change the certificate for the web UI. I went with a standard install with a self signed CA etc. Now I want to install a cert from a commercial CA. I don't mind using the IPA CA certs for the 389 DS, just want to change the cert for the UI. Any pointers on how to do

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread thierry bordaz
On 06/17/2015 01:38 PM, Alexander Frolushkin wrote: Ok, I'll try this soon, thank you! Also, please note, most of today dups appeared when 4 of 19 servers was very busy in IO (all our servers are VMs), because dirsrv debug was enabled to gather logs for our case about attrlist_replace -

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
Except: unable to decode: {replica 22} 5576b83e00020016 5576ba4b00020016 unable to decode: {replica 20} 55716e5700030014 55716e5700030014 unable to decode: {replica 16} 548a81260010 548a81260010 unable to decode: {replica 24} 557fb7d400040018

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Alexander Bokovoy
On Wed, 17 Jun 2015, Henry Hofmann wrote: For redmine use http://www.redmine.org/plugins/redmine_pam_auth. You don't need to include the user which runs redmine into shadow group with FreeIPA because user accounts are never in /etc/shadow for FreeIPA so you don't need that access. What you

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
Ok, I'll try this soon, thank you! Also, please note, most of today dups appeared when 4 of 19 servers was very busy in IO (all our servers are VMs), because dirsrv debug was enabled to gather logs for our case about attrlist_replace - attr_replace (nsslapd-referral,

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Henry Hofmann
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 It should be possible, yes - if you target web service/Red Mine to the compat tree, as it was done for example in this integration: http://www.freeipa.org/page/HowTo/vsphere5_integration Tanks, your expression is very helpful for

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Alexander Bokovoy
On Wed, 17 Jun 2015, Henry Hofmann wrote: Thanks, I get more and more information and amazed about FreeIPA and functionally. I can successfully login in Redmine and Cloud with users from the trust domain. I have add additional attributes for the user accounts like mail etc. For the external

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
On 06/17/2015 12:57 PM, Alexander Frolushkin wrote: Unfortunately, number of duplicates grows dramatically on most sites. Some servers already have over 40 duplicates. Could you please say, may I use re-initialize on falling replica from the good one to fix this? If you have a good one,

[Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Piotr Baranowski
Hi list! I have a challenging setup i need some help with. My topology: EXTERNAL CLIENTS - INTERNET - SERVER - IPA - INTERNAL CLIENTS There is no problem with Internal clients. They register/enroll and then work like a charm. The challenge is how external access IPA server. Firewall

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Piotr Baranowski
- Oryginalna wiadomość - Od: Alexander Bokovoy aboko...@redhat.com So you have two different certificates in use here and your client doesn't know about the other certificate (from your proxy). You need either to deliver that certificate to the client by yourself or change your

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Alexander Bokovoy
On Wed, 17 Jun 2015, Piotr Baranowski wrote: Hi list! I have a challenging setup i need some help with. My topology: EXTERNAL CLIENTS - INTERNET - SERVER - IPA - INTERNAL CLIENTS There is no problem with Internal clients. They register/enroll and then work like a charm. The challenge is how

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
Hello. Another example. Today appeared on servers of different site. Original LDIF: # extended LDIF # # LDAPv3 # base cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru with scope subtree # filter: (objectclass=*) # requesting: ALL # # System: Manage Host Keytab,

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
Hi, this is really strange, if these conflict entries get created they should be the same on all servers. could you repeat the two searches requesting the attribute nscpentrywsi (you have to do it as directory manager, and add -o ldif-wrap=no), it could give info when and where these entries

[Freeipa-users] Firefox issue with web ui certificate

2015-06-17 Thread Prashant Bapat
Hi, I have gotten into a strange situation. I'm running FreeIPA for 2 different environments, dev/production. By mistake, the domain for both are configured same. Say EXAMPLE.COM. Now the problem users are facing when using the web UI using Firefox. It complains that the secure connection failed

Re: [Freeipa-users] OTP - Google Authenticator - iPhone - Invalid barcode

2015-06-17 Thread Prashant Bapat
Simo is right! This issue is same as https://fedorahosted.org/freeipa/ticket/5047 If I change the algorithm in the otp url to uppercase it scans in Google authenticator/iPhone. Further more I manually edited the /usr/lib/python2.7/site-packages/ipalib/plugins/otptoken.py and uppercases the 'sha'

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Henry Hofmann
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 It should be possible, yes - if you target web service/Red Mine to the compat tree, as it was done for example in this integration: http://www.freeipa.org/page/HowTo/vsphere5_integration Tanks, your expression is very helpful for nested group

Re: [Freeipa-users] Cannot login with GSSAPI to IPA client

2015-06-17 Thread Sumit Bose
On Tue, Jun 16, 2015 at 04:32:31PM -0700, nat...@nathanpeters.com wrote: I have 2 CentOS 6 clients both running FreeIPA client 3.0.0-42 and sssd 1.11.6-30. The server is CentOS 7 / IPA 4.1.3 When I try to log in using MIT kerberos and a valid ticket it works on one client, and fails on the

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Martin Kosek
On 06/15/2015 02:19 PM, Henry Hofmann wrote: Hi, I have a question about using IPA (v.4) with an AD (2012) Trust. Is it possible to login with a user from the Active Directory Domain to an Web-Service (like redmine) which is configured to the IPA LDAP? I have understand this by read this

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
Hi, you did send the data directly to me, maybe not wanting to share them to everyone. I'll continue discussion here, trying to be careful. The good entry was created in April on replica 12 0x0c createTimestamp;vucsn-5524d42b0067000c: 20150408070720Z the nsuniqueid entry was created

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
This is correct, thank you for understanding and for helping! Replica with id 26 was created today, this is our new server which was included in domain just a few hours ago. Looks like this dup came right after this new replica creation. WBR, Alexander Frolushkin Cell +79232508764 Work

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
On 06/17/2015 11:03 AM, Alexander Frolushkin wrote: This is correct, thank you for understanding and for helping! Replica with id 26 was created today, this is our new server which was included in domain just a few hours ago. Looks like this dup came right after this new replica creation.

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
# grep conn=237 ./access [17/Jun/2015:14:37:03 +0600] conn=237 fd=71 slot=71 connection from 10.99.75.82 to 10.61.8.2 [17/Jun/2015:14:37:03 +0600] conn=237 op=0 BIND dn= method=sasl version=3 mech=GSSAPI [17/Jun/2015:14:37:03 +0600] conn=237 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
This is not a good news, because replica id 20 is not exist for a some days already. It was recreated and now have id 23 WBR, Alexander Frolushkin Cell +79232508764 Work +79232507764 From: thierry bordaz [mailto:tbor...@redhat.com] Sent: Wednesday, June 17, 2015 4:10 PM To: Alexander Frolushkin

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
Will this be enough? # grep conn=237 op=93 ./access [17/Jun/2015:14:39:46 +0600] conn=237 op=93 ADD dn=cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru [17/Jun/2015:14:39:46 +0600] conn=237 op=93 RESULT err=0 tag=105 nentries=0 etime=0 csn=555ac9360014 #

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
conn=237 is from 10.99.75.82 which replica is this ? msk-rhidm-03.unix.megafon.ru:389: 10 On 06/17/2015 12:13 PM, Alexander Frolushkin wrote: This is not a good news, because replica id 20 is not exist for a some days already. It was recreated and now have id 23 WBR, Alexander Frolushkin Cell

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
conn=237 is from 10.99.75.82 which replica is this ? On 06/17/2015 12:13 PM, Alexander Frolushkin wrote: This is not a good news, because replica id 20 is not exist for a some days already. It was recreated and now have id 23 WBR, Alexander Frolushkin Cell +79232508764 Work +79232507764

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
In access log: [17/Jun/2015:10:08:01 +0600] conn=2 op=91 ADD dn=cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru [17/Jun/2015:10:08:01 +0600] conn=2 op=91 RESULT err=0 tag=105 nentries=0 etime=0 csn=5580f321001a There is a lot of strange around this time in

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
I'm pretty sure id 26 is unique ipa-replica-manage list-ruv Directory Manager password: unable to decode: {replica 20} 555ac82600010014 55716e5700030014 unable to decode: {replica 24} 557fb7d400040018 557fb9a100100018 unable to decode: {replica 22} 5576b83e00010016

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Sumit Bose
On Wed, Jun 17, 2015 at 08:21:22AM +, Henry Hofmann wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 It should be possible, yes - if you target web service/Red Mine to the compat tree, as it was done for example in this integration:

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
This was a usual ipa-replica-install --setup-ca --setup-dns and after that ipa-adtrust-install. No DEL found: # grep cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru ./access [17/Jun/2015:10:08:01 +0600] conn=2 op=89 SRCH base=cn=System: Manage Host

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread thierry bordaz
On 06/17/2015 11:22 AM, Alexander Frolushkin wrote: This was a usual ipa-replica-install --setup-ca --setup-dns and after that ipa-adtrust-install. No DEL found: # grep cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru ./access [17/Jun/2015:10:08:01 +0600]

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Alexander Frolushkin
Unfortunately, number of duplicates grows dramatically on most sites. Some servers already have over 40 duplicates. Could you please say, may I use re-initialize on falling replica from the good one to fix this? WBR, Alexander Frolushkin Cell +79232508764 Work +79232507764 From: Ludwig

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread thierry bordaz
Hello Alexander, How did you initialize that new replica 26. Either 'cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru' was not part of the total init data, or a DEL of that entry happened on replica 26 (before a new ADD) but the DEL was not replicated to

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
On 06/17/2015 11:52 AM, Ludwig Krispenz wrote: On 06/17/2015 11:45 AM, thierry bordaz wrote: On 06/17/2015 11:22 AM, Alexander Frolushkin wrote: This was a usual ipa-replica-install --setup-ca --setup-dns and after that ipa-adtrust-install. No DEL found: # grep cn=System: Manage Host

Re: [Freeipa-users] Firefox issue with web ui certificate

2015-06-17 Thread Fraser Tweedale
On Wed, Jun 17, 2015 at 12:40:37PM +0530, Prashant Bapat wrote: Hi, I have gotten into a strange situation. I'm running FreeIPA for 2 different environments, dev/production. By mistake, the domain for both are configured same. Say EXAMPLE.COM. Now the problem users are facing when using

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread Ludwig Krispenz
On 06/17/2015 11:45 AM, thierry bordaz wrote: On 06/17/2015 11:22 AM, Alexander Frolushkin wrote: This was a usual ipa-replica-install --setup-ca --setup-dns and after that ipa-adtrust-install. No DEL found: # grep cn=System: Manage Host

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread thierry bordaz
On 06/17/2015 11:56 AM, Alexander Frolushkin wrote: Will this be enough? # grep conn=237 op=93 ./access [17/Jun/2015:14:39:46 +0600] conn=237 op=93 ADD dn=cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=unix,dc=megafon,dc=ru [17/Jun/2015:14:39:46 +0600] conn=237 op=93 RESULT err=0

Re: [Freeipa-users] Crazy Cert problem?

2015-06-17 Thread Janelle
On 6/17/15 6:14 AM, Rob Crittenden wrote: Janelle wrote: Hi, Had a server - named ipa001.example.com -- it was a replica. It died. It was re-installed. However, prior to the re-install it was saying the wonderful: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the

Re: [Freeipa-users] Crazy Cert problem?

2015-06-17 Thread Janelle
On 6/17/15 6:21 AM, Rob Crittenden wrote: Janelle wrote: On 6/17/15 6:14 AM, Rob Crittenden wrote: Janelle wrote: Hi, Had a server - named ipa001.example.com -- it was a replica. It died. It was re-installed. However, prior to the re-install it was saying the wonderful: TLS error

Re: [Freeipa-users] Crazy Cert problem?

2015-06-17 Thread Rob Crittenden
Janelle wrote: Hi, Had a server - named ipa001.example.com -- it was a replica. It died. It was re-installed. However, prior to the re-install it was saying the wonderful: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user. It was rebuilt - new OS and doing a

Re: [Freeipa-users] replication conflicts

2015-06-17 Thread thierry bordaz
On 06/17/2015 02:27 PM, Alexander Frolushkin wrote: Except: unable to decode: {replica 22} 5576b83e00020016 5576ba4b00020016 unable to decode: {replica 20} 55716e5700030014 55716e5700030014 unable to decode: {replica 16} 548a81260010 548a81260010 unable to

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Henry Hofmann
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Ok, how can I configure the map of source attributes (mail or any other) to compat tree? Thanks and best regards, Henry - -Original Message- From: Alexander Bokovoy [mailto:aboko...@redhat.com] Sent: Mittwoch, 17. Juni 2015 14:20 To:

Re: [Freeipa-users] Crazy Cert problem?

2015-06-17 Thread Rob Crittenden
Janelle wrote: On 6/17/15 6:14 AM, Rob Crittenden wrote: Janelle wrote: Hi, Had a server - named ipa001.example.com -- it was a replica. It died. It was re-installed. However, prior to the re-install it was saying the wonderful: TLS error -8172:Peer's certificate issuer has been marked as

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Alexander Bokovoy
On Wed, 17 Jun 2015, Piotr Baranowski wrote: - Oryginalna wiadomość - Od: Alexander Bokovoy aboko...@redhat.com So you have two different certificates in use here and your client doesn't know about the other certificate (from your proxy). You need either to deliver that certificate to

Re: [Freeipa-users] Question for AD trust and Webservices

2015-06-17 Thread Alexander Bokovoy
On Wed, 17 Jun 2015, Henry Hofmann wrote: Ok, how can I configure the map of source attributes (mail or any other) to compat tree? Go back in archives in this list and read discussions about Single mail deployment in an FreeIPA-WindowsAD scenario. TLDR; not possible in the compat tree as of

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Piotr Baranowski
- 17 cze 2015 o 16:21, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17 Jun 2015, Piotr Baranowski wrote: - 17 cze 2015 o 15:51, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17 Jun 2015, Piotr Baranowski wrote: - Oryginalna wiadomość - Od: Alexander

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Alexander Bokovoy
On Wed, 17 Jun 2015, Piotr Baranowski wrote: - 17 cze 2015 o 15:51, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17 Jun 2015, Piotr Baranowski wrote: - Oryginalna wiadomość - Od: Alexander Bokovoy aboko...@redhat.com So you have two different certificates in use here

Re: [Freeipa-users] FreeIPA 4.1.0 server behind apache/mod_proxy

2015-06-17 Thread Piotr Baranowski
- 17 cze 2015 o 15:51, Alexander Bokovoy aboko...@redhat.com napisał(a): On Wed, 17 Jun 2015, Piotr Baranowski wrote: - Oryginalna wiadomość - Od: Alexander Bokovoy aboko...@redhat.com So you have two different certificates in use here and your client doesn't know about the other

Re: [Freeipa-users] Crazy Cert problem?

2015-06-17 Thread Janelle
On 6/17/15 6:21 AM, Rob Crittenden wrote: Janelle wrote: On 6/17/15 6:14 AM, Rob Crittenden wrote: Janelle wrote: Hi, Had a server - named ipa001.example.com -- it was a replica. It died. It was re-installed. However, prior to the re-install it was saying the wonderful: TLS error

Re: [Freeipa-users] OTP - Google Authenticator - iPhone - Invalid barcode

2015-06-17 Thread Nathaniel McCallum
Prashant, I have proposed a patch for the issue: https://www.redhat.com/archives/freeipa-devel/2015-June/msg00505.html Please test it and let me know if it works for you. Nathaniel On Wed, 2015-06-17 at 12:35 +0530, Prashant Bapat wrote: Simo is right! This issue is same as

Re: [Freeipa-users] Cannot login with GSSAPI to IPA client

2015-06-17 Thread Simo Sorce
On Wed, 2015-06-17 at 09:17 -0700, nat...@nathanpeters.com wrote: On Tue, Jun 16, 2015 at 04:32:31PM -0700, nat...@nathanpeters.com wrote: I have 2 CentOS 6 clients both running FreeIPA client 3.0.0-42 and sssd 1.11.6-30. The server is CentOS 7 / IPA 4.1.3 When I try to log in using MIT

Re: [Freeipa-users] Cannot login with GSSAPI to IPA client

2015-06-17 Thread nathan
On Tue, Jun 16, 2015 at 04:32:31PM -0700, nat...@nathanpeters.com wrote: I have 2 CentOS 6 clients both running FreeIPA client 3.0.0-42 and sssd 1.11.6-30. The server is CentOS 7 / IPA 4.1.3 When I try to log in using MIT kerberos and a valid ticket it works on one client, and fails on the