Thanks for reply Rob!
> /var/log/krb5kdc.log might have more details on the GSS failures, or the
> journal.
Yeah, I've checked that as well. Unfortunately 'Preauthentication failed' Was
no more explanatory to me.
After two weeks of searching for answers, I gave up and decided to reinstall
ipa server.
I guess, one has to have much deeper knowledge to use it properly and I am just
a mortal user :)
/var/log/krb5kdc.log
38:21 (info): TGS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18),
aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20),
aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16),
DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: ISSUE: authtime 1568572691, etypes
{rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18),
ses=aes256-cts-hmac-sha1-96(18)}, ad...@home.mydomain.com for
HTTP/ipa.home.mydomain....@home.mydomain.com
38:21 (info): closing down fd 11
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18),
aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20),
aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16),
DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: NEEDED_PREAUTH:
HTTP/ipa.home.mydomain....@home.mydomain.com for
krbtgt/home.mydomain....@home.mydomain.com, Additional pre-authentication
required
38:21 (info): closing down fd 11
38:21 (info): preauth (spake) verify failure: Preauthentication failed
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18),
aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20),
aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16),
DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: PREAUTH_FAILED:
HTTP/ipa.home.mydomain....@home.mydomain.com for
krbtgt/home.mydomain....@home.mydomain.com, Preauthentication failed
38:21 (info): closing down fd 11
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18),
aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20),
aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16),
DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: NEEDED_PREAUTH:
HTTP/ipa.home.mydomain....@home.mydomain.com for
krbtgt/home.mydomain....@home.mydomain.com, Additional pre-authentication
required
38:21 (info): closing down fd 11
38:21 (info): preauth (spake) verify failure: Preauthentication failed
38:21 (info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18),
aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20),
aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16),
DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25),
camellia256-cts-cmac(26)}) 10.0.1.10: PREAUTH_FAILED:
HTTP/ipa.home.mydomain....@home.mydomain.com for
krbtgt/home.mydomain....@home.mydomain.com, Preauthentication failed
38:21 (info): closing down fd 11
Cheers!
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
