Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot Retrieve Kerberos Ticket #47

Open
YoungCree opened this issue Sep 14, 2020 · 2 comments
Open

Cannot Retrieve Kerberos Ticket #47

YoungCree opened this issue Sep 14, 2020 · 2 comments

Comments

@YoungCree
Copy link

Hey there, I'm having troubles with the kerberos ticket portion of the setup. When clicking on "Reset Password" I get "Cannot retrieve kerberos ticket". I'm able to grab a keytab and store it in /opt/data/IPAPasswordReset/passwordreset.keytab and I'm pointing to that in the settings.py ../passwordreset.keytab
I'm also able to run the command kinit -kt /opt/data/IPAPasswordReset/passwordreset.keytab passwordreset without any issues. Running klist -A I get the following:
Ticket cache: KCM:0:4774
Default principal: passwordreset@DOMAIN

Valid starting Expires Service principal
09/14/2020 09:53:36 09/15/2020 09:53:36 krbtgt/DOMAIN@DOMAIN
09/14/2020 10:02:55 09/15/2020 09:53:36 HTTP/server@DOMAIN

Ticket cache: KCM:0
Default principal: admin@DOMAIN

Valid starting Expires Service principal
09/10/2020 12:05:50 09/11/2020 12:05:47 krbtgt/DOMAIN@DOMAIN
09/10/2020 12:05:55 09/11/2020 12:05:47 cifs/SERVER@DOMAIN

Ticket cache: KCM:0:72320
Default principal: cifs/server@DOMAIN

Valid starting Expires Service principal
09/10/2020 12:07:04 09/11/2020 12:07:04 krbtgt/DOMAIN@DOMAIN

Do you know what's going on?
Thanks in advance for the help!

@larrabee
Copy link
Owner

Hello.
Please double check, that you properly follow the installation steps:

# Get keytab
ipa-getkeytab -p ldap-passwd-reset -k /opt/data/IPAPasswordReset/ldap-passwd-reset.keytab
# And change files owner
chown -R ldap-passwd-reset:ldap-passwd-reset /opt/data/IPAPasswordReset

@YoungCree
Copy link
Author

I generated the keytab using that method, and the password reset user has access to the entire directory, any other ideas?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants