A tool that can diagnose an IPA client or server installation would be a handy thing to have, and could be built up over time.

Initial things it could do:

• Validate that keytabs are ok (known only, /etc/krb5.keytab, /etc/httpd/conf/ipa.keytab and /etc/dirsrv/ds.keytab)
• Get a host TGT
• Verify that the certificates are ok (start with HTTP and DS, maybe machine cert)
• Connectivity, perhaps using the conncheck tool.
• Replication status, perhaps

It would be nice if it could scan logs for issues, such as AVCs for processes we care about.

Needs design page to more fully flesh out details.

One should be able to run the same tool on clients as well, just a subset of the features would apply.