==================================== ERRORS ====================================
 ERROR at setup of TestServerRoleStatusRetrieval.test_listing_of_enabled_role[role: IPA master, master: configured-ca, enabled]

request = <SubRequest 'mock_api' for <Function 'test_listing_of_enabled_role[role: IPA master, master: configured-ca, enabled]'>>

    @pytest.fixture(scope='module')
    def mock_api(request):
        test_api = create_api(mode=None)
        test_api.bootstrap(in_server=True, in_tree=True)
        test_api.finalize()

        if not test_api.Backend.ldap2.isconnected():
>           test_api.Backend.ldap2.connect()

test_ipaserver/test_serverroles.py:476: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../ipalib/backend.py:66: in connect
    conn = self.create_connection(*args, **kw)
../ipaserver/plugins/ldap2.py:205: in create_connection
    client_controls=clientctrls)
../ipapython/ipaldap.py:1104: in gssapi_bind
    '', auth_tokens, server_controls, client_controls)
/usr/lib64/python2.7/contextlib.py:35: in __exit__
    self.gen.throw(type, value, traceback)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <ipapython.ipaldap.LDAPClient object at 0x7f189ee94e90>, arg_desc = None

    @contextlib.contextmanager
    def error_handler(self, arg_desc=None):
        """Context manager that handles LDAPErrors
            """
        try:
            try:
                yield
            except ldap.TIMEOUT:
                raise errors.DatabaseTimeout()
            except ldap.LDAPError as e:
                desc = e.args[0]['desc'].strip()
                info = e.args[0].get('info', '').strip()
                if arg_desc is not None:
                    info = "%s arguments: %s" % (info, arg_desc)
                raise
        except ldap.NO_SUCH_OBJECT:
            raise errors.NotFound(reason=arg_desc or 'no such entry')
        except ldap.ALREADY_EXISTS:
            raise errors.DuplicateEntry()
        except ldap.CONSTRAINT_VIOLATION:
            # This error gets thrown by the uniqueness plugin
            _msg = 'Another entry with the same attribute value already exists'
            if info.startswith(_msg):
                raise errors.DuplicateEntry()
            else:
                raise errors.DatabaseError(desc=desc, info=info)
        except ldap.INSUFFICIENT_ACCESS:
            raise errors.ACIError(info=info)
        except ldap.INVALID_CREDENTIALS:
            raise errors.ACIError(info="%s %s" % (info, desc))
        except ldap.INAPPROPRIATE_AUTH:
            raise errors.ACIError(info="%s: %s" % (desc, info))
        except ldap.NO_SUCH_ATTRIBUTE:
            # this is raised when a 'delete' attribute isn't found.
            # it indicates the previous attribute was removed by another
            # update, making the oldentry stale.
            raise errors.MidairCollision()
        except ldap.INVALID_SYNTAX:
            raise errors.InvalidSyntax(attr=info)
        except ldap.OBJECT_CLASS_VIOLATION:
            raise errors.ObjectclassViolation(info=info)
        except ldap.ADMINLIMIT_EXCEEDED:
            raise errors.AdminLimitExceeded()
        except ldap.SIZELIMIT_EXCEEDED:
            raise errors.SizeLimitExceeded()
        except ldap.TIMELIMIT_EXCEEDED:
            raise errors.TimeLimitExceeded()
        except ldap.NOT_ALLOWED_ON_RDN:
            raise errors.NotAllowedOnRDN(attr=info)
        except ldap.FILTER_ERROR:
            raise errors.BadSearchFilter(info=info)
        except ldap.NOT_ALLOWED_ON_NONLEAF:
            raise errors.NotAllowedOnNonLeaf()
        except ldap.SERVER_DOWN:
            raise errors.NetworkError(uri=self.ldap_uri,
                                      error=info)
        except ldap.LOCAL_ERROR:
>           raise errors.ACIError(info=info)
E           ACIError: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server ldap/localhost@<REALM> not found in Kerberos database)