I'm setting up two FreeIPA replicas with load balancer in front of them per
https://www.adelton.com/freeipa/freeipa-behind-load-balancer
Things work when authenticating with login and password.
I then want to enable GSSAPI/Negotiate for the WebUI. For that, I create host and service for the load balancer (webipa.example.com and HTTP/webipa.example.com), I add the principal to the ipa-http-delegation rule via
ipa servicedelegationrule-add-member ipa-http-delegation --principals=HTTP/webipa.example.com
and I fetch the keytab for the principal on the backend nodes. When I replace the original /etc/httpd/conf/ipa.keytab file with the new keytab with just the keys for HTTP/webipa.example.com, I can authenticate with my Firefox via Kerberos.
However, I'm afraid that by removing the original keys for HTTP/ipa1.int.example.com (resp. HTTP/ipa2.int.example.com) principal from /etc/httpd/conf/ipa.keytab, I might break something, at least the ability to access those backend machines via GSSAPI directly (not via the load balancer).
When I add the frontend keys to the original keytab file with ktutil with
read_kt /etc/httpd/conf/frontend.keytab write_kt /etc/httpd/conf/ipa.keytab quit
authentication fails with
ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Matching credential not found (filename: /var/run/ipa_memcached/krbcc_1222))
When I try to start with the frontend.keytab content by copying it over to ipa.keytab and append the backend keyts to that file -- then I can Kerberos-authenticate via the frontend but not with going to the backend URL directly.
So it looks like only the first principal in the keytab is considered at whatever stage which fails during the GSSAPI authentication.
This is a copy of https://www.redhat.com/archives/freeipa-users/2017-April/msg00165.html based on chat with Simo.
This PR: https://github.com/modauthgssapi/mod_auth_gssapi/pull/139 is a first step at addressing this issue.
Metadata Update from @pvoborni: - Issue set to the milestone: FreeIPA 4.7
The mod_auth_gssapi PR was merged. @simo, what other steps are needed for this?
Metadata Update from @rcritten: - Issue set to the milestone: FreeIPA 4.7.1 (was: FreeIPA 4.7)
FreeIPA 4.7 has been released, moving to FreeIPA 4.7.1 milestone
Login to comment on this ticket.