[389-users] use GSSAPI behind a haproxy

Hello!
I'm trying setup balancing freeipa with haproxy, using this article: http://directory.fedoraproject.org/docs/389ds/howto/howto-loadbalance-gssapi.html,

On this step:
-------
On the ldap1 server you should extract this keytab:

kinit <account with admins privilige>
ipa-getkeytab -s dc.ipa.example.com -p ldap/haproxydemo.ipa.example.com -k /etc/dirsrv/slapd-localhost/ldap.keytab --retrieve

Important is the –retrieve flag to prevent the keytab contents changing.
------
First, a got "failed to parse result insufficient access rights" error

After:
ipa service-allow-retrieve-keytab ldap/haproxydemo.ipa.example.com --groups=admins

i get the following error:
Failed to parse result: krbPrincipalKey not found

So, i run it without -r key. It success.
Then, after i'm adding KRB5_KTNAME=/etc/dirsrv/slapd-localhost/ldap.keytab to /etc/sysconfig/dirsrv-<instance>
After this freeipa fails to start
In my setup - haproxydemo.ipa.example.com - is a haproxy (with ipa client, A/PTR records)

ldap1.ipa.example.com (ldap2, ldap3) is a working freeipa replicas

Any advices, what am i doing wrong?

Host os
Fedora server 25

Freeipa
VERSION: 4.5.4, API_VERSION: 2.228

rpm -qi 389-ds-base
Name : 389-ds-base
Version : 1.3.5.18
Release : 1.fc25
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org