FreeIPA-users April 2019

freeipa-users@lists.fedorahosted.org

52 participants
77 discussions

Re: new servers not creating DNS entries
by Gotham 04 Apr '19

04 Apr '19

Hi, Can anyone throw some light on this, I m also stuck here for past few days with the same error, tried reinstalling client,rebuilding the VM again, adding manual dns entry....nothing seems to work. Thanks for your help, Gotham

3 2

migrate-ds doesn't migrate roles?
by Mitchell Smith 04 Apr '19

04 Apr '19

Hi, I am migrating users off an old 4.3.1 FreeIPA cluster to a new 4.6.4 FreeIPA cluster via the ‘ipa migrate-ds’ command. ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup --user-ignore-attribute={krbPrincipalName,krbextradata,krblastfailedauth,krblastpwdchange,krblastsuccessfulauth,krbloginfailedcount,krbpasswordexpiration,krbticketflags,krbpwdpolicyreference,mepManagedEntry} --user-ignore-objectclass=mepOriginEntry --with-compat ldap://172.16.1.156 First issue I ran in to is that it didn’t retain the nsAccountLock flag for users so all my disabled users were enabled again, that was an easy fix. Second issue I ran in to is that roles were not migrated and applied to users, I could manually create the roles and apply them to users, but I am wondering why these weren’t migrated by migrate-ds? It is my understanding that this is the intended usage of migrate-ds, to migrate from one FreeIPA to another, dropping important objects like roles seems fairly critical? Your feedback and suggestions would be greatly appreciated. Thanks

2 1

AD trust and external group memberships, sssd issue?
by John Desantis 04 Apr '19

04 Apr '19

Hello all! Due to how our organization is moving, we'll be forced to upgrade our current IPA installation. In a nutshell, this involves using a one-way AD trust. So, with the latest versions of RHEL and IPA offered on our Satellite server, I was able to get an installation up and running and AD trust established; because of the work of all of the IPA developers, this was quite easy - THANK YOU. I've noticed that there seems to be a major delay in how often an external user's group membership is updated. In fact, it seems that I have to run sss_cache -u against the external user in order to verify additions/removals from the group in question. Since I'm still in a testing phase, I am performing the queries on the only two provisioned nodes in the new realm, the IPA servers themselves. Has any other user with the same configuration run into this issue, too? If so, anything to double-check? I'm certain that this is an sss configuration issue, but after searching through google and this mailing list, I can't seem to find any real "solution". Thanks, John DeSantis

1 1

Import hosts from text file
by Cornelis van Ginkel 03 Apr '19

03 Apr '19

Hi All, this is my first post and probably not my last. Can anyone tell me where to find a script to import hosts from a text file? I already found this thread: https://www.redhat.com/archives/freeipa-users/2014-May/msg00158.html The export script works, but I'm lost with the import script. Any help would be appreciated. With kind regards, Cornelis

1 0

Sharing domain name with existing 389 server
by phil.barone＠gmail.com 03 Apr '19

03 Apr '19

Sorry, new to all this. My intent is to add an IPA environment to an existing local openldap 389server test environment. The Deployment Recommendations document warns about overlaps with existing active directory domains but does not mention 389server domains. My intention is to share a local subnet and the same domain name with an existing 389server configuration. The environments will made up of separate systems and have their own dns servers(each have their own LDAP) but will need to ssh back and forth. These are CentOS 6.5(389 1.2.11-15) and CentOS 7.6(ipa-server 4.6.4-10.el7) environments using dnsmasq(2.48-13 and 2.76-7) Hosts files: 389server(dns: dnsvr1.test.hfgs.net) server1.test.company.net server2.test.company.net server11.test.company.net server12.test.company.net IPA(dns: ipasvr1.test.hfgs.net) server11.test.company.net server12.test.company.net server1.test.company.net server2.test.company.net Is this viable? If not, What do i need to do to get add this second IPA environment? Thanks.

2 2

basic password reset page?
by Anthony Jarvis-Clark 03 Apr '19

03 Apr '19

Hello Everyone, I was wondering if anyone here knew of a basic password reset page for FreeIPA? It must have: * No hostname restriction, i.e. if the IPA domain is dev.example.net the reset page should be able to be viewed from password.example.com * Easily edited/styled, i.e. to remove any references to OTP, and to use our own terms/language/styles. Nice to have: * No use of Kerberos. (same as the no hostname restriction) I've tried using a couple of different pages found on github but haven't found one that really fits all our requirements. Thank you, Anthony Clark

1 0

FreeIPA AD Trust with Samba4 ... is it possible?
by D Anderson 01 Apr '19

01 Apr '19

Hello all, I am confused by some of the conflicting documentation about whether this is possible or not. Almost all of the documentation/working examples seem to use an actual Windows Domain Controller. Specifically the part on DNS , as the Samba4 internal DNS server has several know limitations. https://wiki.samba.org/index.php/Samba_Internal_DNS_Back_End#Limitations| >The internal DNS does not support: >zone transfers https://wiki.samba.org/index.php/DNS_Administration#Administering_DNS_on_Wi… >Conditional forwarders are not implemented yet I THINK I got DNS actually working , but had to use solution like here https://www.redhat.com/archives/freeipa-users/2012-October/msg00194.html Although Petr says to stay away from forwarders in IPA Is it better to attempt AD as subdomain of IPA (which I'm currently doing) , or IPA as subdomain of AD ? On both samba4 and freeipa machine I can currently dig SRV records for both domains , but when I attempt ipa add-trust, I see in httpd error logs >[Fri Aug 10 11:58:43.122526 2018] [:error] [pid 6169] ipa: ERROR: Attempt to solve forest trust topology conflicts >[Fri Aug 10 11:58:43.125865 2018] [:error] [pid 6169] ipa: ERROR: non-public: NTSTATUSError: (-1073741601, 'The specified domain did not exist.') Which leads me to believe that no, DNS is not working correctly ( I have all firewall/iptables off and selinux off). I can give more concrete/examples , but before get lost in the weeds wanted to know on broad consensus is it even possible or known bad issues with Samba AD ? Like here https://www.freeipa.org/page/IPAv3_AD_trust#Samba , it says >In order to get properly working MIT krb5-based Samba4 build one have to use --without-ad-dc --with-system-mitkrb5 options when configuring WAF top level build. Which I'm confused ... how to get I get AD trust, if I'm setting up samba without AD abilities?? Yet here https://www.freeipa.org/page/Windows_authentication_against_FreeIPA It recommends a. If you have an AD ( Microsoft ) , use it b. If you don't have a Microsoft AD , setup Samba4 >but it can be configured to trust FreeIPA Does anyone know of a complete A..Z example of how to do that? (what options were used to configure Samba and Freeipa, etc) Thanks

5 7

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2019