August 2019 - FreeIPA-users - Fedora mailing-lists

Re: Add Subject Alternative Name of HA/LB host to LDAPS servers?
by Daniel Oetken 22 Aug '19

22 Aug '19

Why doesn’t terminating SSL on the proxy work with LDAPS? Because it should, and says so too here: https://www.mail-archive.com/haproxy@formilux.org/msg21657.html Though, I’m looking into the same thing to add SAN to the server certificate and wondering about similar questions. When you look at “ipa-getcert list” you should see the current certificates already, including their settings, so I was thinking to just stop tracking those old ones and create new ones like you did, except with the exact same options as the old ones (+ SAN). But yeah, I’m not sure if there is anything else involved, or if there is a better way. I only started using freeipa recently.

3 6

Re: Disabled user accounts
by Alexander Bokovoy 22 Aug '19

22 Aug '19

On to, 22 elo 2019, Angus Clarke via FreeIPA-users wrote: >Hi all > >Just an observation really, some of our users complained that their IdM >login names did not match other systems' - we saw IdM as the easiest >place to fix this (as opposed to modifying local accounts on hundreds >of none-IdM enabled *nix boxes around the estate) You can rename accounts with ipa user-mod --rename $ ipa user-mod some-user --rename=another-user ------------------------- Modified user "some-user" ------------------------- User login: another-user .... >Rightly or wrongly, the approach we took was to disable angusc account >and add new account aclarke using the same UID number. How did you disable it? 'ipa user-disable'? This just leaves this user in the tree and marks its account not possible to use for authentication. >One of our users spotted this happening occasionally: > > >[aclarke@orabledb ~]$ id >uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas) > >We're now deleting the disabled accounts from IdM. > >$ rpm -q ipa-server >ipa-server-4.6.4-10.0.1.el7_6.3.x86_64 -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

Disabled user accounts
by Angus Clarke 22 Aug '19

22 Aug '19

Hi all Just an observation really, some of our users complained that their IdM login names did not match other systems' - we saw IdM as the easiest place to fix this (as opposed to modifying local accounts on hundreds of none-IdM enabled *nix boxes around the estate) Rightly or wrongly, the approach we took was to disable angusc account and add new account aclarke using the same UID number. One of our users spotted this happening occasionally: [aclarke@orabledb ~]$ id uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas) We're now deleting the disabled accounts from IdM. $ rpm -q ipa-server ipa-server-4.6.4-10.0.1.el7_6.3.x86_64 Regards Angus

1 0

Add Subject Alternative Name of HA/LB host to LDAPS servers?
by Jonathan Vaughn 22 Aug '19

22 Aug '19

I've seen some guides for doing reverse proxy of SSL using Apache/Nginx which seem to side step the SSL issue by terminating SSL in the proxy but that only works for actual HTTPS connections to the FreeIPA UI, not for LDAPS. I have got keepalived + HAProxy configured such that accessing ipa.example.com will go through HAProxy and on to FreeIPA for LDAP(S). LDAP works perfectly fine, LDAPS works if the client can ignore the SSL certificate name mismatch (since of course, the SSL certificate will be ipa-11.example.com or ipa-12.example.com or whatever the FreeIPA server actually is). We need this because Atlassian doesn't want to support multiple LDAP host names in configuration without paying for Crowd (which is a pretty redundant product when we have FreeIPA already). Additionally, I can't disable the hostname check for SSL either, which would at least work around the issue, so we need to get ipa.example.com into each FreeIPA LDAP server's SSL certificate. How can I add ipa.example.com as SAN to the SSL certificate used by 389DS in FreeIPA? At first I thought maybe I should start with adding HTTP/ipa.example.com as a principal alias to each HTTP/ipa-(server).example.com and then reissue the SSL but apparently I can only add the alias to a single principal (can't have it on multiple servers)... The basic layout is this: 10.0.0.10 : ipa.example.com (virtual IP / VRRP) 10.0.0.11 : ipa-11.example.com 10.0.0.12 : ipa-12.example.com HAproxy runs on both ipa-11 and ipa-12 and each instance of HAproxy is configured to sticky sessions. Keepalived runs on both ipa-11 and ipa-12, both configured as master but with ipa-11 set as a higher priority so that nominally all requests go to ipa-11 unless ipa-11 is down, in which case the virtual IP moves to the other server. When connecting to ipa.example.com, connection may end up at either of ipa-11.example.com or ipa-12.example.com, and we need them both to have ipa.example.com in addition to their real server name in the SSL certificate for LDAPS to work correctly. So the certificate for ipa-11.example.com should include in SAN both ipa-11.example.com and ipa.example.com, and the certificate for ipa-12.example.com should include in SAN both ip-12.example.com and ipa.example.com.

2 2

Unable to add managed entry
by yousif raed 20 Aug '19

20 Aug '19

Hello , a while ago I've migrated from an old freeipa server to a new server everything worked fine until about a week ago when i deleted a user to preserved then i moved the user to the stage and i tried to activate the user and an error occurred . the error is : - ERR - managed-entries-plugin - mep_add_managed_entry - Unable to add managed entry "cn=ittest1,cn=groups,cn=accounts,dc=example,dc=com" for origin entry "uid=ittest1,cn=users,cn=accounts,dc=example,dc=com" (Already exists). i searched the problem and it turns out that the private group is created but the user is not . and the user is stuck at the stage users and the only way to activate the user is by deleting the private group . thanks in advance

1 0

"NSS Certificate DB" certificate created in new directory after renewal, breaking httpd
by Thomas Kropeit 20 Aug '19

20 Aug '19

Over the weekend, my original "NSS Certificate DB" certificate expired. It was automatically renewed, however in a new location: # ipa-getcert list Number of certificates and requests being tracked: 10. Request ID '20180929060059': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-PHYSEC-DE',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-PHYSEC-DE certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-PHYSEC-DE',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA.PHYSEC.DE subject: CN=master.ipa.physec.de,O=IPA.PHYSEC.DE expires: 2021-07-20 14:25:43 UTC principal name: ldap/master.ipa.physec.de(a)IPA.PHYSEC.DE key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IPA-PHYSEC-DE track: yes auto-renew: yes Request ID '20180929060107': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA.PHYSEC.DE subject: CN=master.ipa.physec.de,O=IPA.PHYSEC.DE expires: 2019-08-17 12:45:50 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes I managed to restart the FreeIPA service by adding `NSSEnforceValidCerts off` to `/etc/httpd/conf.d/nss.conf`. But logging into the webinterface still yields the following error in httpd: [Mon Aug 19 10:36:05.722736 2019] [:error] [pid 12798] ipa: INFO: 401 Unauthorized: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) [Mon Aug 19 10:36:05.723894 2019] [:error] [pid 12802] SSL Library Error: -12269 The server has rejected your certificate as expired I have intentionally not copied the new certificate to `/etc/httpd/alias` as I am not aware of all the involved components and fear that this might break something. My system is running a fully patched CentOS 7.6, running FreeIPA 4.6.4-10.el7.centos.6. What should I do to resolve this issue, simply replacing the certificates, or is there a better method?

2 3

FreeIPA v4.5.0 install lost topology suffixes
by Gavin Williams 19 Aug '19

19 Aug '19

Afternoon all I’ve got a slightly strange one with one of our FreeIPA clusters, whereby the topology suffixes appear to have disappeared. From what I can see, this is causing replication issues between the hosts, which is causing us issues with bootstrapping new clients against FreeIPA. I’m not aware of any config changes that have happened on the FreeIPA hosts that could have caused this issue, so am a bit stumped atm. Is someone able to advise next steps on how to investigate the cause and correct the configuration? Regards Gavin

4 4

python - ipalib, ipapython and ipaclient and virtual environment
by lune voo 19 Aug '19

19 Aug '19

Hello ! I'm trying to create a virtual environment using conda with python 2.6 and I wanted to know if there was still a place to get the following python modules related to ipa : - ipalib - ipapython - ipaclient I'm using an old version of ipa : # rpm -qa | grep ipa python-libipa_hbac-1.13.3-60.el6.x86_64 sssd-ipa-1.13.3-60.el6.x86_64 python-iniparse-0.3.1-2.1.el6.noarch libipa_hbac-1.13.3-60.el6.x86_64 ipa-client-3.0.0-47.el6.x86_64 ipa-python-3.0.0-47.el6.x86_64 Is it possible to install the modules ipalib, ipapython and ipaclient for this old version of ipa and python with pip or conda ? Thank you in advance for your help. Best regards. Lune.

1 0

build of 4.6.6 on centos
by lejeczek 19 Aug '19

19 Aug '19

hi guys would you know if above version should build on Centos 7.6? Or maybe it's officially not supported, as ./configure says: .... checking supported IPA platform... configure: error: IPA platform centos is not supported many thanks, L.

2 3

Automounting homeshares partially stopped working
by Ronald Wimmer 19 Aug '19

19 Aug '19

Some days ago a strange problem struck us. When colleagues access a server using an ipa-automounted share from a Windows client they can logon to such a server using a Kerberos ticket but they cannot access their NFS-automounted home-share anymore. When they log on with username/password they can. When I try the same from my linux client I do not encounter any problems (using the same users as in the above scenario). Where should I start digging in order to find out what is going wrong? Cheers, Ronald

5 24

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2019