FreeIPA-users August 2019

freeipa-users@lists.fedorahosted.org

44 participants
84 discussions

AD -> FreeIPA sync incomplete
by Theodor van Nahl 02 Aug '19

02 Aug '19

Hello, I do have a running `winsync` setup, which is working for most users. The only thing that is missing are * the groups: I've tried to activate the group sync using ldapmodify (setting `nsds7NewWinGroupSyncEnabled: true`), but the attribute apparently is set to `false` automatically and I cannot find logs that indicate problems. * every administrative users: It seems that every user with `adminCount: 1` on AD is not sync to FreeIPA, but I cannot find any reason for that nor is anything mentioned in the logs regarding those users. Do you have an idea what's wrong with my configuration or how to get logs that could indicate the problem? Best regards, Theodor van Nahl

2 3

ipa ca renewal master and ipa replica
by Rob Verduijn 02 Aug '19

02 Aug '19

Hello, I was doing some rtfm for migration of an ipa ca-renewal master to a different system. I figured that the docs on migrating from rhel7 to rhel8 would be a nice help for me to migrate from one centos7 to another centos 7 system. Something in the docs gave me pause. In the doc in chapter 17.4 instruction 4 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… It states that on replicas at the bottom of the file /etc/httpd/conf.d/ipa-pki-proxy.conf you should uncomment the rewrite rule and ensure it points to the 'ca renewal master' However on the centos 7 freeipa replica it points to the replica. Is the configuration on the centos7 freeipa replica incorrect ? Or is the instruction from redhat in need of updates ? If it's the first, then the installation packages of freeipa on centos need some attention, because I didn't configure that line as such. Cheers Rob

2 4

Replacing IPA v3.0.0-51 on OEL6 with IPA v4.6.4-10 on OEL7: Making the newest replica the master
by Auerbach, Steven 01 Aug '19

01 Aug '19

I am struggling through this. I have a new server built and IPA 4.6.4-10 installed. I made it a replica from the v3.0.0-51 master. Ipa-replica-manage shows 3 ipa servers, the original 2 v3.0.0-51 servers and the new ipa v4.6.4-10 server. But when I poll for replication agreements I get no answer. From <server1> I issued the following commands: $ sudo ipa-replica-manage list Directory Manager password: <server1>.mydomain.local: master <server2>.mydomain.local: master <server3 - new>.mydomain.local: master $ sudo ipa-replica-manage list <server2> [sudo] password for <user>: Cannot find servername in public server list $ sudo ipa-replica-manage list <server3> [sudo] password for <user>: Cannot find servername in public server list $ ldapsearch -x -D 'cn=directory manager' -W -b 'cn=mapping tree,cn=config' Enter LDAP Password: There is an extensive response that includes: # dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config . . nsslapd-referral: ldap://<server3>.mydomain..local:389/dc%3Dmydomain%2Cdc%3Dlocal nsslapd-referral: ldap://<server2>.mydomain.local:389/dc%3Dmydomain%2Cdc%3Dlocal # replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config dn: cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 objectClass: top objectClass: nsds5replica objectClass: extensibleobject nsDS5ReplicaType: 3 nsDS5ReplicaRoot: dc=mydomain,dc=local nsds5ReplicaLegacyConsumer: off nsDS5ReplicaId: 4 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaBindDN: krbprincipalname=ldap/<invalid, removed server that should not even appear here>.mydomain.local(a)MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local nsDS5ReplicaBindDN: krbprincipalname=ldap/<server2>.mydomain.local(a)MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local nsDS5ReplicaBindDN: krbprincipalname=ldap/<server3>.mydomain.local(a)MYDOMAIN.LOCAL,cn=services,cn=accounts,dc=mydomain,dc=local nsState:: BAAAAAAAAAA+CUNdAAAAAGEAAAAAAAAAkgAAAAAAAAAEAAAAAAAAAA== nsDS5ReplicaName: a5641a0e-252711e3-96afcc83-6ff9b802 nsds5ReplicaChangeCount: 3768023 nsds5replicareapactive: 0 # meTo<server2>.mydomain.local, replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config dn: cn=meTo<server2>.mydomain.local,cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config cn: meTo<server2>.mydomain.local objectClass: nsds5replicationagreement objectClass: top nsDS5ReplicaTransportInfo: LDAP description: me to <server2>.mydomain.local nsDS5ReplicaRoot: dc=mydomain,dc=local nsDS5ReplicaHost: <server2>.mydomain.local nsds5replicaTimeout: 120 nsDS5ReplicaPort: 389 nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserialentryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount nsDS5ReplicaBindMethod: SASL/GSSAPI nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount nsds50ruv: {replicageneration} 5241a52a000000040000 nsds50ruv: {replica 7 ldap://<server2>.mydomain.local:389} 54c80f57000000070000 5d271a1b000700070000 nsds50ruv: {replica 4 ldap://<server1>.mydomain.local:389} 5241a584000800040000 5d271866000300040000 nsds50ruv: {replica 8 ldap://<server3>.mydomain.local:389} 5d166840000000080000 5d270db6000500080000 nsruvReplicaLastModified: {replica 7 ldap://<server2>.mydomain.local:389} 00000000 nsruvReplicaLastModified: {replica 4 ldap://<server1>.mydomain.local:389} 00000000 nsruvReplicaLastModified: {replica 8 ldap://<server3>.mydomain.local:389} 00000000 nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 20190801154606Z nsds5replicaLastUpdateEnd: 20190801154607Z nsds5replicaChangesSentSinceStartup:: NDo2MDAvMjI1MjE1OSA4OjM1OS8wIA== nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental update succeeded nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 0 nsds5replicaLastInitEnd: 0 # meTo<server3>.mydomain.local, replica, dc\3Dmydomain\2Cdc\3Dlocal, mapping tree, config dn: cn=meTo<server3>.mydomain.local,cn=replica,cn=dc\3Dmydomain\2Cdc\3Dlocal,cn=mapping tree,cn=config cn: meTo<server3>.mydomain.local objectClass: nsds5replicationagreement objectClass: top nsDS5ReplicaTransportInfo: LDAP nsds5ReplicaStripAttrs: modifiersName modifyTimestamp internalModifiersName in ternalModifyTimestamp nsDS5ReplicaRoot: dc=mydomain,dc=local nsDS5ReplicaHost: <server3>.mydomain.local nsds5replicaTimeout: 120 nsDS5ReplicaPort: 389 nsDS5ReplicaBindMethod: SASL/GSSAPI nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE memberof idnssoaserialentryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount description: me to <server3>.mydomain.local nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount nsds50ruv: {replicageneration} 5241a52a000000040000 nsds50ruv: {replica 8 ldap://<server3>.mydomain.local:389} 5d166840000000080000 5d271a1b000000080000 nsds50ruv: {replica 4 ldap://<server1>.mydomain.local:389} 5241a584000800040000 5d271866000300040000 nsds50ruv: {replica 7 ldap://<server2>.mydomain.local:389} 54c80f57000000070000 5d2717a3000300070000 nsruvReplicaLastModified: {replica 8 ldap://<server3>.mydomain.local:389} 00000000 nsruvReplicaLastModified: {replica 4 ldap://<server1>.mydomain.local:389} 00000000 nsruvReplicaLastModified: {replica 7 ldap://<server2>.mydomain.local:389} 00000000 nsds5replicareapactive: 0 nsds5replicaLastUpdateStart: 20190801154606Z nsds5replicaLastUpdateEnd: 20190801154607Z nsds5replicaChangesSentSinceStartup:: NDo2MDAvMTkyNTgzNyA3OjUxMi8wIA== nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental update succeeded nsds5replicaUpdateInProgress: FALSE nsds5replicaLastInitStart: 0 nsds5replicaLastInitEnd: 0 # search result search: 2 result: 0 Success # numResponses: 6 # numEntries: 5 Are there no replication agreements between these servers or is there something missing in "public server list" that the agreements cannot be found? I imagine that all parts need to be seeing each other properly at this point before I even begin to try and make <server3> the new ultimate master. I will then add a <server4> ipa server and replicate it from <server3> once it is the master and retire <server1> and <server2>. At least that is the scope of the project. Steven Auerbach Assistant Director of Information Systems Information Technology & Security State University System of Florida Board of Governors 325 W. Gaines Street, Suite 1625 Tallahassee, Florida 32399 (850) 245-9592 Steven.auerbach(a)flbog.edu<mailto:Steven.auerbach@flbog.edu> | www.flbog.edu<http://www.flbog.edu/> [email_sig]

1 0

ipa-replica-install ERROR
by Boudjoudad Abdelkader 01 Aug '19

01 Aug '19

Hi, I'm trying to install an IPA server replica from but i have the issue below, i did: - Remove the IP of ipa server master from /etc/hosts - Check if there is a problem with ipa-client-install (working fine) - dig IP-ipa-server (resolved) Non of these steps works! I did some researches and it looks like this is a bug, is there a workaround ? ERROR: WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR The host name freeipa-replica.example.com does not match the primary host name freeipa-replica.example.com.x.yy.zzz.in-addr.arpa. Please check /etc/hosts or DNS name resolution ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information Thanks,

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2019