November 2020 - FreeIPA-users - Fedora mailing-lists

Unable to install KRA Replica - 4.8.7
by David Andrzejewski 04 Nov '24

04 Nov '24

I'm attempting to reinstall a replica that I had previously removed. When I run ipa-replica-install and include the --setup-kra option, it eventually fails. I've included the output of the ipa-replica-install command, and the only "bad" thing I can find is the following in the tomcat debug log: > 2020-11-29 03:51:35 [ajp-nio-127.0.0.1-8009-exec-3] SEVERE: addConnector: Connector is already defined I've gone through and run ipa-healthcheck, all is well there. After uninstalling, I couldn't find any old references to the replica in the LDAP database.... the ipa-replica-install works fine if I do not include --setup-kra. Any help would be appreciated. I'm happy to provide whatever additional logs that may be needed. I've replaced my internal DNS suffix with 'example.com'. Thanks! - Dave Failed to configure KRA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'KRA', '-f', '/tmp/tmpf6kaucv2', '--debug'] returned non-zero exit status 1: 'INFO: Connecting to LDAP server at ldaps://ipa.example.com:636\nINFO: Connecting to LDAP server at ldaps://ipa.example.com:636\nINFO: Connecting to security domain at https://ipa.example.com:443\nINFO: Getting security domain info\nINFO: Logging into security domain IPA\nDEBUG: Installing Maven dependencies: False\nINFO: BEGIN spawning KRA subsystem in pki-tomcat instance\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Setting up pkiuser group\nINFO: Reusing existing pkiuser group with GID 17\nINFO: Setting up pkiuser user\nINFO: Reusing existing pkiuser user with UID 17\nDEBUG: Retrieving UID for \'pkiuser\'\nDEBUG: UID of \'pkiuser\' is 17\nDEBUG: Retrieving GID for \'pkiuser\'\nDEBUG: GID of \'pkiuser\' is 17\nINFO: Initialization\nINFO: Appending logs to /var/log/pki/pki-tomcat\nINFO: Setting up infrastructure\nINFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat\nINFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nDEBUG: Command: mkdir -p /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nDEBUG: Command: chmod 770 /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nDEBUG: Command: chown 17:17 /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nINFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: cp -p /usr/share/pki/server/etc/default.cfg /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: chmod 660 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: chown 17:17 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: touch /etc/sysconfig/pki/tomcat/pki-tomcat/kra/deployment.cfg\nDEBUG: Command: chmod 660 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/deployment.cfg\nDEBUG: Command: chown 17:17 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/deployment.cfg\nINFO: Creating /var/lib/pki/pki-tomcat\nINFO: Creating /var/lib/pki/pki-tomcat/kra\nDEBUG: Command: mkdir -p /var/lib/pki/pki-tomcat/kra\nDEBUG: Command: chmod 770 /var/lib/pki/pki-tomcat/kra\nDEBUG: Command: chown 17:17 /var/lib/pki/pki-tomcat/kra\nINFO: Preparing pki-tomcat instance\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Creating /etc/pki/pki-tomcat\nWARNING: Directory already exists: /etc/pki/pki-tomcat\nINFO: Creating /etc/pki/pki-tomcat/password.conf\nINFO: Reusing server NSS database password\nINFO: Using specified internal database password\nINFO: Reusing replication manager password\nINFO: Installing pki-tomcat instance\nINFO: Creating KRA subsystem\nINFO: Creating /var/log/pki/pki-tomcat/kra\nDEBUG: Command: mkdir /var/log/pki/pki-tomcat/kra\nINFO: Creating /var/log/pki/pki-tomcat/kra/archive\nDEBUG: Command: mkdir /var/log/pki/pki-tomcat/kra/archive\nINFO: Creating /var/log/pki/pki-tomcat/kra/signedAudit\nDEBUG: Command: mkdir /var/log/pki/pki-tomcat/kra/signedAudit\nINFO: Creating /etc/pki/pki-tomcat/kra\nDEBUG: Command: mkdir /etc/pki/pki-tomcat/kra\nINFO: Creating /etc/pki/pki-tomcat/kra/CS.cfg\nDEBUG: Command: cp /usr/share/pki/kra/conf/CS.cfg /etc/pki/pki-tomcat/kra/CS.cfg\nINFO: Creating /etc/pki/pki-tomcat/kra/registry.cfg\nINFO: Creating /var/lib/pki/pki-tomcat/kra/conf\nDEBUG: Command: ln -s /etc/pki/pki-tomcat/kra /var/lib/pki/pki-tomcat/kra/conf\nINFO: Creating /var/lib/pki/pki-tomcat/kra/logs\nDEBUG: Command: ln -s /var/log/pki/pki-tomcat/kra /var/lib/pki/pki-tomcat/kra/logs\nINFO: Creating /var/lib/pki/pki-tomcat/kra/registry\nDEBUG: Command: ln -s /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat/kra/registry\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Getting transport cert info from CS.cfg\nINFO: Getting storage cert info from CS.cfg\nINFO: Getting sslserver cert info from CS.cfg\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting audit_signing cert info from CS.cfg\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Deploying /kra web application\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Creating /var/lib/pki/pki-tomcat/kra/webapps\nDEBUG: Command: mkdir -p /var/lib/pki/pki-tomcat/kra/webapps\nDEBUG: Command: chmod 770 /var/lib/pki/pki-tomcat/kra/webapps\nDEBUG: Command: chown 17:17 /var/lib/pki/pki-tomcat/kra/webapps\nINFO: Setting up ownerships, permissions, and ACLs on /var/lib/pki/pki-tomcat/kra/webapps\nINFO: Creating /etc/pki/pki-tomcat/Catalina/localhost/kra.xml\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Creating password file: /etc/pki/pki-tomcat/pfile\nINFO: Updating /etc/pki/pki-tomcat/password.conf\nDEBUG: Command: chmod 660 /etc/pki/pki-tomcat/password.conf\nDEBUG: Command: chown 17:17 /etc/pki/pki-tomcat/password.conf\nDEBUG: Command: ln -s /var/lib/pki/pki-tomcat/alias /var/lib/pki/pki-tomcat/kra/alias\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile pkcs12-import --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug\nINFO: Certificates in PKCS #12 file:\nINFO: Java command: /usr/lib/jvm/jre-openjdk/bin/java -cp /usr/share/pki/lib/* -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile --debug pkcs12-cert-find --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug\nINFO: Server URL: https://ipa.example.com:8443\nINFO: Loading NSS password from /etc/pki/pki-tomcat/pfile\nINFO: NSS database: /etc/pki/pki-tomcat/alias\nINFO: Message format: null\nINFO: Command: pkcs12-cert-find --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug\nINFO: Module: pkcs12\nINFO: Module: cert\nINFO: Module: find\nINFO: Initializing NSS\nINFO: Logging into internal token\nINFO: Using internal token\nINFO: - auditSigningCert cert-pki-kra\nINFO: - caSigningCert cert-pki-ca\nINFO: - storageCert cert-pki-kra\nINFO: - subsystemCert cert-pki-ca\nINFO: - transportCert cert-pki-kra\nINFO: Importing CA certificates:\nINFO: - caSigningCert cert-pki-ca\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/pfile -n caSigningCert cert-pki-ca -a\nWARNING: Certificate already exists: caSigningCert cert-pki-ca\nINFO: Importing user certificates:\nINFO: - auditSigningCert cert-pki-kra\nINFO: - storageCert cert-pki-kra\nINFO: - subsystemCert cert-pki-ca\nINFO: - transportCert cert-pki-kra\nINFO: Java command: /usr/lib/jvm/jre-openjdk/bin/java -cp /usr/share/pki/lib/* -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile --debug pkcs12-import --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug auditSigningCert cert-pki-kra storageCert cert-pki-kra subsystemCert cert-pki-ca transportCert cert-pki-kra\nINFO: Server URL: https://ipa.example.com:8443\nINFO: Loading NSS password from /etc/pki/pki-tomcat/pfile\nINFO: NSS database: /etc/pki/pki-tomcat/alias\nINFO: Message format: null\nINFO: Command: pkcs12-import --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug "auditSigningCert cert-pki-kra" "storageCert cert-pki-kra" "subsystemCert cert-pki-ca" "transportCert cert-pki-kra"\nINFO: Module: pkcs12\nINFO: Module: import\nINFO: Initializing NSS\nINFO: Logging into internal token\nINFO: Using internal token\nDEBUG: Command: certutil -M -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/pfile -n auditSigningCert cert-pki-kra -t u,u,Pu\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias\nDEBUG: Result of CA certificate export: \nINFO: Removing /etc/pki/pki-tomcat/pfile\nDEBUG: Command: rm -f /etc/pki/pki-tomcat/pfile\nINFO: Getting transport cert info from CS.cfg\nINFO: Getting storage cert info from CS.cfg\nINFO: Getting sslserver cert info from CS.cfg\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting audit_signing cert info from CS.cfg\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Creating /root/.dogtag/pki-tomcat/kra\nDEBUG: Command: mkdir -p /root/.dogtag/pki-tomcat/kra\nDEBUG: Command: chmod 755 /root/.dogtag/pki-tomcat/kra\nDEBUG: Command: chown 0:0 /root/.dogtag/pki-tomcat/kra\nINFO: Creating password file: /root/.dogtag/pki-tomcat/kra/password.conf\nINFO: Updating /root/.dogtag/pki-tomcat/kra/password.conf\nDEBUG: Command: chmod 660 /root/.dogtag/pki-tomcat/kra/password.conf\nDEBUG: Command: chown 0:0 /root/.dogtag/pki-tomcat/kra/password.conf\nINFO: Storing PKCS #12 password in /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nINFO: Updating /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nDEBUG: Command: chmod 660 /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nDEBUG: Command: chown 17:17 /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nWARNING: Directory already exists: /var/lib/ipa/tmp-6ae9ficu\nDEBUG: Command: certutil -N -d /var/lib/ipa/tmp-6ae9ficu -f /root/.dogtag/pki-tomcat/kra/password.conf\nINFO: Creating SELinux contexts\nINFO: Generating system keys\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Configuring subsystem\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nDEBUG: Setting ephemeral requests to true\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Importing sslserver cert data from CA\nINFO: Importing subsystem cert data from CA\nINFO: Importing sslserver request data from CA\nINFO: Importing subsystem request data from CA\nINFO: Joining existing domain\nINFO: Getting install token\nINFO: Using CA at https://ipa.example.com:443\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Reusing replicated database\nINFO: Initializing database\nDEBUG: Command: sudo -u pkiuser /usr/lib/jvm/jre-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/kra/webapps/kra/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/etc/pki/pki-tomcat/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI kra-db-init --setup-schema --setup-db-manager --setup-vlv-indexes --debug\nINFO: Loading /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Initializing database ipaca for o=kra,o=ipaca\nINFO: Creating com.netscape.cmsutil.password.PlainPasswordFile\nFINE: PlainPasswordFile: Initializing PlainPasswordFile\nFINE: LdapAuthInfo: init()\nFINE: LdapAuthInfo: init begins\nFINE: LdapAuthInfo: init ends\nFINE: TCP Keep-Alive: true\nFINE: LdapAuthInfo: init: prompt is internaldb\nFINE: LdapAuthInfo: init: try getting from memory cache\nFINE: LdapAuthInfo: init: password not in memory\nFINE: LdapAuthInfo: getPasswordFromStore: try to get it from password store\nFINE: LdapAuthInfo: getPasswordFromStore: about to get from passwored store: internaldb\nFINE: LdapAuthInfo: getPasswordFromStore: password store available\nFINE: LdapAuthInfo: getPasswordFromStore: password found for prompt in password store\nFINE: LdapAuthInfo: password ok: store in memory cache\nFINE: LdapBoundConnection: Connecting to ipa.example.com:636 with basic auth as cn=Directory Manager\nFINE: ldapconn/PKISocketFactory.makeSSLSocket: begins\nFINE: PKIClientSocketListener.handshakeCompleted: begins\nFINE: Handshake completed:\nFINE: - client: 10.1.1.7\nFINE: - server: 10.1.1.7\nFINE: - subject: SYSTEM\nFINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_ESTABLISH\nFINE: PKIClientSocketListener.handshakeCompleted: CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS\nFINE: PKIClientSocketListener.handshakeCompleted: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636\nFINE: SSL handshake happened\nINFO: Configuring directory\nINFO: Importing /usr/share/pki/server/conf/database.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-549427834453303422.ldif\nINFO: Modifying cn=config\nINFO: - replacing nsslapd-maxbersize: 209715200\nINFO: Enabling USN\nINFO: Importing /usr/share/pki/server/conf/usn.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-784255222034676900.ldif\nINFO: Modifying cn=USN,cn=plugins,cn=config\nINFO: - replacing nsslapd-pluginenabled: on\nINFO: Setting up PKI schema\nINFO: Importing /usr/share/pki/server/conf/schema.ldif\nINFO: Adding attributetypes: ( usertype-oid NAME \'usertype\' DESC \'Distinguish whether the user is administrator, agent or subsystem.\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( userstate-oid NAME \'userstate\' DESC \'Distinguish whether the user is administrator, agent or subsystem.\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( cmsuser-oid NAME \'cmsuser\' DESC \'CMS User\' SUP top STRUCTURAL MUST usertype MAY userstate X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( archivedBy-oid NAME \'archivedBy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( adminMessages-oid NAME \'adminMessages\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( algorithm-oid NAME \'algorithm\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( algorithmId-oid NAME \'algorithmId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( signingAlgorithmId-oid NAME \'signingAlgorithmId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( autoRenew-oid NAME \'autoRenew\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( certStatus-oid NAME \'certStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlName-oid NAME \'crlName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlSize-oid NAME \'crlSize\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( deltaSize-oid NAME \'deltaSize\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlNumber-oid NAME \'crlNumber\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( deltaNumber-oid NAME \'deltaNumber\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( firstUnsaved-oid NAME \'firstUnsaved\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlCache-oid NAME \'crlCache\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revokedCerts-oid NAME \'revokedCerts\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( unrevokedCerts-oid NAME \'unrevokedCerts\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( expiredCerts-oid NAME \'expiredCerts\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlExtensions-oid NAME \'crlExtensions\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfArchival-oid NAME \'dateOfArchival\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfRecovery-oid NAME \'dateOfRecovery\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfRevocation-oid NAME \'dateOfRevocation\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfCreate-oid NAME \'dateOfCreate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfModify-oid NAME \'dateOfModify\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( duration-oid NAME \'duration\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( extension-oid NAME \'extension\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( issuedBy-oid NAME \'issuedBy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( issueInfo-oid NAME \'issueInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( issuerName-oid NAME \'issuerName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( keySize-oid NAME \'keySize\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( clientId-oid NAME \'clientId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dataType-oid NAME \'dataType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( status-oid NAME \'status\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( keyState-oid NAME \'keyState\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( metaInfo-oid NAME \'metaInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( nextUpdate-oid NAME \'nextUpdate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( notAfter-oid NAME \'notAfter\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( notBefore-oid NAME \'notBefore\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( ownerName-oid NAME \'ownerName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( password-oid NAME \'password\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( p12Expiration-oid NAME \'p12Expiration\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( proofOfArchival-oid NAME \'proofOfArchival\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( publicKeyData-oid NAME \'publicKeyData\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( publicKeyFormat-oid NAME \'publicKeyFormat\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( privateKeyData-oid NAME \'privateKeyData\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestId-oid NAME \'requestId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestInfo-oid NAME \'requestInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestState-oid NAME \'requestState\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestResult-oid NAME \'requestResult\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestOwner-oid NAME \'requestOwner\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestAgentGroup-oid NAME \'requestAgentGroup\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestSourceId-oid NAME \'requestSourceId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestType-oid NAME \'requestType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestFlag-oid NAME \'requestFlag\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestError-oid NAME \'requestError\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( resourceACLS-oid NAME \'resourceACLS\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revInfo-oid NAME \'revInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revokedBy-oid NAME \'revokedBy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revokedOn-oid NAME \'revokedOn\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( serialno-oid NAME \'serialno\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( nextRange-oid NAME \'nextRange\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( publishingStatus-oid NAME \'publishingStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( beginRange-oid NAME \'beginRange\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( endRange-oid NAME \'endRange\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( subjectName-oid NAME \'subjectName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( sessionContext-oid NAME \'sessionContext\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( thisUpdate-oid NAME \'thisUpdate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transId-oid NAME \'transId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transStatus-oid NAME \'transStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transName-oid NAME \'transName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transOps-oid NAME \'transOps\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( userDN-oid NAME \'userDN\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( userMessages-oid NAME \'userMessages\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( version-oid NAME \'version\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( Clone-oid NAME \'Clone\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( DomainManager-oid NAME \'DomainManager\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecurePort-oid NAME \'SecurePort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecureAgentPort-oid NAME \'SecureAgentPort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecureAdminPort-oid NAME \'SecureAdminPort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecureEEClientAuthPort-oid NAME \'SecureEEClientAuthPort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( UnSecurePort-oid NAME \'UnSecurePort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SubsystemName-oid NAME \'SubsystemName\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( cmsUserGroup-oid NAME \'cmsUserGroup\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( realm-oid NAME \'realm\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( CertACLS-oid NAME \'CertACLS\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY resourceACLS X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( repository-oid NAME \'repository\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ou MAY ( serialno $ description $ nextRange $ publishingStatus ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( request-oid NAME \'request\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $ dateOfModify $ requestState $ requestResult $ requestOwner $ requestAgentGroup $ requestSourceId $ requestType $ requestFlag $ requestError $ userMessages $ adminMessages $ realm ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( transaction-oid NAME \'transaction\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( transId $ description $ transName $ transStatus $ transOps ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( crlIssuingPointRecord-oid NAME \'crlIssuingPointRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ crlNumber $ crlSize $ thisUpdate $ nextUpdate $ deltaNumber $ deltaSize $ firstUnsaved $ certificateRevocationList $ deltaRevocationList $ crlCache $ revokedCerts $ unrevokedCerts $ expiredCerts $ cACertificate ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( certificateRecord-oid NAME \'certificateRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $ dateOfModify $ certStatus $ autoRenew $ issueInfo $ metaInfo $ revInfo $ version $ duration $ notAfter $ notBefore $ algorithmId $ subjectName $ signingAlgorithmId $ userCertificate $ issuedBy $ revokedBy $ revokedOn $ extension $ publicKeyData $ issuerName ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( userDetails-oid NAME \'userDetails\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST userDN MAY ( dateOfCreate $ dateOfModify $ password $ p12Expiration ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( keyRecord-oid NAME \'keyRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $ dateOfModify $ keyState $ privateKeyData $ ownerName $ keySize $ metaInfo $ dateOfArchival $ dateOfRecovery $ algorithm $ publicKeyFormat $ publicKeyData $ archivedBy $ clientId $ dataType $ status $ realm ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiSecurityDomain-oid NAME \'pkiSecurityDomain\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( ou $ name ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiSecurityGroup-oid NAME \'pkiSecurityGroup\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiSubsystem-oid NAME \'pkiSubsystem\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( cn $ Host $ SecurePort $ SubsystemName $ Clone ) MAY ( DomainManager $ SecureAgentPort $ SecureAdminPort $SecureEEClientAuthPort $ UnSecurePort ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiRange-oid NAME \'pkiRange\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( cn $ beginRange $ endRange $ Host $ SecurePort ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( securityDomainSessionEntry-oid NAME \'securityDomainSessionEntry\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( cn $ host $ uid $ cmsUserGroup $ dateOfCreate ) X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfCreate-oid NAME \'dateOfCreate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfModify-oid NAME \'dateOfModify\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( modified-oid NAME \'modified\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenUserID-oid NAME \'tokenUserID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenStatus-oid NAME \'tokenStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenAppletID-oid NAME \'tokenAppletID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( keyInfo-oid NAME \'keyInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfResets-oid NAME \'numberOfResets\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfEnrollments-oid NAME \'numberOfEnrollments\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfRenewals-oid NAME \'numberOfRenewals\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfRecoveries-oid NAME \'numberOfRecoveries\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( allowPinReset-oid NAME \'allowPinReset\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( extensions-oid NAME \'extensions\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenOp-oid NAME \'tokenOp\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenID-oid NAME \'tokenID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenMsg-oid NAME \'tokenMsg\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenResult-oid NAME \'tokenResult\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenIP-oid NAME \'tokenIP\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenPolicy-oid NAME \'tokenPolicy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenIssuer-oid NAME \'tokenIssuer\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenSubject-oid NAME \'tokenSubject\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenSerial-oid NAME \'tokenSerial\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenOrigin-oid NAME \'tokenOrigin\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenType-oid NAME \'tokenType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenKeyType-oid NAME \'tokenKeyType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenReason-oid NAME \'tokenReason\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenNotBefore-oid NAME \'tokenNotBefore\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenNotAfter-oid NAME \'tokenNotAfter\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( profileID-oid NAME \'profileID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tokenRecord-oid NAME \'tokenRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ modified $ tokenReason $ tokenUserID $ tokenStatus $ tokenAppletID $ keyInfo $ tokenPolicy $ extensions $ numberOfResets $ numberOfEnrollments $ numberOfRenewals $ numberOfRecoveries $ userCertificate $ tokenType ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tokenActivity-oid NAME \'tokenActivity\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ tokenOp $ tokenIP $ tokenResult $ tokenID $ tokenUserID $ tokenMsg $ extensions $ tokenType ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tokenCert-oid NAME \'tokenCert\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ userCertificate $ tokenUserID $ tokenID $ tokenIssuer $ tokenOrigin $ tokenSubject $ tokenSerial $ tokenStatus $ tokenType $ tokenKeyType $ tokenNotBefore $ tokenNotAfter $ extensions ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tpsProfileID-oid NAME \'tpsProfileID\' DESC \'CMS defined class\' SUP top AUXILIARY MAY ( profileID ) X-ORIGIN \'user-defined\' )\nINFO: Adding attributetypes: ( classId-oid NAME \'classId\' DESC \'Certificate profile class ID\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( certProfileConfig-oid NAME \'certProfileConfig\' DESC \'Certificate profile configuration\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( certProfile-oid NAME \'certProfile\' DESC \'Certificate profile\' SUP top STRUCTURAL MUST cn MAY ( classId $ certProfileConfig ) X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityID-oid NAME \'authorityID\' DESC \'Authority ID\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityKeyNickname-oid NAME \'authorityKeyNickname\' DESC \'Authority key nickname\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN \'user-defined\' )\nINFO: Adding attributetypes: ( authorityParentID-oid NAME \'authorityParentID\' DESC \'Authority Parent ID\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityEnabled-oid NAME \'authorityEnabled\' DESC \'Authority Enabled\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityDN-oid NAME \'authorityDN\' DESC \'Authority DN\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authoritySerial-oid NAME \'authoritySerial\' DESC \'Authority certificate serial number\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityParentDN-oid NAME \'authorityParentDN\' DESC \'Authority Parent DN\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityKeyHost-oid NAME \'authorityKeyHost\' DESC \'Authority Key Hosts\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( authority-oid NAME \'authority\' DESC \'Certificate Authority\' SUP top STRUCTURAL MUST ( cn $ authorityID $ authorityKeyNickname $ authorityEnabled $ authorityDN ) MAY ( authoritySerial $ authorityParentID $ authorityParentDN $ authorityKeyHost $ description ) X-ORIGIN \'user defined\' )\nINFO: Setting up ACME schema\nINFO: Importing /usr/share/pki/acme/database/ldap/schema.ldif\nINFO: Adding attributetypes: ( acmeExpires-oid NAME \'acmeExpires\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeValidatedAt-oid NAME \'acmeValidatedAt\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeStatus-oid NAME \'acmeStatus\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeError-oid NAME \'acmeError\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeNonceId-oid NAME \'acmeNonceId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeAccountId-oid NAME \'acmeAccountId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeAccountContact-oid NAME \'acmeAccountContact\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch )\nINFO: Adding attributetypes: ( acmeAccountKey-oid NAME \'acmeAccountKey\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeOrderId-oid NAME \'acmeOrderId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeIdentifier-oid NAME \'acmeIdentifier\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch )\nINFO: Adding attributetypes: ( acmeAuthorizationId-oid NAME \'acmeAuthorizationId\' SUP name )\nINFO: Adding attributetypes: ( acmeAuthorizationWildcard-oid NAME \'acmeAuthorizationWildcard\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 EQUALITY booleanMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeChallengeId-oid NAME \'acmeChallengeId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeToken-oid NAME \'acmeToken\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )\nINFO: Adding attributetypes: ( acmeCertificateId-oid NAME \'acmeCertificateId\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseExactMatch SINGLE-VALUE )\nINFO: Adding objectclasses: ( acmeNonce-oid NAME \'acmeNonce\' STRUCTURAL MUST ( acmeNonceId $ acmeExpires ) )\nINFO: Adding objectclasses: ( acmeAccount-oid NAME \'acmeAccount\' STRUCTURAL MUST ( acmeAccountId $ acmeAccountKey $ acmeStatus ) MAY acmeAccountContact )\nINFO: Adding objectclasses: ( acmeOrder-oid NAME \'acmeOrder\' STRUCTURAL MUST ( acmeOrderId $ acmeAccountId $ acmeStatus $ acmeIdentifier $ acmeAuthorizationId ) MAY ( acmeError $ acmeCertificateId $ acmeExpires ) )\nINFO: Adding objectclasses: ( acmeAuthorization-oid NAME \'acmeAuthorization\' STRUCTURAL MUST ( acmeAuthorizationId $ acmeAccountId $ acmeIdentifier $ acmeAuthorizationWildcard $ acmeStatus ) MAY acmeExpires )\nINFO: Adding objectclasses: ( acmeChallenge-oid NAME \'acmeChallenge\' ABSTRACT MUST ( acmeChallengeId $ acmeAccountId $ acmeAuthorizationId $ acmeStatus ) MAY ( acmeValidatedAt $ acmeError ) )\nINFO: Adding objectclasses: ( acmeChallengeDns01-oid NAME \'acmeChallengeDns01\' SUP acmeChallenge STRUCTURAL MUST acmeToken )\nINFO: Adding objectclasses: ( acmeChallengeHttp01-oid NAME \'acmeChallengeHttp01\' SUP acmeChallenge STRUCTURAL MUST acmeToken )\nINFO: Adding objectclasses: ( acmeCertificate-oid NAME \'acmeCertificate\' STRUCTURAL MUST ( acmeCertificateId $ userCertificate ) MAY acmeExpires )\nINFO: Creating indexes\nINFO: Importing /usr/share/pki/kra/conf/index.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-25296192129415365.ldif\nINFO: Adding cn=revokedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=revokedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=issuedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=issuedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=publicKeyData,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=publicKeyData,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=clientId,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=clientId,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=dataType,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=dataType,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=status,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=status,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=description,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=description,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=serialno,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=serialno,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=metaInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=metaInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=certstatus,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=certstatus,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requestid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requestid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requesttype,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requesttype,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requeststate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requeststate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requestowner,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requestowner,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=notbefore,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=notbefore,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=notafter,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=notafter,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=duration,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=duration,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=dateOfCreate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=dateOfCreate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=revokedOn,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=revokedOn,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=archivedBy,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=archivedBy,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=ownername,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=ownername,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=subjectname,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=subjectname,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requestsourceid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requestsourceid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=revInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=revInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=extension,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=extension,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=realm,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nINFO: Setting up database manager\nINFO: Importing /usr/share/pki/server/conf/manager.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-3984013368624234966.ldif\nINFO: Adding ou=csusers,cn=config\nWARNING: Unable to add ou=csusers,cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Modifying o=kra,o=ipaca\nINFO: - adding aci: (targetattr = "*")(version 3.0; acl "cert manager access v2"; allow (all) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify o=kra,o=ipaca: netscape.ldap.LDAPException: error result (20); Type or value exists\nINFO: Modifying cn=ldbm database,cn=plugins,cn=config\nINFO: - adding aci: (targetattr = "*")(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Modifying cn=config\nINFO: - adding aci: (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Modifying ou=csusers,cn=config\nINFO: - adding aci: (targetattr != "aci")(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Modifying cn="o=kra,o=ipaca",cn=mapping tree,cn=config\nINFO: - adding aci: (targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify cn="o=kra,o=ipaca",cn=mapping tree,cn=config: netscape.ldap.LDAPException: error result (32); No such object\nINFO: Modifying cn="o=kra,o=ipaca",cn=mapping tree,cn=config\nINFO: - adding aci: (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify cn="o=kra,o=ipaca",cn=mapping tree,cn=config: netscape.ldap.LDAPException: error result (32); No such object\nINFO: Modifying cn="o=kra,o=ipaca",cn=mapping tree,cn=config\nINFO: - adding aci: (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify cn="o=kra,o=ipaca",cn=mapping tree,cn=config: netscape.ldap.LDAPException: error result (32); No such object\nINFO: Modifying cn=tasks,cn=config\nINFO: - adding aci: (targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Creating VLV indexes\nINFO: Importing /usr/share/pki/kra/conf/vlv.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-1261970238527115258.ldif\nINFO: Adding cn=allKeys-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraAll-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraArchival-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceled-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejected-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraComplete-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=allKeys-pki-tomcatIndex, cn=allKeys-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraAll-pki-tomcatIndex, cn=kraAll-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraArchival-pki-tomcatIndex, cn=kraArchival-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRecovery-pki-tomcatIndex, cn=kraRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceled-pki-tomcatIndex, cn=kraCanceled-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledEnrollment-pki-tomcatIndex, cn=kraCanceledEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledRecovery-pki-tomcatIndex, cn=kraCanceledRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejected-pki-tomcatIndex, cn=kraRejected-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedEnrollment-pki-tomcatIndex, cn=kraRejectedEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedRecovery-pki-tomcatIndex, cn=kraRejectedRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraComplete-pki-tomcatIndex, cn=kraComplete-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteEnrollment-pki-tomcatIndex, cn=kraCompleteEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteRecovery-pki-tomcatIndex, cn=kraCompleteRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Rebuilding VLV indexes\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-kra-reindex-8248341685647863582.ldif\nINFO: Adding cn=index1160527115, cn=index, cn=tasks, cn=config\nINFO: Waiting for task cn=index1160527115, cn=index, cn=tasks, cn=config (1s)\nINFO: Getting cn=index1160527115, cn=index, cn=tasks, cn=config\nINFO: Task cn=index1160527115, cn=index, cn=tasks, cn=config complete\nFINE: PKIClientSocketListener.alertReceived: begins\nFINE: SSL alert received:\nFINE: - reason: CLOSE_NOTIFY\nFINE: - client: 10.1.1.7\nFINE: - server: 10.1.1.7\nFINE: - subject: SYSTEM\nFINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertReceived: CS_CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertReceived: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636 reason=CLOSE_NOTIFY\nFINE: PKIClientSocketListener.alertSent: begins\nFINE: PKIClientSocketListener.alertSent: got description:0\nFINE: PKIClientSocketListener.alertSent: got reason:CLOSE_NOTIFY\nFINE: PKIClientSocketListener.alertSent: CS_CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertSent: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636 reason=CLOSE_NOTIFY\nFINE: SSL alert sent:\nFINE: - reason: CLOSE_NOTIFY\nFINE: - client: 10.1.1.7\nFINE: - server: 10.1.1.7\nFINE: - subject: SYSTEM\nFINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertSent: CS_CLIENT_ACCESS_SESSION_ESTABLISH_FAILURE\nFINE: PKIClientSocketListener.alertSent: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636 reason=CLOSE_NOTIFY\nINFO: Updating ranges for KRA clone\nINFO: Updating request ID range\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-range-request request --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:24 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Requesting request range\nINFO: HTTP request: POST /kra/admin/kra/updateNumberRange HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 57\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:25 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 165\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Response: <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>0</Status><beginNumber>99980001</beginNumber><endNumber>99990000</endNumber></XMLResponse>\nFINE: Status: 0\nINFO: Begin: 99980001\nINFO: End: 99990000\nINFO: Updating serial number range\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-range-request serialNo --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:28 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Requesting serialNo range\nINFO: HTTP request: POST /kra/admin/kra/updateNumberRange HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 58\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:29 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 167\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Response: <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>0</Status><beginNumber>11ffe0001</beginNumber><endNumber>11fff0000</endNumber></XMLResponse>\nFINE: Status: 0\nINFO: Begin: 11ffe0001\nINFO: End: 11fff0000\nINFO: Updating replica ID range\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-range-request replicaId --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:32 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Requesting replicaId range\nINFO: HTTP request: POST /kra/admin/kra/updateNumberRange HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 59\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:32 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 157\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Response: <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>0</Status><beginNumber>1285</beginNumber><endNumber>1289</endNumber></XMLResponse>\nFINE: Status: 0\nINFO: Begin: 1285\nINFO: End: 1289\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Updating configuration for KRA clone\nINFO: Updating configuration\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-config-export --names internaldb.ldapauth.password,internaldb.replication.password,cloning.ca.type --substores internaldb,internaldb.ldapauth,internaldb.ldapconn,kra.transport,kra.storage,kra.subsystem,kra.audit_signing --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:36 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Getting configuration properties\nINFO: HTTP request: POST /kra/admin/kra/getConfigEntries HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 269\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:36 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 10909\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Status: 0\nINFO: Properties:\nINFO: - internaldb._000\nINFO: - internaldb._001\nINFO: - internaldb._002\nINFO: - internaldb.basedn\nINFO: - internaldb.database\nINFO: - internaldb.maxConns\nINFO: - internaldb.minConns\nINFO: - internaldb.ldapauth.authtype\nINFO: - internaldb.ldapauth.bindDN\nINFO: - internaldb.ldapauth.bindPWPrompt\nINFO: - internaldb.ldapauth.clientCertNickname\nINFO: - internaldb.ldapconn.host\nINFO: - internaldb.ldapconn.port\nINFO: - internaldb.ldapconn.secureConn\nINFO: - kra.transport.cert\nINFO: - kra.transport.certreq\nINFO: - kra.transport.nickname\nINFO: - kra.transport.tokenname\nINFO: - kra.storage.cert\nINFO: - kra.storage.certreq\nINFO: - kra.storage.nickname\nINFO: - kra.storage.tokenname\nINFO: - kra.subsystem.cert\nINFO: - kra.subsystem.certreq\nINFO: - kra.subsystem.dn\nINFO: - kra.subsystem.nickname\nINFO: - kra.subsystem.tokenname\nINFO: - kra.audit_signing.cert\nINFO: - kra.audit_signing.certreq\nINFO: - kra.audit_signing.nickname\nINFO: - kra.audit_signing.tokenname\nINFO: - internaldb.replication.password\nINFO: - cloning.ca.type\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Restarting server\nDEBUG: Command: systemctl restart pki-tomcatd(a)pki-tomcat.service\nINFO: FIPS mode is not enabled\nINFO: Subsystem status: running\nINFO: Configuring KRA subsystem\nINFO: Setting up clone\nINFO: Creating clone setup request\n/usr/lib/python3.6/site-packages/urllib3/connection.py:362: SubjectAltNameWarning: Certificate for ipa.example.com has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)\n SubjectAltNameWarning\nINFO: Setting up database\nINFO: Creating database setup request\nINFO: Getting sslserver cert info from CS.cfg\nINFO: Getting sslserver cert info from NSS database\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /tmp/tmpl_0lpu4u/password.txt -n Server-Cert cert-pki-ca -a\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /tmp/tmpef27un35/password.txt\nINFO: Setting up transport certificate\nINFO: transport certificate is already set up\nINFO: Setting up storage certificate\nINFO: storage certificate is already set up\nINFO: Setting up sslserver certificate\nINFO: sslserver certificate is already set up\nINFO: Setting up subsystem certificate\nINFO: subsystem certificate is already set up\nINFO: Setting up audit_signing certificate\nINFO: audit_signing certificate is already set up\nINFO: Backing up keys into /etc/pki/pki-tomcat/alias/kra_backup_keys.p12\nDEBUG: Command: pki-server subsystem-cert-export kra -i pki-tomcat --pkcs12-file /etc/pki/pki-tomcat/alias/kra_backup_keys.p12 --pkcs12-password-file /tmp/tmpdeq3qnpk/password.txt\nINFO: Setting up security domain\nINFO: Creating security domain setup request\nINFO: Finalizing KRA configuration\nINFO: Creating finalize config request\n') See the installation logs and the following files/directories for more information: /var/log/pki/pki-tomcat [error] RuntimeError: KRA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. KRA configuration failed. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@ipa]~#

4 4

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

certmonger error on ubuntu
by Robson Francisco de Souza 07 Feb '24

07 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 19 Sep '23

19 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

Do keytabs expire?
by Ronald Wimmer 07 Jun '23

07 Jun '23

Hi, today I found out that some entries in a keytab file seemed to have expired: Request ticket server HTTP/mwc.linux.mydomain.at(a)LINUX.MYDOMAIN.AT kvno 4 not found in keytab; keytab is likely out of date Fetching the keytab again with ipa-getkeytab fixed the problem. But why is this happening? Do keytab entries expire? I have not set any custom password or ticket policies. Regards, Ronald

4 13

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 28 Mar '23

28 Mar '23

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

2 2

ipa-replica-install fails when I use custom certificates
by Peter Tselios 08 Feb '23

08 Feb '23

I have installed the ipa server by using the following command: --------- ipa-server-install --realm "EXAMPLE.COM" -p 'password' -a 'password' --hostname="server.example.com" -n example.com --ip-address="10.1.4.2" --dirsrv-cert-file=/etc/pki/tls/private/example.com.pem --dirsrv-cert-file=/etc/pki/tls/certs/example.com.crt --dirsrv-pin='' --http-cert-file=/etc/pki/tls/certs/example.com.crt --http-cert-file=/etc/pki/tls/private/example.com.pem --http-pin='' --ca-cert-file=/etc/pki/ca-trust/source/anchors/myca.pem --ca-cert-file=/etc/pki/ca-trust/source/anchors/mysubca.pem --mkhomedir -N --no-host-dns --unattended --------- Which works perfectly fine. However, I cannot make it work with ipa-replica-install since there is no option for --ca-cert-file. So, how can I install a replica with custom certificates?

6 12

FreeIPA CA failing to login with new admin user
by Stasiek Michalski 19 Dec '22

19 Dec '22

Hello, I installed FreeIPA replica on 4.8.4 on CentOS 8 from 4.4.4 from Fedora 25 with `ipa-replica-install --setup-dns --auto-forwarders`, without `--setup-ca` due to errors, which went fine. I do want to install CA though, which failed when I did `--setup-ca` and then later `ipa-ca-install` with the following error: ``` [4/29]: creating installation admin user Unable to log in as uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca on ldap://freeipa.infra.opensuse.org:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca did not replicate to ldap://freeipa.infra.opensuse.org:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ``` Obviously I did try try extending the timeout based on that, but I don't think that was helpful in the end, considering the logs produced by the old server: httpd access_log ``` 192.168.47.90 - - [23/Jul/2020:00:25:36 +0000] "GET /ca/rest/account/login HTTP/1.1" 401 994 ``` server process in journal ``` SSLAuthenticatorWithFallback: Authenticating with BASIC authentication Invalid Credential. at com.netscape.cmscore.authentication.PasswdUserDBAuthentication.authenticate(PasswdUserDBAuthentication.java:167) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:63) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:78) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:94) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:98) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:579) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:877) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) SSLAuthenticatorWithFallback: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" SSLAuthenticatorWithFallback: Fallback auth return code: 401 SSLAuthenticatorWithFallback: Result: false ``` and from pki logs ``` Failed to authenticate as admin UID=admin-freeipa2.infra.opensuse.org. Error: netscape.ldap.LDAPException: error result (49) ``` I don't particularly know how to proceed from here, since those errors don't mean much to me. I see however it's not just me having issues with `ipa-ca-install` at least similar to this one (although by the looks of it, the reason is already different ;) Thanks in advance for trying, LCP [Stasiek] https://lcp.world/

4 6

Problem running IPA client on IPv6 only connection
by William Muriithi 26 Jul '22

26 Jul '22

Hello, I have an IPA clients that has both IPv4 and IPv6 addresses. One of the IPA client is in the office and hence can reach the IPA server on both IPv4 and IPv6. However, the client outside the LAN can only reach the IPA server over IPv6. I was able to enroll the external client fine over IPv6 and from the logs, all clean. However, when I attempted to ssh, its not able to retreave the user from IPA. The client in the office works fine. I can also make for example LDAP queries and they work over IPv6 fine. It looks like kerberos is somehow however using IPv4. I reached this conclusion after taking a tcpdump when attempting to ssh to the server and the kerberos traffic from the client to IPA is on IPv4. What would I need to do on the IPA client for it to prefer IPv6? I am aware I could remove IPv4 address from DNS, but that would break any communication from IPv4 only systems. Any assistance would be appreaciated. [william@ansible ~]$ ssh root(a)mars.external.example.com Last login: Mon Jan 7 17:19:49 2019 from 65.98.193.94 [root@mars ~]# kinit admin kinit: Cannot contact any KDC for realm 'EXTERNAL.EXAMPLE.COM <http://external.example.com/>' while getting initial credentials [root@mars ~]# ldapsearch -x -b cn=ftp,cn=groups,cn=compat,dc=external,dc=example,dc=com | tail -n 4 result: 0 Success # numResponses: 2 # numEntries: 1 [root@mars ~]# cat /etc/resolv.conf search external.example.com nameserver 2607:4860:6000:a::5 [root@mars ~]# Regards, William

5 10

ssh key issues
by Andrew Meyer 21 Jul '22

21 Jul '22

I recently cleaned up a few server in my home lab. Deleted servers that I no longer needed. However It seems I have a server with an IP address that used previously. FreeIPA is reporting that it is in /var/lib/sss/pubconf/known_hosts but I can't reverse engineer the hostname by doing sshkey -R 1.2.3.4. I have run into this issue previously but it has bee quite some time. When I go to delete the line from /var/lib/sss/pubconf/known_hosts it is gone. If someone could help me that would be great. I didn't see anything on my FreeIPA master that indicated I did anything there.

5 12

Could not login with AD user
by Ronald Wimmer 20 Jul '22

20 Jul '22

Today I was not able to log in with an AD user to an IPA client within a test setup. IPA users worked fine. DNS is managed externally. I figured out that the DNS-Record of that particular IPA client has not been created correctly. After having corrected the DNS entry and having dropped the SSSD cache on that client I could login with my AD user. Do you have an explanation for that or was it just a coincidence? Cheers, Ronald

4 13

freeipa/certmonger for openvpn user certificates
by Patrick Spinler 27 Jun '22

27 Jun '22

Hi, I'm setting up an openvpn server and I'd like to use our already existing FreeIPA CA to issue user keys/certs for openvpn's use. Since our OpenVPN box is a freeipa client, I thought it'd be nice to use certmonger to issue and keep up to date these certs. Ergo, I've created a certificate profile: pat@apex-freeipa ~$ ipa certprofile-show --all OpenVPNUserCert dn: cn=OpenVPNUserCert,cn=certprofiles,cn=ca,dc=int,dc=apexmw,dc=com Profile ID: OpenVPNUserCert Profile description: OpenVPN User Certificates Store issued certificates: FALSE objectclass: ipacertprofile, top And also a CA acl. For experimentation (and working vs our test freeipa) I've left this as wide open as I can: [pat@apex-freeipa ~]$ ipa caacl-show --all OpenVPN_User_Certificate_ACL dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com ACL name: OpenVPN_User_Certificate_ACL Enabled: TRUE CA category: all Profile category: all User category: all Host category: all Service category: all ipauniqueid: 6dde33a6-7849-11e9-aa05-525400b52c7b objectclass: ipaassociation, ipacaacl Then, on my openvpn server, I ask for a cert for use for one of my users (myself, in this case): root@apex-openvpn:~# ipa-getcert request -f /etc/openvpn/client/pat.crt -k /etc/openvpn/client/pat.key -r -N 'CN=pat,O=INT.APEXMW.COM' -K pat -g 4096 --profile OpenVPNUserCert New signing request "20190603014016" added. But, it fails due to an access err vs the 'userCertificate' attribute of my account: root@apex-openvpn:~# ipa-getcert list (...snippy snip excess...) Request ID '20190603014016': status: CA_REJECTED ca-error: Server at https://apex-freeipa.int.apexmw.com/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'write' privilege to the 'userCertificate' attribute of entry 'uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com'.). stuck: yes key pair storage: type=FILE,location='/etc/openvpn/client/pat.key' certificate: type=FILE,location='/etc/openvpn/client/pat.crt' CA: IPA issuer: subject: expires: unknown pre-save command: post-save command: track: yes auto-renew: yes If I look at the dirsrv log, here's the accesses I see for this request (trimmed off the date/time to make the lines a _little_ shorter): root@apex-freeipa slapd-INT-APEXMW-COM# grep conn=178 access | cut -d' ' -f3- conn=178 fd=114 slot=114 connection from 10.10.200.1 to 10.10.200.1 conn=178 op=0 BIND dn="" method=sasl version=3 mech=GSS-SPNEGO conn=178 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0025554208 dn="fqdn=apex-openvpn.int.apexmw.com,cn=computers,cn=accounts,dc=int,dc=apexmw,dc=com" conn=178 op=1 SRCH base="cn=ipaconfig,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL conn=178 op=1 RESULT err=0 tag=101 nentries=1 etime=0.0001319554 conn=178 op=2 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=2 RESULT err=0 tag=101 nentries=1 etime=0.0000979573 conn=178 op=3 SRCH base="cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(cn=CA))" attrs=ALL conn=178 op=3 RESULT err=0 tag=101 nentries=1 etime=0.0000736730 conn=178 op=4 SRCH base="cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaca)(cn=ipa))" attrs="" conn=178 op=4 RESULT err=0 tag=101 nentries=1 etime=0.0000499142 conn=178 op=5 SRCH base="cn=ipa,cn=cas,cn=ca,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="ipaCaId ipaCaSubjectDN cn ipaCaIssuerDN description" conn=178 op=5 RESULT err=0 tag=101 nentries=1 etime=0.0000482726 conn=178 op=6 SRCH base="cn=apex-freeipa.int.apexmw.com,cn=masters,cn=ipa,cn=etc,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=CA))" attrs=ALL conn=178 op=6 RESULT err=0 tag=101 nentries=1 etime=0.0000950646 notes=U conn=178 op=7 SRCH base="cn=accounts,dc=int,dc=apexmw,dc=com" scope=2 filter="(&(objectClass=krbprincipalaux)(krbPrincipalName=pat(a)INT.APEXMW.COM))" attrs=ALL conn=178 op=7 RESULT err=0 tag=101 nentries=1 etime=0.0002747849 conn=178 op=8 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=8 RESULT err=0 tag=120 nentries=0 etime=0.0000135034 conn=178 op=9 SRCH base="cn=request certificate ignore caacl,cn=virtual operations,cn=etc,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="objectClass" conn=178 op=9 RESULT err=0 tag=101 nentries=1 etime=0.0000932668 - entryLevelRights: none conn=178 op=10 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="distinguishedName" conn=178 op=10 RESULT err=0 tag=101 nentries=1 etime=0.0000640289 conn=178 op=11 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="telephoneNumber ipaSshPubKey uid krbCanonicalName ipatokenRadiusUserName ipaUserAuthType krbPrincipalExpiration homeDirectory nsAccountLock usercertificate;binary title loginShell uidNumber mail ipaCertMapData memberOf memberofindirect krbPrincipalName givenName gidNumber sn ou userClass ipatokenRadiusConfigLink" conn=178 op=11 RESULT err=0 tag=101 nentries=1 etime=0.0001401737 conn=178 op=12 SRCH base="dc=int,dc=apexmw,dc=com" scope=2 filter="(|(member=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberUser=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com)(memberHost=uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com))" attrs="" conn=178 op=12 RESULT err=0 tag=101 nentries=7 etime=0.0001492344 notes=P pr_idx=0 pr_cookie=-1 conn=178 op=13 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(userPassword=*)" attrs="userPassword" conn=178 op=13 RESULT err=0 tag=101 nentries=1 etime=0.0000524838 conn=178 op=14 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(krbPrincipalKey=*)" attrs="krbPrincipalKey" conn=178 op=14 RESULT err=0 tag=101 nentries=1 etime=0.0000597589 conn=178 op=15 SRCH base="ipaUniqueID=80b23b30-6a0c-11e9-baa3-525400b52c7b,cn=sudorules,cn=sudo,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=15 RESULT err=0 tag=101 nentries=1 etime=0.0000379744 conn=178 op=16 SRCH base="ipaUniqueID=5fb3a640-705a-11e9-aa05-525400b52c7b,cn=hbac,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="cn" conn=178 op=16 RESULT err=0 tag=101 nentries=1 etime=0.0000337904 conn=178 op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" attrs="serviceCategory cn ipaMemberCertProfile ipaMemberCa ipaCertProfileCategory memberUser userCategory hostCategory memberHost ipaEnabledFlag ipaCaCategory memberService description" conn=178 op=17 RESULT err=0 tag=101 nentries=2 etime=0.0001647058 conn=178 op=18 EXT oid="1.3.6.1.4.1.4203.1.11.3" name="whoami-plugin" conn=178 op=18 RESULT err=0 tag=120 nentries=0 etime=0.0000138321 conn=178 op=19 SRCH base="uid=pat,cn=users,cn=accounts,dc=int,dc=apexmw,dc=com" scope=0 filter="(objectClass=*)" attrs="userCertificate" conn=178 op=19 RESULT err=0 tag=101 nentries=1 etime=0.0001475052 - entryLevelRights: none conn=178 op=20 UNBIND conn=178 op=20 fd=114 closed - U1 To begin with, I note that this session does a BIND with 'dn=""', right at the beginning, it's essentially an anonymous bind, yah? That operation near the end, here: op=17 SRCH base="cn=caacls,cn=ca,dc=int,dc=apexmw,dc=com" scope=1 filter="(&(objectClass=ipaassociation)(objectClass=ipacaacl))" seems like it might be kinda key. and indeed, if I attempt to run this by hand as an anonymous bind, I get no results: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(|(objectClass=ipaassociation)(objectClass=ipacaacl))" # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (|(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 It's only if I run this as an _authenticated_ bind, that I can find my ACL: root@apex-freeipa slapd-INT-APEXMW-COM# ldapsearch -x -D "cn=Directory Manager" -W -h localhost -b dc=int,dc=apexmw,dc=com -s sub "(&(objectClass=ipaassociation)(objectClass=ipacaacl))" cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=int,dc=apexmw,dc=com> with scope subtree # filter: (&(objectClass=ipaassociation)(objectClass=ipacaacl)) # requesting: cn # # c98b740c-6903-11e9-ad1b-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=c98b740c-6903-11e9-ad1b-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: hosts_services_caIPAserviceCert # 6dde33a6-7849-11e9-aa05-525400b52c7b, caacls, ca, int.apexmw.com dn: ipaUniqueID=6dde33a6-7849-11e9-aa05-525400b52c7b,cn=caacls,cn=ca,dc=int,dc =apexmw,dc=com cn: OpenVPN_User_Certificate_ACL # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Is this (using certmonger to auto-issue signed certs/keys for my openvpn users) going to be essentially impossible to do, here? Do I need to go a more traditional route of creating a seperate keystore/certdb, issuing a CSR, and feeding that to FreeIPA to sign? Any advice appreciated, and thanks in advance, -- Pat

4 6

Broken ipa replica
by Giulio Casella 08 May '22

08 May '22

Hi everyone, I'm stuck with a broken replica. I had a setup with two ipa server in replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02". Due to heavy load idc01 crashed many times, and was not working anymore. So I tried to redo the replica again. At first I tried to "ipa-replica-manage re-initialize", with no success. Now I'm trying to redo from scratch the replica setup: on idc02 I removed the segments (ipa topologysegment-del, for both ca and domain suffix), on idc01 I removed everything (ipa-server-install --uninstall), then I joined domain (ipa-client-install), and everything is working so far. When doing "ipa-replica-install" on idc01 I get: [...] [28/41]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 22 seconds elapsed [ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error (-11) connection error: Unknown connection error (-11) - Total update aborted] And on idc02 (the working server), in /var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating: [20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)". [20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Received error -1 (Can't contact LDAP server): for total update operation [20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to send endReplication extended operation (Can't contact LDAP server) [20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11) [20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Replication bind with GSSAPI auth resumed [20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. It seems that idc02 remembers something about the old replica. Any hint? Thank you in advance, Giulio

5 10

IPA CA allow CSR SAN names in external domains
by Steve Dainard 14 Mar '22

14 Mar '22

Hello I have a RHEL7 IPA server installed as a subordinate CA. I'd like to be able to add SAN's for a different dns domain than exists in the IPA realm. The dns for 'otherdomain.com' is handled by active directory which my IPA server has a cross-forest trust with. ie: host: client1.ipadomain.com certificate: CN = client1.ipadomain.com, SAN = client1.ipadomain.com, servicename.otherdomain.com When I try to submit this CSR with 'ipa-getcert request' the IPA server denies with: "The service principal for subject alt name servicename.otherdomain.com in certificate request does not exist" It seems that the default CAACL enforces a profile named 'caIPAserviceCert', but I'm having some trouble determining what can be modified (or cloned and changed in a new profile) that would allow the CA to sign a CSR that contains *.ipadomain.com and *.otherdomain.com in the SAN. This is the only section in the profile that contains SAN: policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name Thanks, Steve

3 3

freeipa with sudo and 2FA (OTP)
by John Ratliff 31 Jan '22

31 Jan '22

I'm trying to setup freeipa with OTP. I created a TOTP under my user in freeipa and updated my user to use 2FA (password + OTP). When I try to do sudo, it only asks for my password and it fails every time (presumably because it isn't getting the OTP first). I didn't see anything useful in the sss_sudo logs, even after adding debug_level = 6 in the config. What can I do to further troubleshoot this? Thanks.

4 6

Problems after replacing SSL certificates
by Andreas Bulling 21 Oct '21

21 Oct '21

Dear all, I have recently started using FreeIPA (4.8.1 on Ubuntu) and now wanted to replace the original SSL certificates for the web UI and the LDAP server with official ones issued by our university. I've followed the procedure described here (no errors): https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP I could confirm in the browser that the certificate for the web UI has been replaced and I therefore assume so has the LDAP certificate. Authentication from other hosts/services using LDAP still works but in the server log file I see errors like these for all hosts in the domain: Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: NEEDED_PREAUTH: host/X@X for krbtgt/X@X, Additional pre-authentication required Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for krbtgt/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Apr 20 19:57:11 auth krb5kdc[24895]: TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) X: ISSUE: authtime 1587405431, etypes {rep=18 tkt=18 ses=18}, host/X@X for ldap/X@X Apr 20 19:57:11 auth krb5kdc[24895]: closing down fd 12 Also, ipa-certupdate on the respective clients shows ipa-certupdate trying https://X/ipa/json [try 1]: Forwarding 'schema' to json server 'https://X/ipa/json' cannot connect to 'https://X/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727) The ipa-certupdate command failed. Also, I can't login to the web UI anymore. I tried ipa-getkeytab -s X -p HTTP/X@X -k /var/lib/ipa/gssproxy/http.keytab on the freeipa server (followed by ipactl restart) but this didn't help. Any idea/suggestions for how to get everything working again? Thanks a lot!

6 15

User in AD not found by IPA
by Marc Boorshtein 14 Oct '21

14 Oct '21

We added a new account to AD that has a domain trust with FreeIPA. This one user is having an issue where IPA can't find him. The user is in the same OU as other users that work fine. The user is unlocked (userAccountControl is 512) and the userprincipalname is set. When I try to add the user to an id view or an external group IPA gives me the error "trusted domain object not found" . Not really sure where to look next to figure out what's wrong. We see the user when we make LDAP calls to AD. Thanks Marc

4 14

Cannot add externally-signed IPA CA certificate
by Dmitry Perets 27 Aug '21

27 Aug '21

Hi, I am trying to configure FreeIPA as a SubCA, and the "RootCA" is self-made with openssl. So I've signed the FreeIPA's request with my self-signed "root ca" certificate, but it looks like FreeIPA doesn't like it: ipa-server-install --external-cert-file=/root/rootca/rootcacert.pem --external-cert-file=/root/rootca/certs/ipacert.pem <...skipped...> ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR CA certificate CN=RootCA,OU=PRJ,O=COMPANY,L=Bonn,C=DE in /root/rootca/rootcacert.pem, /root/rootca/certs/ipacert.pem is not valid: not a CA certificate ipa.ipapython.install.cli.install_tool(CompatServerMasterInstall): ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information The subj above is my self-made root CA cert, so it looks like something is missing in it. But what...? Here is it below, it has the "Basic Constraint" set with CA:TRUE... What else is required, so that FreeIPA accepts it as a root CA? Should I add it somewhere first, before running the ipa-server-install? [root@ipa ~]# openssl x509 -text -noout -in /root/rootca/rootcacert.pem Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha256WithRSAEncryption Issuer: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Validity Not Before: Oct 24 11:43:13 2018 GMT Not After : Oct 21 11:43:13 2028 GMT Subject: C=DE, L=Bonn, O=COMPANY, OU=PRJ, CN=RootCA Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: <...skipped...> Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Authority Key Identifier: keyid:B3:18:3B:CF:29:D2:A5:D4:AE:94:A5:42:65:A2:D8:12:7C:92:78:81 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption <...skipped...> Thanks!!

2 2

FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
by Anthony Joseph Messina 01 Jul '21

01 Jul '21

After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc. May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock The server seems to come up without issue, but can you point me in the right direction to resolve these errors? freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64 I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors. Thanks. -A -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

7 9

dirsrv hangs soon after reboot
by Kees Bakker 17 May '21

17 May '21

Hey, I'm looking for advice how to analyse/debug this. On one of the masters the dirsrv is unresponsive. It runs, but every attempt to connect it hangs. The command "systemctl status" does not show anything alarming ● dirsrv(a)EXAMPLE-COM.service - 389 Directory Server EXAMPLE-COM. Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled) Active: active (running) since vr 2020-04-17 13:46:25 CEST; 1h 33min ago Process: 3123 ExecStartPre=/usr/sbin/ds_systemd_ask_password_acl /etc/dirsrv/slapd-%i/dse.ldif (code=exited, status=0/SUCCESS) Main PID: 3134 (ns-slapd) Status: "slapd started: Ready to process requests" CGroup: /system.slice/system-dirsrv.slice/dirsrv(a)EXAMPLE-COM.service └─3134 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-EXAMPLE-COM -i /var/run/dirsrv/slapd-EXAMPLE-COM.pid apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:13:54 linge.example.com ns-slapd[3134]: GSSAPI client step 2 apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:54 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 1 apr 17 15:18:55 linge.example.com ns-slapd[3134]: GSSAPI client step 2 However, an ldapsearch command hangs forever [root@rotte ~]# ldapsearch -H ldaps://linge.example.com -D uid=keesbtest,cn=users,cn=accounts,dc=example,dc=com -W -LLL -o ldif-wrap=no -b cn=users,cn=accounts,dc=example,dc=com '(&(objectClass=person)(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))' uid Enter LDAP Password: Even if I use the socket (ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket) the ldapsearch command hangs. "ipactl status" hangs "kinit" hangs -- Kees Bakker

5 16

DNS - trusted-keys via IPA's tools - ?
by lejeczek 03 May '21

03 May '21

hi everybody I want to ask if we have a way of adding trusted-keys? Official/recommended VS by fiddling/non-recommended ? many thanks, L.

1 1

Something changed regarding enrollment permissions?
by Ronald Wimmer 18 Feb '21

18 Feb '21

Today we did not manage to enroll new hosts with our enrollment user. The only thing we changed is that we added the Permission "System: Remove hosts" to the "Host Enrollment" role. The error we get is: Joining realm failed: Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab child exited with 9 When I try to add the same host with my admin user it works without any problems. Cheers, Ronald

2 2

Unable to install ipa client centos 7.5.1804 (Core)
by William Graboyes 16 Feb '21

16 Feb '21

Hello List, I have been searching around for the day and have found an answer for the error I am getting when I am trying to install the client on a brand new install: Version: ipa-client-4.5.4-10.el7.centos.3.x86_64 ipa-client-common-4.5.4-10.el7.centos.3.noarch The error is below (run as root, not via sudo): ipa-client-install Traceback (most recent call last): File "/sbin/ipa-client-install", line 22, in <module> from ipaclient.install import ipa_client_install File "/usr/lib/python2.7/site-packages/ipaclient/install/ipa_client_install.py", line 5, in <module> from ipaclient.install import client File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 34, in <module> from ipalib import api, errors, x509 File "/usr/lib/python2.7/site-packages/ipalib/x509.py", line 45, in <module> from pyasn1_modules import rfc2315, rfc2459 File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 67, in <module> class DigestedData(univ.Sequence): File "/usr/lib/python2.7/site-packages/pyasn1_modules/rfc2315.py", line 72, in DigestedData namedtype.NamedType('digest', Digest) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 115, in __init__ self.__ambiguousTypes = 'terminal' not in kwargs and self.__computeAmbiguousTypes() or {} File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 232, in __computeAmbiguousTypes ambigiousTypes[idx] = NamedTypes(*partialAmbigiousTypes, **dict(terminal=True)) File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 114, in __init__ self.__tagToPosMap = self.__computeTagToPosMap() File "/usr/lib/python2.7/site-packages/pyasn1/type/namedtype.py", line 205, in __computeTagToPosMap for _tagSet in tagMap.presentTypes: AttributeError: 'property' object has no attribute 'presentTypes' Any help would be greatly appreciated. Thanks, Bill G.

3 2

FreeIPA certificate doesn't validate in iOS
by Jochen Kellner 16 Feb '21

16 Feb '21

Hello, I'm running IPA on current Fedora 32, freeipa-server-4.8.9-2 and pki-server-10.9.0-0.4 Today the certificate of my IMAP server (running on Debian Buster) was automatically refreshed: ,---- | Request ID '20181003215953': | status: MONITORING | stuck: no | key pair storage: type=FILE,location='/etc/ssl/private/imap.jochen.org.key' | certificate: type=FILE,location='/etc/ssl/certs/imap.jochen.org.crt' | CA: IPA | issuer: CN=Certificate Authority,O=JOCHEN.ORG | subject: CN=imap.jochen.org,O=JOCHEN.ORG | expires: 2022-09-07 09:30:16 CEST | dns: imap.jochen.org | principal name: imap/jupiter.jochen.org(a)JOCHEN.ORG | key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment | eku: id-kp-serverAuth,id-kp-clientAuth | pre-save command: | post-save command: /root/refresh_cyrus_certificate.sh | track: yes | auto-renew: yes `---- On an iPhone one of my users gets a message that the certificate is not valid. Reason seems to be this: https://7402.org/blog/2019/new-self-signed-ssl-cert-ios-13.html When I look at the certificate with openssl I see: ,---- | X509v3 extensions: | X509v3 Authority Key Identifier: | keyid:4F:F8:45:3D:E8:06:4B:8D:BB:9D:D2:D1:8B:00:43:A1:07:16:A1:17 | | Authority Information Access: | OCSP - URI:http://ipa-ca.jochen.org/ca/ocsp | | X509v3 Key Usage: critical | Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment | X509v3 Extended Key Usage: | TLS Web Server Authentication, TLS Web Client Authentication `---- My current guess is that the "Key Usage: critical" is the reason for the iOS error. I've looked for the certprofiles and found these files: ,---- | [root@freeipa3 /]# find . -name \*caIPAserviceCert\* -ls | 8510694 8 -rw-rw---- 1 pkiuser pkiuser 6218 Mär 4 2020 ./var/lib/pki/pki-tomcat/ca/profiles/ca/caIPAserviceCert.cfg | 9332162 4 -rw-r--r-- 1 root root 229 Aug 20 12:38 ./usr/lib/python3.8/site-packages/ipaclient/csrgen/profiles/caIPAserviceCert.json | 26138015 8 -rw-r--r-- 1 root root 7014 Aug 20 12:37 ./usr/share/ipa/profiles/caIPAserviceCert.UPGRADE.cfg | 26138016 8 -rw-r--r-- 1 root root 7294 Aug 20 12:37 ./usr/share/ipa/profiles/caIPAserviceCert.cfg | 9323278 8 -rw-r--r-- 1 root root 6272 Jun 25 23:53 ./usr/share/pki/ca/profiles/ca/caIPAserviceCert.cfg `---- These files contain: ,---- | policyset.serverCertSet.6.constraint.params.keyUsageCritical=true | policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true | policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true | policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true | policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true | policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false `---- So I think this is where the critical comes from and the keyUsage defaults come from. What I could use help with is the following: 1. I didn't find reports about the problem in pagure or the mailing list. Am I really alone with this? 2. My FreeIPA has been installed years ago on Fedora, moved to CentOS and this year back to Fedora by creating replicas. Has there been a problem with upgrading the certprofiles? 3. How can I remove the options from the certificate request so that certmonger gets a valid certificate? Do I miss something else? -- This space is intentionally left blank.

4 16

Concurrent ssh to the same host fails after few successfully open sessions with Additional pre-authentication krb error.
by mir mal 11 Feb '21

11 Feb '21

Hi, As in the title a very odd behaviour if I keep opening new ssh sessions using same IPA user after few successful ones I have ssh authentication failed error and in krb5 logs on freeipa server, I can see the following errors: Nov 19 07:21:39 lab-ipa.stuxnet.lab krb5kdc[4894](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 192.168.10.64: NEEDED_PREAUTH: c000000(a)STUXNET.LAB for krbtgt/STUXNET.LAB(a)STUXNET.LAB, Additional pre-authentication required Nov 19 07:21:39 lab-ipa.stuxnet.lab krb5kdc[4894](info): closing down fd 11 At the same time, I can use the same user and connect to other hosts or use kinit or freeipa web portal. It looks like after N successful attempts I'm hitting some kind of time or max concurrent connections limit, but I can't find any related settings. It's standard Fedora-based freeipa 4.8.10 and hosts to connect are ubuntu. If I wait a few minutes I'm allowed to open another connection but then again if I try to open few I hit the error. I've been checking KRB_TRACE for kinit and sshd DEBUG3 level logs but I can't find why would it happen the only error is the one above with pre-auth. Thanks

5 14

Re: IPA Kerberos Trust problem with Windows Update kb4586830
by Schindler, Daniel (STEAG Energy Services GmbH) 16 Dec '20

16 Dec '20

Hi guys, Have you had the chance to see if the out-of-band patch from MS really fixes the issue? We have installed the fix on a Windows Server 2012 R2 domain controller but in my case I'm still not able to authenticate against it. My involved components: Oracle Linux 7.x; Kerberos; SSSD Please see my thread at Github for further info: https://github.com/SSSD/sssd/issues/5408 -- Mit freundlichen Grüßen Kind regards Daniel Schindler Systemspezialist Network Management Services Information Technologies / Technical Services STEAG Energy Services GmbH Rüttenscheider Str. 1-3 45128 Essen Germany www.steag-energyservices.com<http://www.steag-energyservices.com/>

3 2

IPA Kerberos Trust problem with Windows Update kb4586830
by Jerry Träskelin 16 Dec '20

16 Dec '20

Hello, first let me introduce our setup: - FreeIPA 4.6.5 (I know it's a bit old already) masters CentOS 7 - FreeIPA 4.6.6 client CentOS 7 - Windows Server 2016 DCs - Netapp Filer NFS server There's a two-way trust between the AD and IPA domains which works nicely. User accounts exist in the AD domain and can be used on IPA members as well. The Netapp has a computer account in AD. IPA clients mount NFSv4 shares using krb5p encryption. The problem: After installing the latest Windows updates on the DCs (kb4586830) the Kerberos authentication to the file server started failing. We were able to identify it as a Kerberos problem by trying to mount without Kerberos, which worked but of course nothing was accessible. After trying a bunch of different things and reading a lot of logs, we finally uninstalled the update on the DCs and everything worked again. There's not a whole lot of error messages to go on even though log/debug levels were set to the highest. The mounting client will simply say "mount.nfs: access denied by server while mounting". On the DC I was a able to find a Failure Code 0x3C for the Kerberos ticket request. 0x3C is a generic error, according to https://docs.microsoft.com/en-us/windows/security/threat-protection/auditin…. None of the possible causes listed by Microsoft apply to our situation. Since uninstalling the update on the DCs made the problem go away, I guess it's safe to assume that Microsoft changed something. The update notes don't really mention anything useful, but after some googling I found https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-17049 which seems like something that could have caused this. Is there some settings in the IPA that could be changed to comply with the changes made by Microsoft? Thanks!

4 4

Stateless Machines and Force Join
by Mark Potter 12 Dec '20

12 Dec '20

We boot everything stateless in our environment and are using FreeIPA for authentication. I started discussing this a while ago but ended up with other things taking priority. The number of machines we have make managing keys an untenable solution so we are using ipa-client-install -U -q -p <join user> -w <password --domain=domain.com --server=ipaserver.domain.com --fixed-primary --force-join called from rc.local during boot to rejoin machines to the FreeIPA environment (we will be moving away from --fixed-primary but aren't there yet). While this works it, potentially, exposes a password. I am looking for a better way to handle machines that need to re-join at every boot. We have access to ansible as well a decent, in house, templating system for configuration. Please forgive my starting this discussion anew and not resurrecting a zombie and thanks in advance for your help! -- *Mark Potter* Senior Linux Administrator

3 5

Allocation of a new value for DNA range failed
by Ronald Wimmer 03 Dec '20

03 Dec '20

After upgrading to OL 8.1 and replacing all of my 8 IPA servers I ran into this particular problem. Is it right that I need to have an ID range where all DNA ranges have to fit in? And that the DNA range of each IPA server has to be distinct from the ranges of the other IPA servers? I will start by checking each IPA server with ldapsearch -x -D 'cn=Directory Manager' -W -b 'cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' (according to what Rob wrote on his blog some years ago https://rcritten.wordpress.com/2015/01/05/freeipa-and-no-dna-range/ ) Cheers, Ronald

2 7

SmartCard-HSM authentication using pinpad card reader for improved security
by Peter Steen 03 Dec '20

03 Dec '20

Hello Folks! We are working on getting smart card authentication working using pinpad card readers for improved security. To do this we use: FreeIPA Server is running on Fedora32 with latest updates. FreeIPA is also configured to be Certificate Authority. FreeIPA Clients are Fedora 32 based with latest updates with connected usb card reader Gemalto C700 with pinpad, we use several user individual SmartCard HSM 4K with FreeIPA signed certificates on them. FreeIPA Clients run OpenSC and are configured to use smartcard certificate based authentication, setup per Smartare HSM best practice. Further clients are using SSSD and not PAM_PKCS#11. All working great using smartcard for authentication, as long not enabling the pinpad in opensc. If doing so we are prompted for the PIN not only in the pinpad reader but also GDM prompts you to enter PIN on keyboard. Expected result is to be logged in directly after entering correct PIN code on pinpad reader, not being prompted by GDM to enter PIN on keyboard as well. If enabling pinpad, login gets a bit odd: 1. Fedora 32 workstation GDM menu prompts a few users that can login 2. Smartcard is inserted in reader 3. GDM blanks out the screen and smartcard reader prompts to enter PIN. 4. Entering pin on smartcard reader followed by pressing ok button on smartcard reader at getting result Pin OK in reader display. 5. GDM now prompts for entering PIN on keyboard, this is unexpected, instead of being logged in to the window manager, here Gnome or xfce. 6. Any number can be entered, it does not matter, followed by hitting enter. 7. Once again smartcard reader now prompts for PIN. 8. Entering PIN on the smartcard pinpad reader followed by pressing pinpad ok button. 9. You are now logged in, and all is normal. If ripping out the smartcard from reader the screen locks, as expected. What could this be, anyone who have seen this before or know how to set it up ?

2 6

setup ipa server with DNS when domain is managed by existing DNS server but not yet managing the reverse zones I want to configure
by Rob van Halteren 02 Dec '20

02 Dec '20

Hello, I have seen more threats like this but not exactly this topic. I am setting up an IPA server in a existing internal domain on a B-class network range . I have already a DNS server running for this domain, but it holds only a C-class network range. I tried to setup the IPA server with the "ipa-server-install --setup-dns --no-forwarders --auto-reverse --allow-zone-overlap" options but this does not work and results in the disability to create PTR records for any network range in my domain. + it than needs the existing DNS server as forwarder to be able to resolve global addresses. I intent to install the IPA server as qualified DNS server for my domain , next to the existing DNS server and when setup, decommission the existing DNS server. Any help would be appreciated Thanks. Rob.

1 1

topology question / ansible-freeipa
by Rainer Duffner 30 Nov '20

30 Nov '20

Hi, I’m trying to install FreeIPA on CentOS 8.2 with the ansible-freeipa module. After a few hiccups, it seems to work now. I want to run three masters in the end. Using the cluster-playbook, it looks like (from the Topology-Graph in the Web-GUI) that I end up with something like this: 3 < -- > 1 < -- > 2 Which seems to indicate that 3 does not talk to 2. From the documentation, it looks like I want/need replication agreements between 1+2, 1+3 and 2+3 so that if 1 is down, 2 and 3 can still be updated and talk to each other. This would - as far as I have understood the documentation - result in a playbook like this: --- - name: Add topology segments hosts: ipaserver become: true gather_facts: false vars: ipatopology_segments: - {suffix: domain+ca, left: ipa-ansible1.ipa.example.org, right: ipa-ansible2.ipa.example.org} - {suffix: domain+ca, left: ipa-ansible1.ipa.example.org, right: ipa-ansible3.ipa.example.org} - {suffix: domain+ca, left: ipa-ansible2.ipa.example.org, right: ipa-ansible3.ipa.example.org} tasks: - name: Add topology segment ipatopologysegment: ipaadmin_password: "{{ ipaadmin_password }}" suffix: "{{ item.suffix }}" name: "{{ item.name | default(omit) }}" left: "{{ item.left }}" right: "{{ item.right }}" state: checked loop: "{{ ipatopology_segments | default([]) }}“ However, when I run that, it doesn’t seem to do anything. Maybe somebody can add some information here? Rainer

2 3

ipa failed to start after reboot
by Paul-Henri Hons 30 Nov '20

30 Nov '20

Hello, I'm on Centos8 with freeipa installed from several month in lxc container (2 containers with replication). I've intalled custom certificates from letsencrypt for httpd and slapd and they're valid till january 2021. Yesterday, I restarted the containers and on both, Directory service failed to start. The log is below. Can someone help me to find the right direction to solve it ? All my services heavely depends on it :-( Thanks by advance, Paul-Henri [30/Nov/2020:08:16:06.423512539 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [30/Nov/2020:08:16:06.440854922 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [30/Nov/2020:08:16:06.469627909 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [30/Nov/2020:08:16:06.499234923 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [30/Nov/2020:08:16:06.526831242 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [30/Nov/2020:08:16:06.555048556 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [30/Nov/2020:08:16:06.591310772 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [30/Nov/2020:08:16:06.653648267 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [30/Nov/2020:08:16:06.686970459 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [30/Nov/2020:08:16:06.716504472 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [30/Nov/2020:08:16:06.773674674 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [30/Nov/2020:08:16:06.807784636 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [30/Nov/2020:08:16:06.848156076 +0000] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [30/Nov/2020:08:16:06.881073427 +0000] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [30/Nov/2020:08:16:06.910055086 +0000] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [30/Nov/2020:08:16:06.974353372 +0000] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [30/Nov/2020:08:16:07.039826294 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.152097703 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.172262353 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.204863801 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.215156151 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.216821135 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.219650834 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.238011898 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.249040534 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.274750517 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.283165976 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.290449211 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.309211301 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.344580813 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.371243332 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.381258115 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.442193236 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ad,cn=etc,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.464066203 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.479286324 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=hoah,dc=ch does not exist [30/Nov/2020:08:16:07.594646290 +0000] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [30/Nov/2020:08:16:07.629034110 +0000] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=hoah,dc=ch--no CoS Templates found, which should be added before the CoS Definition. [30/Nov/2020:08:16:07.651839151 +0000] - ERR - ipalockout_get_global_config - [file ipa_lockout.c, line 178]: krb5_init_context failed (-1429577697) [30/Nov/2020:08:16:07.685167130 +0000] - ERR - ipaenrollment_start - [file ipa_enrollment.c, line 398]: krb5_init_context failed [30/Nov/2020:08:16:07.713369817 +0000] - ERR - ipapwd_start - [file ipa_pwd_extop.c, line 1857]: krb5_init_context failed

2 2

ipa-client-automount server query
by Scott Dungan 27 Nov '20

27 Nov '20

When attempting to setup a domain client to query the domain for automounts, we see the following: ipa-client-automount --location=default Searching for IPA server... Autodiscovery was successful but didn't return a server If we specify a server it works: ipa-client-automount --location=default --server idm1.domain.com IPA server: idm1.domain.com Location: default Continue to configure the system with these values? [no]: This implies that the client will only query this server for automount entries, rather than all IPA replicas, so therefore it is not a redundant configuration. My question is how to populate DNS entries so that the command can find the server(s) automatically. We are using an external DNS service, so this may explain why the command is unable to find automount servers?

2 3

Re: subsystemCert appears out of date
by Florence Blanc-Renaud 27 Nov '20

27 Nov '20

On 11/27/20 11:54 AM, Marc Pearson | i-Neda Ltd wrote: > Hi Flo, > > I've raised that issue as requested including this full email chain so far: > > https://pagure.io/freeipa/issue/8600 > > Sorry to seem dense, but ssl certs and keys are definatly not my strong suite, and the whole freeipa setup se have was sort of dumped on me when my colleague who was looking after this left the company. Would you be able to be a bit more specific on what I need to do to try and work around this issue, or point me in the correct direction so that I'm able figure out (and hopefully learn more of the freeipa workings) the steps to attempt this work around. > Hi, The directory server is using a server certificate on port 636 for SSL communications. The certificate is stored in a NSS database located in /etc/dirsrv/slap-XXX/, with a nickname configured in /etc/dirsrv/slap-XXX/dse.ldif: ----- dn: cn=RSA,cn=encryption,cn=config cn: RSA nsSSLActivation: on nsSSLPersonalitySSL: Server-Cert <<<< cert nickname nsSSLToken: internal (software) objectClass: top objectClass: nsEncryptionModule [...] ----- We can find a cert with this nickname in the NSS DB: ----- # certutil -L -d /etc/dirsrv/slapd-XXX Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Server-Cert u,u,u XXX IPA CA CT,C,C ----- In a usual setup, the nickname is "Server-Cert", but in your NSS DB I didn't see any certificate with this nickname. I assume that the cert nickname is "CN=*.int.i-neda.com" because it's the only one in the database with the trust attributes u,u,u (u means that there is also a private key associated with the certificate and the ldap server needs access to the private key in order to use the cert as a Server Certificate). It's totally ok to use a different nickname, as long as the nsSSLPersonalitySSL value is the same as the nickname in the NSS DB. Except that ipa-cert-fix doesn't take this into account and hardcodes the nickname "Server-Cert": https://pagure.io/freeipa/blob/master/f/ipaserver/install/ipa_cert_fix.py#_… You can either wait for a fix in ipa-cert-fix, or apply a workaround which consists in renaming the certificate into "Server-Cert". In order to do that: Stop the LDAP server # systemctl stop dirsrv@INT-I-NEDA-COM Start with a backup the existing dse.ldif and NSSDB: # cp /etc/dirsrv/slapd-INT-I-NEDA-COM/dse.ldif /path/to/backup # cp /etc/dirsrv/slapd-INT-I-NEDA-COM/*.db /path/to/backup Edit /etc/dirsrv/slapd-INT-I-NEDA-COM/dse.ldif and replace the certificate nickname with Server-Cert (find the line containing nsSSLPersonalitySSL): nsSSLPersonalitySSL: Server-Cert Rename the certificate in the NSSDB: # certutil -d /etc/dirsrv/slapd-INT-I-NEDA-COM/ --rename -n <old name> --new-n Server-Cert Restart LDAP server # systemctl start dirsrv@INT-I-NEDA-COM At this point you should be able to use ipa-cert-fix. HTH, flo > Thanks for all the help so far, it's been much appreciated. > > Kind Regards, > > Marc. > > -----Original Message----- > From: Florence Blanc-Renaud <flo(a)redhat.com> > Sent: 24 November 2020 10:45 > To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Subject: Re: [Freeipa-users] subsystemCert appears out of date > > On 11/24/20 10:50 AM, Marc Pearson | i-Neda Ltd wrote: >> Thanks Flo, >> >> I'm suprosed I didn't catch that typeo: >> >> certutil -L -d /etc/dirsrv/slapd-INT-I-NEDA-COM >> >> Certificate Nickname Trust Attributes >> >> SSL,S/MIME,JAR/XPI >> >> CN=AddTrust External CA Root,OU=AddTrust External TTP >> Network,O=AddTrust AB,C=SE C,, CN=COMODO High-Assurance Secure Server >> CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, CN=COMODO RSA Domain Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, >> comodoCA C,, >> INT.I-NEDA.COM IPA CA CT,C,C >> INT.I-NEDA.COM IPA CA CT,C,C >> INT.I-NEDA.COM IPA CA CT,C,C >> CN=COMODO RSA Certification Authority,O=COMODO CA >> Limited,L=Salford,ST=Greater Manchester,C=GB C,, CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, >> comodoCA2 C,, >> INT.I-NEDA.COM IPA CA CT,C,C >> INT.I-NEDA.COM IPA CA CT,C,C >> comodoCA C,, >> CN=*.int.i-neda.com u,u,u >> INT.I-NEDA.COM IPA CA CT,C,C >> > Ok, so I think the issue with ipa-cert-fix comes from the fact that the LDAP server cert is not called 'Server-Cert' but rather 'CN=*.int.i-neda.com' - you can check with the following command: > # grep nsSSLPersonalitySSL /etc/dirsrv/slapd-INT-I-NEDA-COM/dse.ldif > > Can you log an issue at https://pagure.io/freeipa/new_issue ? > When the LDAP server cert doesn't have the default name, ipa-cert-fix fails. > A possible workaround would be to rename the cert in the NSSDB to 'Server-Cert' with certutil --rename but you will also need to update the dse.ldif file (stop ds, edit, start ds). This will allow you to use ipa-cert-fix and hopefully to move forward. > > flo >> Marc. >> >> -----Original Message----- >> From: Florence Blanc-Renaud <flo(a)redhat.com> >> Sent: 24 November 2020 09:01 >> To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users >> list <freeipa-users(a)lists.fedorahosted.org> >> Subject: Re: [Freeipa-users] subsystemCert appears out of date >> >> On 11/24/20 9:54 AM, Marc Pearson | i-Neda Ltd wrote: >>> Hi Flo, >>> >>> I'm getting a database error when running that command: >>> >>> # certutil -L -d /etc/dirsrc/slapd-INT-I-NEDA-COM >>> certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. >>> >> Sorry, I made a typo, it should be dirsrv, not dirsrc: >> # certutil -L -d /etc/dirsrv/slapd-INT-I-NEDA-COM >> >> flo >>> >>> Not sure if that's of any help? >>> >>> Marc. >>> >>> -----Original Message----- >>> From: Florence Blanc-Renaud <flo(a)redhat.com> >>> Sent: 21 November 2020 19:06 >>> To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users >>> list <freeipa-users(a)lists.fedorahosted.org> >>> Subject: Re: [Freeipa-users] subsystemCert appears out of date >>> >>> On 11/18/20 12:23 PM, Marc Pearson | i-Neda Ltd wrote: >>>> Hi Flo, >>>> >>>> Thanks for the information. I've tried to run the cert fix utility just now and I'm hitting an issue, ironically with the SSL certificate: >>>> >>>> [root@red-auth01 ~]# ipa-cert-fix >>>> Failed to get Server-Cert >>>> The ipa-cert-fix command failed. >>>> >>> Hi, >>> I failed to notice the first time but there is no tracking for the LDAP cert that is stored in /etc/dirsrv/slapd-$DOMAIN/. What is the output of # certutil -L -d /etc/dirsrc/slapd-$DOMAIN You should see Server-Cert (=the ldap server certificate), or maybe a different nickname is used? >>> >>> flo >>> >>>> From the message log: >>>> Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: >>>> Forwarding request to dogtag-ipa-renew-agent Nov 18 11:18:32 >>>> red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 Nov 18 11:18:33 red-auth01 certmonger: 2020-11-18 11:18:33 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. >>>> Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: >>>> Forwarding request to dogtag-ipa-renew-agent Nov 18 11:18:35 >>>> red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 Nov 18 11:18:35 red-auth01 certmonger: 2020-11-18 11:18:35 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. >>>> >>>> Any advice? >>>> >>>> Marc. >>>> >>>> -----Original Message----- >>>> From: Florence Blanc-Renaud <flo(a)redhat.com> >>>> Sent: 17 November 2020 10:57 >>>> To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users >>>> list <freeipa-users(a)lists.fedorahosted.org> >>>> Subject: Re: [Freeipa-users] subsystemCert appears out of date >>>> >>>> On 11/17/20 10:19 AM, Marc Pearson | i-Neda Ltd wrote: >>>>> Hi Flo, >>>>> >>>>> Thanks for the help. Included is the output of all the commands as >>>>> you requested. These were all run from a single freeIPA server (red-auth01). >>>>> >>>>> kinit admin; ipa server-role-find --role "CA server" >>>>> Password for admin(a)INT.I-NEDA.COM: >>>>> ---------------------- >>>>> 8 server roles matched >>>>> ---------------------- >>>>> Â Server name: power-auth03.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> >>>>> Â Server name: power-auth04.int.i-neda.com Â Role name: CA >>>>> server Â Role status: absent >>>>> >>>>> Â Server name: red-auth01.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> >>>>> Â Server name: red-auth02.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> >>>>> Â Server name: red-auth03.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> >>>>> Â Server name: red-auth04.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> >>>>> Â Server name: white-auth01.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> >>>>> Â Server name: white-auth02.int.i-neda.com Â Role name: CA >>>>> server Â Role status: enabled >>>>> ---------------------------- >>>>> Number of entries returned 8 >>>>> ---------------------------- >>>>> >>>>> >>>>> Â kinit admin; ipa config-show | grep "renewal" >>>>> Password for admin(a)INT.I-NEDA.COM: >>>>> Â IPA CA renewal master: red-auth01.int.i-neda.com >>>>> >>>>> >>>>> rpm -qa | grep ipa-server >>>>> ipa-server-common-4.6.8-5.el7.centos.noarch >>>>> ipa-server-4.6.8-5.el7.centos.x86_64 >>>>> ipa-server-dns-4.6.8-5.el7.centos.noarch >>>>> >>>>> >>>>> getcert list >>>>> Number of certificates and requests being tracked: 8. >>>>> Request ID '20171101175244': >>>>> status: MONITORING >>>>> stuck: no >>>>> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >>>>> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >>>>> CA: SelfSign >>>>> issuer: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>>>> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>>>> expires: 2021-08-10 14:04:07 UTC >>>>> principal name: krbtgt/INT.I-NEDA.COM(a)INT.I-NEDA.COM >>>>> certificate template/profile: KDCs_PKINIT_Certs pre-save command: >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>>> Request ID '20180722081853': >>>>> status: MONITORING >>>>> stuck: no >>>>> key pair storage: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSign >>>>> i n g Cert cert-pki-ca',token='NSS Certificate DB',pin set >>>>> certificate: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSign >>>>> i n g Cert cert-pki-ca',token='NSS Certificate DB' >>>>> CA: dogtag-ipa-ca-renew-agent >>>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> subject: CN=CA Audit,O=INT.I-NEDA.COM >>>>> expires: 2022-09-16 12:36:41 UTC >>>>> key usage: digitalSignature,nonRepudiation pre-save command: >>>>> /usr/libexec/ipa/certmonger/stop_pkicad >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>>> "auditSigningCert cert-pki-ca" >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>>> Request ID '20180722081854': >>>>> status: MONITORING >>>>> stuck: no >>>>> key pair storage: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigni >>>>> n g C ert cert-pki-ca',token='NSS Certificate DB',pin set >>>>> certificate: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigni >>>>> n g C ert cert-pki-ca',token='NSS Certificate DB' >>>>> CA: dogtag-ipa-ca-renew-agent >>>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> subject: CN=OCSP Subsystem,O=INT.I-NEDA.COM >>>>> expires: 2022-09-16 12:35:31 UTC >>>>> eku: id-kp-OCSPSigning >>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>>> "ocspSigningCert cert-pki-ca" >>>>> track: yes >>>>> auto-renew: yes >>>>> Request ID '20180722081855': >>>>> status: CA_UNREACHABLE >>>>> ca-error: Error 58 connecting to >>>>> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >>>>> Problem with the local SSL certificate. >>>>> stuck: no >>>>> key pair storage: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystem >>>>> C e r t cert-pki-ca',token='NSS Certificate DB',pin set >>>>> certificate: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystem >>>>> C e r t cert-pki-ca',token='NSS Certificate DB' >>>>> CA: dogtag-ipa-ca-renew-agent >>>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> subject: CN=CA Subsystem,O=INT.I-NEDA.COM >>>>> expires: 2020-10-24 07:04:35 UTC >>>>> key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >>>>> /usr/libexec/ipa/certmonger/stop_pkicad >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>>> "subsystemCert cert-pki-ca" >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>>> Request ID '20180722081856': >>>>> status: MONITORING >>>>> stuck: no >>>>> key pair storage: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigning >>>>> C e r t cert-pki-ca',token='NSS Certificate DB',pin set >>>>> certificate: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigning >>>>> C e r t cert-pki-ca',token='NSS Certificate DB' >>>>> CA: dogtag-ipa-ca-renew-agent >>>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> subject: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> expires: 2040-10-10 07:51:04 UTC >>>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>>> "caSigningCert cert-pki-ca" >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>>> Request ID '20180722081857': >>>>> status: CA_UNREACHABLE >>>>> ca-error: Error 58 connecting to >>>>> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >>>>> Problem with the local SSL certificate. >>>>> stuck: no >>>>> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >>>>> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >>>>> CA: dogtag-ipa-ca-renew-agent >>>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> subject: CN=IPA RA,O=INT.I-NEDA.COM >>>>> expires: 2020-10-24 07:03:24 UTC >>>>> key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >>>>> /usr/libexec/ipa/certmonger/renew_ra_cert_pre >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>>> Request ID '20180722081858': >>>>> status: MONITORING >>>>> stuck: no >>>>> key pair storage: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Ce >>>>> r t cert-pki-ca',token='NSS Certificate DB',pin set >>>>> certificate: >>>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Ce >>>>> r t cert-pki-ca',token='NSS Certificate DB' >>>>> CA: dogtag-ipa-ca-renew-agent >>>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>>> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>>>> expires: 2021-02-09 11:59:57 UTC >>>>> key usage: >>>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection >>>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>>> "Server-Cert cert-pki-ca" >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>>> Request ID '20200530130439': >>>>> status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN >>>>> stuck: yes >>>>> key pair storage: >>>>> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >>>>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >>>>> CA: IPA >>>>> issuer: >>>>> subject: >>>>> expires: unknown >>>>> pre-save command: >>>>> post-save command: >>>>> track: yes >>>>> auto-renew: yes >>>>> >>>> Hi Marc, >>>> >>>> so the current situation is the following: >>>> - red-auth01 is the renewal master, with multiple replicas hosting the CA role. >>>> - on this server, 'subsystemCert cert-pki-ca' is expired (expires: >>>> 2020-10-24 07:04:35 UTC) as well as /var/lib/ipa/ra-agent.pem (expires: >>>> 2020-10-24 07:03:24 UTC). >>>> - there is also an issue with the tracking of the cert used by HTTP >>>> >>>> But one of your comments is puzzling me: >>>> >>>>> The signing SSL (int.i-neda.com) is a full wildcard block chain >>>>> that is authorized by a recognised 3rd party. It's worth noting >>>>> though, that we had some issues with the block chain back in April >>>>> as the thrid parties block chain expired. So it's possible that >>>>> this is as a result of that issue, and may require some fettling to resolve. All help is appreciated. >>>> Did you import the new CA chain at that time using ipa-cacert-manage install / ipa-certupdate? >>>> >>>> According to getcert output, the IPA CA is now self-signed. It looks a lot like issue https://pagure.io/freeipa/issue/8176 where the externally-signed IPA CA is renewed/replaced with a self-signed CA. >>>> >>>> As you have ipa 4.6.8-5, the ipa-cert-fix utility is available on your system. It will be easier to use this tool to fix the server: >>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_lin >>>> u >>>> x >>>> /7/html-single/linux_domain_identity_authentication_and_policy_guide >>>> / i ndex#renewing-expired-system-certificate-when-idm-is-offline >>>> >>>> Once the systems are up again, you can switch back to an externally-signed ipa CA: >>>> - import the external CA chain using ipa-cacert-manage install + run >>>> ipa-certupdate on all the ipa nodes >>>> - switch to externally-signed CA with ipa-cacert-manage renew >>>> --external-ca command >>>> (https://access.redhat.com/documentation/en-us/red_hat_enterprise_li >>>> n >>>> u >>>> x/7/html-single/linux_domain_identity_authentication_and_policy_guid >>>> e >>>> / >>>> index#manual-cert-renewal-ext) >>>> >>>> HTH, >>>> flo >>>>> >>>>> My current tempory work around is to set the local clock of the OS >>>>> back by over a month so the server belives the expired CA's are still valid. >>>>> >>>>> Kind Regards, >>>>> >>>>> Marc. >>>>> ------------------------------------------------------------------- >>>>> - >>>>> - >>>>> - >>>>> -- >>>>> *From:* Florence Blanc-Renaud <flo(a)redhat.com> >>>>> *Sent:* 16 November 2020 14:35 >>>>> *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >>>>> *Cc:* Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com> >>>>> *Subject:* Re: [Freeipa-users] subsystemCert appears out of date On >>>>> 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: >>>>>> Hi All, >>>>>> >>>>>> My subsystem cert appears to have gone out of date, and IÃ¢â,¬â"¢m >>>>>> unable to get it to update. This has become an issue on my >>>>>> production environment, and my current work around has been to >>>>>> take the system date back by a month. IÃ¢â,¬â"¢ve tried the cert >>>>>> renew tool, but this doesnÃ¢â,¬â"¢t seem to have updated this cert. >>>>>> >>>>>> Is anyone able to point me in the right direction to be able to >>>>>> update this specific certificate as IÃ¢â,¬â"¢ve been unable to find anything online. >>>>>> >>>>>> [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n >>>>>> 'subsystemCert cert-pki-ca' >>>>>> >>>>>> Certificate: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Data: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Version: 3 (0x2) >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Serial Number: 42 (0x2a) >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 >>>>>> SHA-256 With RSA Encryption >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Validity: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Not Before: Sun >>>>>> Nov >>>>>> 04 >>>>>> 08:04:35 2018 >>>>>> >>>>>> Not After : Sat Oct 24 07:04:35 2020 >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject Public Key Info: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Public Key Algorithm: >>>>>> PKCS #1 RSA Encryption >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â RSA Public Key: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Modulus: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> Ã,Â Ã,Â Ã,Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> Exponent: 65537 (0x10001) >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signed Extensions: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>>>>> Authority Key Identifier >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Key ID: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> d5:08:c0:3a >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Authority >>>>>> Information Access >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Method: PKIX >>>>>> Online Certificate Status Protocol >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Location: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>>>>> Key Usage >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Critical: True >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Usages: Digital >>>>>> Signature >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> Ã,Â Ã,Â Ã,Â Non-Repudiation >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> Ã,Â Ã,Â Ã,Â Key Encipherment >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> Ã,Â Ã,Â Ã,Â Data Encipherment >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Extended Key >>>>>> Usage >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> TLS Web Server Authentication Certificate >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> TLS Web Client Authentication Certificate >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 With RSA >>>>>> Encryption >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Signature: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA-256): >>>>>> >>>>>> >>>>>> 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1: >>>>>> 15:13:92:D3:7A:3D:F8:54:44 >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA1): >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>>> 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Mozilla-CA-Policy: false (attribute missing) >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Certificate Trust Flags: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â SSL Flags: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Email Flags: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Object Signing Flags: >>>>>> >>>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>>>> >>>>>> Thanks for the help, >>>>>> >>>>>> Marc. >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>>> To unsubscribe send an email to >>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>>> Fedora Code of Conduct: >>>>>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>>>>> List Guidelines: >>>>>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>>>>> List Archives: >>>>>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.f >>>>>> e >>>>>> d >>>>>> o >>>>>> rahosted.org >>>>>> >>>>> Hi Marc, >>>>> >>>>> we need more information in order to help you: >>>>> - do you have multiple master/replicas with the CA role: >>>>> # kinit admin; ipa server-role-find --role "CA server" >>>>> >>>>> - which server is the renewal master: >>>>> # kinit admin ; ipa config-show | grep "renewal" >>>>> >>>>> - which version is installed: >>>>> # rpm -qa | grep ipa-server >>>>> >>>>> - Is the subsystemCert cert-pki-ca the only expired certificate: >>>>> # getcert list >>>>> >>>>> flo >>>>> >>>> >>> >> >

1 0

Re: subsystemCert appears out of date
by Florence Blanc-Renaud 27 Nov '20

27 Nov '20

On 11/24/20 10:50 AM, Marc Pearson | i-Neda Ltd wrote: > Thanks Flo, > > I'm suprosed I didn't catch that typeo: > > certutil -L -d /etc/dirsrv/slapd-INT-I-NEDA-COM > > Certificate Nickname Trust Attributes > SSL,S/MIME,JAR/XPI > > CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE C,, > CN=COMODO High-Assurance Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, > CN=COMODO RSA Domain Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, > comodoCA C,, > INT.I-NEDA.COM IPA CA CT,C,C > INT.I-NEDA.COM IPA CA CT,C,C > INT.I-NEDA.COM IPA CA CT,C,C > CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, > CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB C,, > comodoCA2 C,, > INT.I-NEDA.COM IPA CA CT,C,C > INT.I-NEDA.COM IPA CA CT,C,C > comodoCA C,, > CN=*.int.i-neda.com u,u,u > INT.I-NEDA.COM IPA CA CT,C,C > Ok, so I think the issue with ipa-cert-fix comes from the fact that the LDAP server cert is not called 'Server-Cert' but rather 'CN=*.int.i-neda.com' - you can check with the following command: # grep nsSSLPersonalitySSL /etc/dirsrv/slapd-INT-I-NEDA-COM/dse.ldif Can you log an issue at https://pagure.io/freeipa/new_issue ? When the LDAP server cert doesn't have the default name, ipa-cert-fix fails. A possible workaround would be to rename the cert in the NSSDB to 'Server-Cert' with certutil --rename but you will also need to update the dse.ldif file (stop ds, edit, start ds). This will allow you to use ipa-cert-fix and hopefully to move forward. flo > Marc. > > -----Original Message----- > From: Florence Blanc-Renaud <flo(a)redhat.com> > Sent: 24 November 2020 09:01 > To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Subject: Re: [Freeipa-users] subsystemCert appears out of date > > On 11/24/20 9:54 AM, Marc Pearson | i-Neda Ltd wrote: >> Hi Flo, >> >> I'm getting a database error when running that command: >> >> # certutil -L -d /etc/dirsrc/slapd-INT-I-NEDA-COM >> certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. >> > Sorry, I made a typo, it should be dirsrv, not dirsrc: > # certutil -L -d /etc/dirsrv/slapd-INT-I-NEDA-COM > > flo >> >> Not sure if that's of any help? >> >> Marc. >> >> -----Original Message----- >> From: Florence Blanc-Renaud <flo(a)redhat.com> >> Sent: 21 November 2020 19:06 >> To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users >> list <freeipa-users(a)lists.fedorahosted.org> >> Subject: Re: [Freeipa-users] subsystemCert appears out of date >> >> On 11/18/20 12:23 PM, Marc Pearson | i-Neda Ltd wrote: >>> Hi Flo, >>> >>> Thanks for the information. I've tried to run the cert fix utility just now and I'm hitting an issue, ironically with the SSL certificate: >>> >>> [root@red-auth01 ~]# ipa-cert-fix >>> Failed to get Server-Cert >>> The ipa-cert-fix command failed. >>> >> Hi, >> I failed to notice the first time but there is no tracking for the LDAP cert that is stored in /etc/dirsrv/slapd-$DOMAIN/. What is the output of # certutil -L -d /etc/dirsrc/slapd-$DOMAIN You should see Server-Cert (=the ldap server certificate), or maybe a different nickname is used? >> >> flo >> >>> From the message log: >>> Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: >>> Forwarding request to dogtag-ipa-renew-agent Nov 18 11:18:32 >>> red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 Nov 18 11:18:33 red-auth01 certmonger: 2020-11-18 11:18:33 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. >>> Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: >>> Forwarding request to dogtag-ipa-renew-agent Nov 18 11:18:35 >>> red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 Nov 18 11:18:35 red-auth01 certmonger: 2020-11-18 11:18:35 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. >>> >>> Any advice? >>> >>> Marc. >>> >>> -----Original Message----- >>> From: Florence Blanc-Renaud <flo(a)redhat.com> >>> Sent: 17 November 2020 10:57 >>> To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users >>> list <freeipa-users(a)lists.fedorahosted.org> >>> Subject: Re: [Freeipa-users] subsystemCert appears out of date >>> >>> On 11/17/20 10:19 AM, Marc Pearson | i-Neda Ltd wrote: >>>> Hi Flo, >>>> >>>> Thanks for the help. Included is the output of all the commands as >>>> you requested. These were all run from a single freeIPA server (red-auth01). >>>> >>>> kinit admin; ipa server-role-find --role "CA server" >>>> Password for admin(a)INT.I-NEDA.COM: >>>> ---------------------- >>>> 8 server roles matched >>>> ---------------------- >>>> Â Server name: power-auth03.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> >>>> Â Server name: power-auth04.int.i-neda.com Â Role name: CA >>>> server Â Role status: absent >>>> >>>> Â Server name: red-auth01.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> >>>> Â Server name: red-auth02.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> >>>> Â Server name: red-auth03.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> >>>> Â Server name: red-auth04.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> >>>> Â Server name: white-auth01.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> >>>> Â Server name: white-auth02.int.i-neda.com Â Role name: CA >>>> server Â Role status: enabled >>>> ---------------------------- >>>> Number of entries returned 8 >>>> ---------------------------- >>>> >>>> >>>> Â kinit admin; ipa config-show | grep "renewal" >>>> Password for admin(a)INT.I-NEDA.COM: >>>> Â IPA CA renewal master: red-auth01.int.i-neda.com >>>> >>>> >>>> rpm -qa | grep ipa-server >>>> ipa-server-common-4.6.8-5.el7.centos.noarch >>>> ipa-server-4.6.8-5.el7.centos.x86_64 >>>> ipa-server-dns-4.6.8-5.el7.centos.noarch >>>> >>>> >>>> getcert list >>>> Number of certificates and requests being tracked: 8. >>>> Request ID '20171101175244': >>>> status: MONITORING >>>> stuck: no >>>> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >>>> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >>>> CA: SelfSign >>>> issuer: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>>> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>>> expires: 2021-08-10 14:04:07 UTC >>>> principal name: krbtgt/INT.I-NEDA.COM(a)INT.I-NEDA.COM >>>> certificate template/profile: KDCs_PKINIT_Certs pre-save command: >>>> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >>>> track: yes >>>> auto-renew: yes >>>> >>>> Request ID '20180722081853': >>>> status: MONITORING >>>> stuck: no >>>> key pair storage: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigni >>>> n g Cert cert-pki-ca',token='NSS Certificate DB',pin set >>>> certificate: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigni >>>> n g Cert cert-pki-ca',token='NSS Certificate DB' >>>> CA: dogtag-ipa-ca-renew-agent >>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> subject: CN=CA Audit,O=INT.I-NEDA.COM >>>> expires: 2022-09-16 12:36:41 UTC >>>> key usage: digitalSignature,nonRepudiation pre-save command: >>>> /usr/libexec/ipa/certmonger/stop_pkicad >>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>> "auditSigningCert cert-pki-ca" >>>> track: yes >>>> auto-renew: yes >>>> >>>> Request ID '20180722081854': >>>> status: MONITORING >>>> stuck: no >>>> key pair storage: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSignin >>>> g C ert cert-pki-ca',token='NSS Certificate DB',pin set >>>> certificate: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSignin >>>> g C ert cert-pki-ca',token='NSS Certificate DB' >>>> CA: dogtag-ipa-ca-renew-agent >>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> subject: CN=OCSP Subsystem,O=INT.I-NEDA.COM >>>> expires: 2022-09-16 12:35:31 UTC >>>> eku: id-kp-OCSPSigning >>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>> "ocspSigningCert cert-pki-ca" >>>> track: yes >>>> auto-renew: yes >>>> Request ID '20180722081855': >>>> status: CA_UNREACHABLE >>>> ca-error: Error 58 connecting to >>>> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >>>> Problem with the local SSL certificate. >>>> stuck: no >>>> key pair storage: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemC >>>> e r t cert-pki-ca',token='NSS Certificate DB',pin set >>>> certificate: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemC >>>> e r t cert-pki-ca',token='NSS Certificate DB' >>>> CA: dogtag-ipa-ca-renew-agent >>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> subject: CN=CA Subsystem,O=INT.I-NEDA.COM >>>> expires: 2020-10-24 07:04:35 UTC >>>> key usage: >>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >>>> /usr/libexec/ipa/certmonger/stop_pkicad >>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>> "subsystemCert cert-pki-ca" >>>> track: yes >>>> auto-renew: yes >>>> >>>> Request ID '20180722081856': >>>> status: MONITORING >>>> stuck: no >>>> key pair storage: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningC >>>> e r t cert-pki-ca',token='NSS Certificate DB',pin set >>>> certificate: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningC >>>> e r t cert-pki-ca',token='NSS Certificate DB' >>>> CA: dogtag-ipa-ca-renew-agent >>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> subject: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> expires: 2040-10-10 07:51:04 UTC >>>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>> "caSigningCert cert-pki-ca" >>>> track: yes >>>> auto-renew: yes >>>> >>>> Request ID '20180722081857': >>>> status: CA_UNREACHABLE >>>> ca-error: Error 58 connecting to >>>> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >>>> Problem with the local SSL certificate. >>>> stuck: no >>>> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >>>> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >>>> CA: dogtag-ipa-ca-renew-agent >>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> subject: CN=IPA RA,O=INT.I-NEDA.COM >>>> expires: 2020-10-24 07:03:24 UTC >>>> key usage: >>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >>>> /usr/libexec/ipa/certmonger/renew_ra_cert_pre >>>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >>>> track: yes >>>> auto-renew: yes >>>> >>>> Request ID '20180722081858': >>>> status: MONITORING >>>> stuck: no >>>> key pair storage: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cer >>>> t cert-pki-ca',token='NSS Certificate DB',pin set >>>> certificate: >>>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cer >>>> t cert-pki-ca',token='NSS Certificate DB' >>>> CA: dogtag-ipa-ca-renew-agent >>>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>>> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>>> expires: 2021-02-09 11:59:57 UTC >>>> key usage: >>>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection >>>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>>> "Server-Cert cert-pki-ca" >>>> track: yes >>>> auto-renew: yes >>>> >>>> Request ID '20200530130439': >>>> status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN >>>> stuck: yes >>>> key pair storage: >>>> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >>>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >>>> CA: IPA >>>> issuer: >>>> subject: >>>> expires: unknown >>>> pre-save command: >>>> post-save command: >>>> track: yes >>>> auto-renew: yes >>>> >>> Hi Marc, >>> >>> so the current situation is the following: >>> - red-auth01 is the renewal master, with multiple replicas hosting the CA role. >>> - on this server, 'subsystemCert cert-pki-ca' is expired (expires: >>> 2020-10-24 07:04:35 UTC) as well as /var/lib/ipa/ra-agent.pem (expires: >>> 2020-10-24 07:03:24 UTC). >>> - there is also an issue with the tracking of the cert used by HTTP >>> >>> But one of your comments is puzzling me: >>> >>>> The signing SSL (int.i-neda.com) is a full wildcard block chain that >>>> is authorized by a recognised 3rd party. It's worth noting though, >>>> that we had some issues with the block chain back in April as the >>>> thrid parties block chain expired. So it's possible that this is as >>>> a result of that issue, and may require some fettling to resolve. All help is appreciated. >>> Did you import the new CA chain at that time using ipa-cacert-manage install / ipa-certupdate? >>> >>> According to getcert output, the IPA CA is now self-signed. It looks a lot like issue https://pagure.io/freeipa/issue/8176 where the externally-signed IPA CA is renewed/replaced with a self-signed CA. >>> >>> As you have ipa 4.6.8-5, the ipa-cert-fix utility is available on your system. It will be easier to use this tool to fix the server: >>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linu >>> x >>> /7/html-single/linux_domain_identity_authentication_and_policy_guide/ >>> i ndex#renewing-expired-system-certificate-when-idm-is-offline >>> >>> Once the systems are up again, you can switch back to an externally-signed ipa CA: >>> - import the external CA chain using ipa-cacert-manage install + run >>> ipa-certupdate on all the ipa nodes >>> - switch to externally-signed CA with ipa-cacert-manage renew >>> --external-ca command >>> (https://access.redhat.com/documentation/en-us/red_hat_enterprise_lin >>> u >>> x/7/html-single/linux_domain_identity_authentication_and_policy_guide >>> / >>> index#manual-cert-renewal-ext) >>> >>> HTH, >>> flo >>>> >>>> My current tempory work around is to set the local clock of the OS >>>> back by over a month so the server belives the expired CA's are still valid. >>>> >>>> Kind Regards, >>>> >>>> Marc. >>>> -------------------------------------------------------------------- >>>> - >>>> - >>>> -- >>>> *From:* Florence Blanc-Renaud <flo(a)redhat.com> >>>> *Sent:* 16 November 2020 14:35 >>>> *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >>>> *Cc:* Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com> >>>> *Subject:* Re: [Freeipa-users] subsystemCert appears out of date On >>>> 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: >>>>> Hi All, >>>>> >>>>> My subsystem cert appears to have gone out of date, and IÃ¢â,¬â"¢m >>>>> unable to get it to update. This has become an issue on my >>>>> production environment, and my current work around has been to take >>>>> the system date back by a month. IÃ¢â,¬â"¢ve tried the cert renew >>>>> tool, but this doesnÃ¢â,¬â"¢t seem to have updated this cert. >>>>> >>>>> Is anyone able to point me in the right direction to be able to >>>>> update this specific certificate as IÃ¢â,¬â"¢ve been unable to find anything online. >>>>> >>>>> [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n >>>>> 'subsystemCert cert-pki-ca' >>>>> >>>>> Certificate: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Data: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Version: 3 (0x2) >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Serial Number: 42 (0x2a) >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 >>>>> SHA-256 With RSA Encryption >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Validity: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Not Before: Sun Nov >>>>> 04 >>>>> 08:04:35 2018 >>>>> >>>>> Not After : Sat Oct 24 07:04:35 2020 >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject Public Key Info: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Public Key Algorithm: >>>>> PKCS #1 RSA Encryption >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â RSA Public Key: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Modulus: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> Ã,Â Ã,Â Ã,Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> Exponent: 65537 (0x10001) >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signed Extensions: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>>>> Authority Key Identifier >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Key ID: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> d5:08:c0:3a >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Authority >>>>> Information Access >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Method: PKIX Online >>>>> Certificate Status Protocol >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Location: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>>>> Key Usage >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Critical: True >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Usages: Digital >>>>> Signature >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> Ã,Â Ã,Â Ã,Â Non-Repudiation >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> Ã,Â Ã,Â Ã,Â Key Encipherment >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> Ã,Â Ã,Â Ã,Â Data Encipherment >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Extended Key >>>>> Usage >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>>>> Web Server Authentication Certificate >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>>>> Web Client Authentication Certificate >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 With RSA >>>>> Encryption >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Signature: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA-256): >>>>> >>>>> >>>>> 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1: >>>>> 15:13:92:D3:7A:3D:F8:54:44 >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA1): >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>>> 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Mozilla-CA-Policy: false (attribute missing) >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Certificate Trust Flags: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â SSL Flags: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Email Flags: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Object Signing Flags: >>>>> >>>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>>> >>>>> Thanks for the help, >>>>> >>>>> Marc. >>>>> >>>>> >>>>> _______________________________________________ >>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>> To unsubscribe send an email to >>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>> Fedora Code of Conduct: >>>>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>>>> List Guidelines: >>>>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>>>> List Archives: >>>>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fe >>>>> d >>>>> o >>>>> rahosted.org >>>>> >>>> Hi Marc, >>>> >>>> we need more information in order to help you: >>>> - do you have multiple master/replicas with the CA role: >>>> # kinit admin; ipa server-role-find --role "CA server" >>>> >>>> - which server is the renewal master: >>>> # kinit admin ; ipa config-show | grep "renewal" >>>> >>>> - which version is installed: >>>> # rpm -qa | grep ipa-server >>>> >>>> - Is the subsystemCert cert-pki-ca the only expired certificate: >>>> # getcert list >>>> >>>> flo >>>> >>> >> >

2 1

Auditing FreeIPA activities
by Sreenadh Menon 26 Nov '20

26 Nov '20

Hi, As part of auditing certain activities such as "User Add" "Group Add" and other modifications, we are trying to setup a tool such as Splunk. When a user gets added or any modification is made in FreeIPA we need to Audit who made that change. But FreeIPA seems to be not logging that particular information, Would like to know if any one here have achieved that here. I noticed the following option, https://github.com/pschiffe/rsyslog-elasticsearch-kibana My understanding is this is a preconfigured Kibana setup where we need to forward all the FreeIPA related logs to this Kibana docker through rsyslog. As per the following image, https://github.com/pschiffe/rsyslog-elasticsearch-kibana/blob/master/doc/im… The user who is making the change also is getting logged. For example, we can see that the action "user_add" was committed by the user, admin@KVM. From my research this does not seem to be a Kibana Action as such, but something that is present in the FreeIPA log file. How ever I could not find the string user_add itself anywhere in the log after adding the user. I checked the logs such as, slapd-$REALM/access Is it because the FreeIPA logs have changed over the years and this solution is no longer usable, or is it something entirely generated by Kibana and we can use it with the newer FreeIPA versions as well> Sorry for the long post. Thanks in advance!

1 0

Default Trust View --> not able to resolve AD user on clients
by Pieter Baele 26 Nov '20

26 Nov '20

Hi, We only used the default trust view. Recently a colleague added another ID View. After that when adding a lot of new users from AD, with overrides in the Default Trust View we were not able to resolve the new users (id: ‘xxxxxx’: no such user) on IPA clients. No problem on the IPA servers (at first sight) After searching a lot on different parameters (pam_id_timeout etc)and clearing caches we found that the problem disappeared when adding users to a new ID View and removing them from the Default Trust View. Running latest on RHEL 7.x (VERSION: 4.6.8, API_VERSION: 2.237) Any similar reports? Sincerely Pieter

1 0

FreeIPA - Windows 10 Dynamic Dns Updates
by Ben Lewis 26 Nov '20

26 Nov '20

Hi All, I have installed a freeipa server an configured a Windows 10 client to authenticate against it. I am able to login to the Windows machine against the IPA realm, the issue I am seeing relates to the Windows client updating its DNS records. I could see ZONENAME/IN denied errors in /var/log/messages, what i also noticed in /var/log/krb5kdc.log at around the same time that the dns update errors occur I see a kerberos error. It seems that the Windows host is attempting to obtain a ticket using the format COMPUTERNAME$(a)EXAMPLE.COM instead of the FQDN. I am using Free IPA Server 4.8.4-7 on a Centos 8.2 server. I have a host and principal in freeipa for the Windows host.

2 1

replica install DNS failure on master CNAME
by Stijn De Weirdt 26 Nov '20

26 Nov '20

hello, we are trying to migrate our ipa setup to el8, and are adding a el8 host as a replica. however, this master is somewhat special as it involves classless delegation. it is part of a /27 subnet, so we added it as a ptr record to 0/27.the.24.prefix, and put a cname on the ip in the.24.prefix (not sure i'm using the correct terminology here, but it's done as described in https://www.freeipa.org/page/Howto/DNS_classless_IN-ADDR.ARPA_delegation) the master is a functional ipa client before the replica-install is started. running the ipa-replica-install --setup-dns, we get an error: the installer seems to try to always add the master ip as a ptr record, and treats duplicates and something called a EmptyModlist as ok. however, in our case, there's a cname in place, and our install fails with a > 2020-11-26T07:52:36Z DEBUG The ipa-replica-install command failed, exception: ValidationError: invalid 'cnamerecord': CNAME record is not allowed to coexist with any ot\ > her record (RFC 1034, section 3.6.2) my question is the following: is there any hard requirement for a fully functional master to have a ptr record instead of a cname (and/or is it allowed to use the classless setup for a master). if not, is it ok to comment out the part of the install code that tries to add this record, and retry the install? there is a similar/identical issue reported 2 years ago https://pagure.io/freeipa/issue/7693 (and the bugzilla referenced there), but there is a comment "from IPA team" that says "I don't know if using this also for IPA server is a good or desired thing."; so some feedback/guidance is welcome. many thanks, stijn error log > 2020-11-26T07:52:36Z DEBUG step duration: named __generate_rndc_key 0.03 sec > 2020-11-26T07:52:36Z DEBUG [2/8]: setting up our own record > 2020-11-26T07:52:36Z DEBUG raw: dnszone_show('our.domain', version='2.235') > 2020-11-26T07:52:36Z DEBUG dnszone_show(<DNS name our.domain.>, rights=False, all=False, raw=False, version='2.235') > 2020-11-26T07:52:36Z DEBUG raw: dnsrecord_add('our.domain', 'hostname', arecord='1.2.3.4', version='2.235') > 2020-11-26T07:52:36Z DEBUG dnsrecord_add(<DNS name our.domain.>, <DNS name hostname>, arecord=('1.2.3.4',), a_extra_create_reverse=False, aaaa_extra_create_reverse=False, force=False, structured=False, all=False, raw=False, version='2.235') > 2020-11-26T07:52:36Z DEBUG raw: dnszone_show('4.3.2.1.in-addr.arpa.', version='2.235') > 2020-11-26T07:52:36Z DEBUG dnszone_show(<DNS name 4.3.2.1.in-addr.arpa.>, rights=False, all=False, raw=False, version='2.235') > 2020-11-26T07:52:36Z DEBUG raw: dnszone_show('3.2.1.in-addr.arpa.', version='2.235') > 2020-11-26T07:52:36Z DEBUG dnszone_show(<DNS name 3.2.1.in-addr.arpa.>, rights=False, all=False, raw=False, version='2.235') > 2020-11-26T07:52:36Z DEBUG raw: dnsrecord_add('3.2.1.in-addr.arpa.', '5', ptrrecord='hostname.our.domain.', version='2.235') > 2020-11-26T07:52:36Z DEBUG dnsrecord_add(<DNS name 3.2.1.in-addr.arpa.>, <DNS name 5>, a_extra_create_reverse=False, aaaa_extra_create_reverse=False, ptrrecord=('hostname.our.domain.',), force=False, structured=False, all=False, raw=False, version='2.235') > 2020-11-26T07:52:36Z DEBUG Traceback (most recent call last): > File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 603, in start_creation > run_step(full_msg, method) > File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 589, in run_step > method() > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 921, in __add_self > self.__add_master_records(self.fqdn, self.ip_addresses) > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 918, in __add_master_records > add_ptr_rr(reverse_zone, addr, fqdn, None, api=self.api) > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 414, in add_ptr_rr > add_rr(zone, name, "PTR", normalize_zone(fqdn), dns_backup, api) > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 397, in add_rr > api.Command.dnsrecord_add(unicode(zone), unicode(name), **addkw) > File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 450, in __call__ > return self.__do_call(*args, **options) > File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 478, in __do_call > ret = self.run(*args, **options) > File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 800, in run > return self.execute(*args, **options) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 3655, in execute > result = super(dnsrecord_add, self).execute(*keys, **options) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/baseldap.py", line 1199, in execute > *keys, **options) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 3647, in pre_callback > self.obj.check_record_type_collisions(keys, rrattrs) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 3261, in check_record_type_collisions > error=_('CNAME record is not allowed to coexist ' > ipalib.errors.ValidationError: invalid 'cnamerecord': CNAME record is not allowed to coexist with any other record (RFC 1034, section 3.6.2) > > 2020-11-26T07:52:36Z DEBUG [error] ValidationError: invalid 'cnamerecord': CNAME record is not allowed to coexist with any other record (RFC 1034, section 3.6.2) > 2020-11-26T07:52:36Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 179, in execute > return_value = self.run() > File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 340, in run > return cfgr.run() > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run > return self.execute() > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute > for rval in self._executor(): > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner > exc_handler(exc_info) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception > self._handle_exception(exc_info) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception > six.reraise(*exc_info) > File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner > step() > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> > step = lambda: next(self.__gen) > File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from > six.reraise(*exc_info) > File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from > value = gen.send(prev_value) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure > next(executor) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner > exc_handler(exc_info) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception > self._handle_exception(exc_info) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception > self.__parent._handle_exception(exc_info) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception > six.reraise(*exc_info) > File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception > super(ComponentBase, self)._handle_exception(exc_info) > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception > six.reraise(*exc_info) > File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner > step() > File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda> > step = lambda: next(self.__gen) > File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from > six.reraise(*exc_info) > File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from > value = gen.send(prev_value) > File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install > for unused in self._installer(self.parent): > File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 597, in main > replica_install(self) > File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 402, in decorated > func(installer) > File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1339, in install > dns.install(False, True, options, api) > File "/usr/lib/python3.6/site-packages/ipaserver/install/dns.py", line 342, in install > bind.create_instance() > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 774, in create_instance > self.start_creation() > File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 603, in start_creation > run_step(full_msg, method) > File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 589, in run_step > method() > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 921, in __add_self > self.__add_master_records(self.fqdn, self.ip_addresses) > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 918, in __add_master_records > add_ptr_rr(reverse_zone, addr, fqdn, None, api=self.api) > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 414, in add_ptr_rr > add_rr(zone, name, "PTR", normalize_zone(fqdn), dns_backup, api) > File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 397, in add_rr > api.Command.dnsrecord_add(unicode(zone), unicode(name), **addkw) > File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 450, in __call__ > return self.__do_call(*args, **options) > File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 478, in __do_call > ret = self.run(*args, **options) > File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 800, in run > return self.execute(*args, **options) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 3655, in execute > result = super(dnsrecord_add, self).execute(*keys, **options) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/baseldap.py", line 1199, in execute > *keys, **options) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 3647, in pre_callback > self.obj.check_record_type_collisions(keys, rrattrs) > File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 3261, in check_record_type_collisions > error=_('CNAME record is not allowed to coexist ' > > 2020-11-26T07:52:36Z DEBUG The ipa-replica-install command failed, exception: ValidationError: invalid 'cnamerecord': CNAME record is not allowed to coexist with any other record (RFC 1034, section 3.6.2) > 2020-11-26T07:52:36Z ERROR invalid 'cnamerecord': CNAME record is not allowed to coexist with any other record (RFC 1034, section 3.6.2) > 2020-11-26T07:52:36Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

1 0

Replication Error
by Ronald Wimmer 25 Nov '20

25 Nov '20

By coincidence I found something in /var/log/messages that does not look too good: Oct 2 09:41:30 pipa02.linux.mydomain.at ns-slapd[1905]: [02/Oct/2020:09:41:30.887447735 +0200] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=pipa02.linux.oebb.at-to-pipa06.linux.mydomain.at" (pipa06:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. The error seems to persist. What has do be done? Do i have to uninstall ipa replica and do an ipa-replica-install agein? Cheers, Ronald

2 6

recover - Entry "cn=schema" single-valued attribute "nsSchemaCSN" has multiple values - how?
by lejeczek 25 Nov '20

25 Nov '20

Hi guys. One of IPA masters somehow got itself into trouble: [25/Nov/2020:10:42:51.918481532 +0000] - ERR - slapi_entry_schema_check_ext - Entry "cn=schema" single-valued attribute "nsSchemaCSN" has multiple values [25/Nov/2020:10:42:51.924870263 +0000] - ERR - setup_internal_backends - Please edit the file to correct the reported problems and then restart the server. It would be nice to know how such a case can occur but most important question is - how to fix it? Any suggestions I'll greatly appreciate. many thanks, L.

1 0

how to create system user account, hide ipa data from users, have a default group list
by Jelle de Jong 25 Nov '20

25 Nov '20

Hello everybody, 1. How can I make a system user like the admin account only without admin rights, but still available with id and getent tools. I need machine account for a holds a kerberos ticket. A normal user shows up everywhere through LDAP, the admin user does not but is still available in sssd and other integrations. 2. How can I hide the Telephone Number, Address data etc from the public active user list, so not all users can access this data? Is is possible to hide all the active users from each other? 3. How can I configure multiple default groups for new created users, so a list like ipausers, groupone, grouptwo? 4. Thank you! Kind regards, Jelle de Jong

1 0

Unable to remove incomplete replication entry - topology plugin?
by Robert.Mattson＠L3Harris.com 25 Nov '20

25 Nov '20

Dear FreeIPA Community, We're having a problem joining a host to an IPA realm. We created a host account in the realm and added that host to the IPA replicas group. We installed the ipa-client and ipa-server RPMS on the incoming replica (host2). Using ipa-client-install then used ipa-replica-install to upgrade it to a replica, the data replication phase inside the replica-install process failed because the time on the replica was many hours in advance of the existing master/replica in the realm. In other failed installs where this occurs (typically VM development environments where snapshotting is frequent), we've had success forcing removal of the failed replica using ipa host-del <hostname> --force, or of necessary a 'ipa-replica-manage clean-dangling-ruv' or 'ipa-replica-manage clean-ruv <n>' to help remove left-over data. Should that fail, manually removing the LDAP entry corresponding to the incoming host is necessary, the stale entry is; cn=meTohost2.system,cn=replica,cn=dc\3Dsystem,cn=mapping tree,cn=config When we attempt to delete that entry in the LDAP tree, 389-ds rejects the operation and logs the message; "RESULT err=53 tag=107 nentries=0 etime=0.0002043881 - Entry is managed by topology plugin.Deletion not allowed". How can we remove data from the replica to attempt to re-join the failed host? Both the incoming replica and existing realm master/replica are running CentOS 7.6; ipa-client-4.6.4-10.el7.centos.3.x86_64 ipa-client-common-4.6.4-10.el7.centos.3.noarch ipa-common-4.6.4-10.el7.centos.3.noarch ipa-server-4.6.4-10.el7.centos.3.x86_64 ipa-server-common-4.6.4-10.el7.centos.3.noarch Thanks in advance, Rob CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.

2 1

Re: subsystemCert appears out of date
by Florence Blanc-Renaud 24 Nov '20

24 Nov '20

On 11/24/20 9:54 AM, Marc Pearson | i-Neda Ltd wrote: > Hi Flo, > > I'm getting a database error when running that command: > > # certutil -L -d /etc/dirsrc/slapd-INT-I-NEDA-COM > certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. > Sorry, I made a typo, it should be dirsrv, not dirsrc: # certutil -L -d /etc/dirsrv/slapd-INT-I-NEDA-COM flo > > Not sure if that's of any help? > > Marc. > > -----Original Message----- > From: Florence Blanc-Renaud <flo(a)redhat.com> > Sent: 21 November 2020 19:06 > To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Subject: Re: [Freeipa-users] subsystemCert appears out of date > > On 11/18/20 12:23 PM, Marc Pearson | i-Neda Ltd wrote: >> Hi Flo, >> >> Thanks for the information. I've tried to run the cert fix utility just now and I'm hitting an issue, ironically with the SSL certificate: >> >> [root@red-auth01 ~]# ipa-cert-fix >> Failed to get Server-Cert >> The ipa-cert-fix command failed. >> > Hi, > I failed to notice the first time but there is no tracking for the LDAP cert that is stored in /etc/dirsrv/slapd-$DOMAIN/. What is the output of # certutil -L -d /etc/dirsrc/slapd-$DOMAIN You should see Server-Cert (=the ldap server certificate), or maybe a different nickname is used? > > flo > >> From the message log: >> Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: >> Forwarding request to dogtag-ipa-renew-agent Nov 18 11:18:32 >> red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 Nov 18 11:18:33 red-auth01 certmonger: 2020-11-18 11:18:33 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. >> Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: >> Forwarding request to dogtag-ipa-renew-agent Nov 18 11:18:35 >> red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 Nov 18 11:18:35 red-auth01 certmonger: 2020-11-18 11:18:35 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. >> >> Any advice? >> >> Marc. >> >> -----Original Message----- >> From: Florence Blanc-Renaud <flo(a)redhat.com> >> Sent: 17 November 2020 10:57 >> To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users >> list <freeipa-users(a)lists.fedorahosted.org> >> Subject: Re: [Freeipa-users] subsystemCert appears out of date >> >> On 11/17/20 10:19 AM, Marc Pearson | i-Neda Ltd wrote: >>> Hi Flo, >>> >>> Thanks for the help. Included is the output of all the commands as >>> you requested. These were all run from a single freeIPA server (red-auth01). >>> >>> kinit admin; ipa server-role-find --role "CA server" >>> Password for admin(a)INT.I-NEDA.COM: >>> ---------------------- >>> 8 server roles matched >>> ---------------------- >>> Â Server name: power-auth03.int.i-neda.com Â Role name: CA >>> server Â Role status: enabled >>> >>> Â Server name: power-auth04.int.i-neda.com Â Role name: CA >>> server Â Role status: absent >>> >>> Â Server name: red-auth01.int.i-neda.com Â Role name: CA server >>> Â Role status: enabled >>> >>> Â Server name: red-auth02.int.i-neda.com Â Role name: CA server >>> Â Role status: enabled >>> >>> Â Server name: red-auth03.int.i-neda.com Â Role name: CA server >>> Â Role status: enabled >>> >>> Â Server name: red-auth04.int.i-neda.com Â Role name: CA server >>> Â Role status: enabled >>> >>> Â Server name: white-auth01.int.i-neda.com Â Role name: CA >>> server Â Role status: enabled >>> >>> Â Server name: white-auth02.int.i-neda.com Â Role name: CA >>> server Â Role status: enabled >>> ---------------------------- >>> Number of entries returned 8 >>> ---------------------------- >>> >>> >>> Â kinit admin; ipa config-show | grep "renewal" >>> Password for admin(a)INT.I-NEDA.COM: >>> Â IPA CA renewal master: red-auth01.int.i-neda.com >>> >>> >>> rpm -qa | grep ipa-server >>> ipa-server-common-4.6.8-5.el7.centos.noarch >>> ipa-server-4.6.8-5.el7.centos.x86_64 >>> ipa-server-dns-4.6.8-5.el7.centos.noarch >>> >>> >>> getcert list >>> Number of certificates and requests being tracked: 8. >>> Request ID '20171101175244': >>> status: MONITORING >>> stuck: no >>> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >>> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >>> CA: SelfSign >>> issuer: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>> expires: 2021-08-10 14:04:07 UTC >>> principal name: krbtgt/INT.I-NEDA.COM(a)INT.I-NEDA.COM >>> certificate template/profile: KDCs_PKINIT_Certs pre-save command: >>> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >>> track: yes >>> auto-renew: yes >>> >>> Request ID '20180722081853': >>> status: MONITORING >>> stuck: no >>> key pair storage: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSignin >>> g Cert cert-pki-ca',token='NSS Certificate DB',pin set >>> certificate: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSignin >>> g Cert cert-pki-ca',token='NSS Certificate DB' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>> subject: CN=CA Audit,O=INT.I-NEDA.COM >>> expires: 2022-09-16 12:36:41 UTC >>> key usage: digitalSignature,nonRepudiation pre-save command: >>> /usr/libexec/ipa/certmonger/stop_pkicad >>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>> "auditSigningCert cert-pki-ca" >>> track: yes >>> auto-renew: yes >>> >>> Request ID '20180722081854': >>> status: MONITORING >>> stuck: no >>> key pair storage: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigning >>> C ert cert-pki-ca',token='NSS Certificate DB',pin set >>> certificate: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigning >>> C ert cert-pki-ca',token='NSS Certificate DB' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>> subject: CN=OCSP Subsystem,O=INT.I-NEDA.COM >>> expires: 2022-09-16 12:35:31 UTC >>> eku: id-kp-OCSPSigning >>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>> "ocspSigningCert cert-pki-ca" >>> track: yes >>> auto-renew: yes >>> Request ID '20180722081855': >>> status: CA_UNREACHABLE >>> ca-error: Error 58 connecting to >>> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >>> Problem with the local SSL certificate. >>> stuck: no >>> key pair storage: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCe >>> r t cert-pki-ca',token='NSS Certificate DB',pin set >>> certificate: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCe >>> r t cert-pki-ca',token='NSS Certificate DB' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>> subject: CN=CA Subsystem,O=INT.I-NEDA.COM >>> expires: 2020-10-24 07:04:35 UTC >>> key usage: >>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >>> /usr/libexec/ipa/certmonger/stop_pkicad >>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>> "subsystemCert cert-pki-ca" >>> track: yes >>> auto-renew: yes >>> >>> Request ID '20180722081856': >>> status: MONITORING >>> stuck: no >>> key pair storage: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCe >>> r t cert-pki-ca',token='NSS Certificate DB',pin set >>> certificate: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCe >>> r t cert-pki-ca',token='NSS Certificate DB' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>> subject: CN=Certificate Authority,O=INT.I-NEDA.COM >>> expires: 2040-10-10 07:51:04 UTC >>> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>> "caSigningCert cert-pki-ca" >>> track: yes >>> auto-renew: yes >>> >>> Request ID '20180722081857': >>> status: CA_UNREACHABLE >>> ca-error: Error 58 connecting to >>> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >>> Problem with the local SSL certificate. >>> stuck: no >>> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >>> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>> subject: CN=IPA RA,O=INT.I-NEDA.COM >>> expires: 2020-10-24 07:03:24 UTC >>> key usage: >>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >>> /usr/libexec/ipa/certmonger/renew_ra_cert_pre >>> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >>> track: yes >>> auto-renew: yes >>> >>> Request ID '20180722081858': >>> status: MONITORING >>> stuck: no >>> key pair storage: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >>> cert-pki-ca',token='NSS Certificate DB',pin set >>> certificate: >>> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >>> cert-pki-ca',token='NSS Certificate DB' >>> CA: dogtag-ipa-ca-renew-agent >>> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >>> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >>> expires: 2021-02-09 11:59:57 UTC >>> key usage: >>> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >>> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection >>> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >>> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >>> "Server-Cert cert-pki-ca" >>> track: yes >>> auto-renew: yes >>> >>> Request ID '20200530130439': >>> status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN >>> stuck: yes >>> key pair storage: >>> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >>> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >>> CA: IPA >>> issuer: >>> subject: >>> expires: unknown >>> pre-save command: >>> post-save command: >>> track: yes >>> auto-renew: yes >>> >> Hi Marc, >> >> so the current situation is the following: >> - red-auth01 is the renewal master, with multiple replicas hosting the CA role. >> - on this server, 'subsystemCert cert-pki-ca' is expired (expires: >> 2020-10-24 07:04:35 UTC) as well as /var/lib/ipa/ra-agent.pem (expires: >> 2020-10-24 07:03:24 UTC). >> - there is also an issue with the tracking of the cert used by HTTP >> >> But one of your comments is puzzling me: >> >>> The signing SSL (int.i-neda.com) is a full wildcard block chain that >>> is authorized by a recognised 3rd party. It's worth noting though, >>> that we had some issues with the block chain back in April as the >>> thrid parties block chain expired. So it's possible that this is as a >>> result of that issue, and may require some fettling to resolve. All help is appreciated. >> Did you import the new CA chain at that time using ipa-cacert-manage install / ipa-certupdate? >> >> According to getcert output, the IPA CA is now self-signed. It looks a lot like issue https://pagure.io/freeipa/issue/8176 where the externally-signed IPA CA is renewed/replaced with a self-signed CA. >> >> As you have ipa 4.6.8-5, the ipa-cert-fix utility is available on your system. It will be easier to use this tool to fix the server: >> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux >> /7/html-single/linux_domain_identity_authentication_and_policy_guide/i >> ndex#renewing-expired-system-certificate-when-idm-is-offline >> >> Once the systems are up again, you can switch back to an externally-signed ipa CA: >> - import the external CA chain using ipa-cacert-manage install + run >> ipa-certupdate on all the ipa nodes >> - switch to externally-signed CA with ipa-cacert-manage renew >> --external-ca command >> (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linu >> x/7/html-single/linux_domain_identity_authentication_and_policy_guide/ >> index#manual-cert-renewal-ext) >> >> HTH, >> flo >>> >>> My current tempory work around is to set the local clock of the OS >>> back by over a month so the server belives the expired CA's are still valid. >>> >>> Kind Regards, >>> >>> Marc. >>> --------------------------------------------------------------------- >>> - >>> -- >>> *From:* Florence Blanc-Renaud <flo(a)redhat.com> >>> *Sent:* 16 November 2020 14:35 >>> *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >>> *Cc:* Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com> >>> *Subject:* Re: [Freeipa-users] subsystemCert appears out of date On >>> 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: >>>> Hi All, >>>> >>>> My subsystem cert appears to have gone out of date, and IÃ¢â,¬â"¢m >>>> unable to get it to update. This has become an issue on my >>>> production environment, and my current work around has been to take >>>> the system date back by a month. IÃ¢â,¬â"¢ve tried the cert renew >>>> tool, but this doesnÃ¢â,¬â"¢t seem to have updated this cert. >>>> >>>> Is anyone able to point me in the right direction to be able to >>>> update this specific certificate as IÃ¢â,¬â"¢ve been unable to find anything online. >>>> >>>> [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n >>>> 'subsystemCert cert-pki-ca' >>>> >>>> Certificate: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Data: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Version: 3 (0x2) >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Serial Number: 42 (0x2a) >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 >>>> With RSA Encryption >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Validity: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Not Before: Sun Nov >>>> 04 >>>> 08:04:35 2018 >>>> >>>> Not After : Sat Oct 24 07:04:35 2020 >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject Public Key Info: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Public Key Algorithm: >>>> PKCS #1 RSA Encryption >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â RSA Public Key: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Modulus: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> Ã,Â Ã,Â Ã,Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> Exponent: 65537 (0x10001) >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signed Extensions: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>>> Authority Key Identifier >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Key ID: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> d5:08:c0:3a >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Authority >>>> Information Access >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Method: PKIX Online >>>> Certificate Status Protocol >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Location: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>>> Key Usage >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Critical: True >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Usages: Digital >>>> Signature >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> Ã,Â Ã,Â Ã,Â Non-Repudiation >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> Ã,Â Ã,Â Ã,Â Key Encipherment >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> Ã,Â Ã,Â Ã,Â Data Encipherment >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Extended Key >>>> Usage >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>>> Web Server Authentication Certificate >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>>> Web Client Authentication Certificate >>>> >>>> Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 With RSA >>>> Encryption >>>> >>>> Â Ã,Â Ã,Â Ã,Â Signature: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 >>>> >>>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA-256): >>>> >>>> >>>> 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1: >>>> 15:13:92:D3:7A:3D:F8:54:44 >>>> >>>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA1): >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>>> 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 >>>> >>>> Â Ã,Â Ã,Â Ã,Â Mozilla-CA-Policy: false (attribute missing) >>>> >>>> Â Ã,Â Ã,Â Ã,Â Certificate Trust Flags: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â SSL Flags: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Email Flags: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Object Signing Flags: >>>> >>>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>>> >>>> Thanks for the help, >>>> >>>> Marc. >>>> >>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to >>>> freeipa-users-leave(a)lists.fedorahosted.org >>>> Fedora Code of Conduct: >>>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>>> List Guidelines: >>>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>>> List Archives: >>>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fed >>>> o >>>> rahosted.org >>>> >>> Hi Marc, >>> >>> we need more information in order to help you: >>> - do you have multiple master/replicas with the CA role: >>> # kinit admin; ipa server-role-find --role "CA server" >>> >>> - which server is the renewal master: >>> # kinit admin ; ipa config-show | grep "renewal" >>> >>> - which version is installed: >>> # rpm -qa | grep ipa-server >>> >>> - Is the subsystemCert cert-pki-ca the only expired certificate: >>> # getcert list >>> >>> flo >>> >> >

2 1

List of supported client operating systems
by Ronald Wimmer 24 Nov '20

24 Nov '20

Is there a list of officially supported client operating systems and versions? Or is it just a matter of having a recent version of sssd (>= 1.9)? Cheers, Ronald

1 0

Re: subsystemCert appears out of date
by Rob Crittenden 24 Nov '20

24 Nov '20

Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: > Hi Flo, > > Thanks for the information. I've tried to run the cert fix utility just now and I'm hitting an issue, ironically with the SSL certificate: > > [root@red-auth01 ~]# ipa-cert-fix > Failed to get Server-Cert > The ipa-cert-fix command failed. > > From the message log: > Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: Forwarding request to dogtag-ipa-renew-agent > Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 > Nov 18 11:18:33 red-auth01 certmonger: 2020-11-18 11:18:33 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. > Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: Forwarding request to dogtag-ipa-renew-agent > Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 > Nov 18 11:18:35 red-auth01 certmonger: 2020-11-18 11:18:35 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. Does /var/lib/ipa/ra-agent.[pem|key] exist? They should be mode 0440 owned by root:ipaapi. rob > > Any advice? > > Marc. > > -----Original Message----- > From: Florence Blanc-Renaud <flo(a)redhat.com> > Sent: 17 November 2020 10:57 > To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Subject: Re: [Freeipa-users] subsystemCert appears out of date > > On 11/17/20 10:19 AM, Marc Pearson | i-Neda Ltd wrote: >> Hi Flo, >> >> Thanks for the help. Included is the output of all the commands as you >> requested. These were all run from a single freeIPA server (red-auth01). >> >> kinit admin; ipa server-role-find --role "CA server" >> Password for admin(a)INT.I-NEDA.COM: >> ---------------------- >> 8 server roles matched >> ---------------------- >> Â Server name: power-auth03.int.i-neda.com Â Role name: CA server >> Â Role status: enabled >> >> Â Server name: power-auth04.int.i-neda.com Â Role name: CA server >> Â Role status: absent >> >> Â Server name: red-auth01.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: red-auth02.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: red-auth03.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: red-auth04.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: white-auth01.int.i-neda.com Â Role name: CA server >> Â Role status: enabled >> >> Â Server name: white-auth02.int.i-neda.com Â Role name: CA server >> Â Role status: enabled >> ---------------------------- >> Number of entries returned 8 >> ---------------------------- >> >> >> Â kinit admin; ipa config-show | grep "renewal" >> Password for admin(a)INT.I-NEDA.COM: >> Â IPA CA renewal master: red-auth01.int.i-neda.com >> >> >> rpm -qa | grep ipa-server >> ipa-server-common-4.6.8-5.el7.centos.noarch >> ipa-server-4.6.8-5.el7.centos.x86_64 >> ipa-server-dns-4.6.8-5.el7.centos.noarch >> >> >> getcert list >> Number of certificates and requests being tracked: 8. >> Request ID '20171101175244': >> status: MONITORING >> stuck: no >> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >> CA: SelfSign >> issuer: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >> expires: 2021-08-10 14:04:07 UTC >> principal name: krbtgt/INT.I-NEDA.COM(a)INT.I-NEDA.COM >> certificate template/profile: KDCs_PKINIT_Certs pre-save command: >> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >> track: yes >> auto-renew: yes >> >> Request ID '20180722081853': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigning >> Cert cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigning >> Cert cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=CA Audit,O=INT.I-NEDA.COM >> expires: 2022-09-16 12:36:41 UTC >> key usage: digitalSignature,nonRepudiation pre-save command: >> /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "auditSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20180722081854': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningC >> ert cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningC >> ert cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=OCSP Subsystem,O=INT.I-NEDA.COM >> expires: 2022-09-16 12:35:31 UTC >> eku: id-kp-OCSPSigning >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "ocspSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20180722081855': >> status: CA_UNREACHABLE >> ca-error: Error 58 connecting to >> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >> Problem with the local SSL certificate. >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCer >> t cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCer >> t cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=CA Subsystem,O=INT.I-NEDA.COM >> expires: 2020-10-24 07:04:35 UTC >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >> /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "subsystemCert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20180722081856': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCer >> t cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCer >> t cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=Certificate Authority,O=INT.I-NEDA.COM >> expires: 2040-10-10 07:51:04 UTC >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20180722081857': >> status: CA_UNREACHABLE >> ca-error: Error 58 connecting to >> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >> Problem with the local SSL certificate. >> stuck: no >> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=IPA RA,O=INT.I-NEDA.COM >> expires: 2020-10-24 07:03:24 UTC >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >> /usr/libexec/ipa/certmonger/renew_ra_cert_pre >> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >> track: yes >> auto-renew: yes >> >> Request ID '20180722081858': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >> cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >> cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >> expires: 2021-02-09 11:59:57 UTC >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "Server-Cert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20200530130439': >> status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN >> stuck: yes >> key pair storage: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >> CA: IPA >> issuer: >> subject: >> expires: unknown >> pre-save command: >> post-save command: >> track: yes >> auto-renew: yes >> > Hi Marc, > > so the current situation is the following: > - red-auth01 is the renewal master, with multiple replicas hosting the CA role. > - on this server, 'subsystemCert cert-pki-ca' is expired (expires: > 2020-10-24 07:04:35 UTC) as well as /var/lib/ipa/ra-agent.pem (expires: > 2020-10-24 07:03:24 UTC). > - there is also an issue with the tracking of the cert used by HTTP > > But one of your comments is puzzling me: > >> The signing SSL (int.i-neda.com) is a full wildcard block chain that >> is authorized by a recognised 3rd party. It's worth noting though, >> that we had some issues with the block chain back in April as the >> thrid parties block chain expired. So it's possible that this is as a >> result of that issue, and may require some fettling to resolve. All help is appreciated. > Did you import the new CA chain at that time using ipa-cacert-manage install / ipa-certupdate? > > According to getcert output, the IPA CA is now self-signed. It looks a lot like issue https://pagure.io/freeipa/issue/8176 where the externally-signed IPA CA is renewed/replaced with a self-signed CA. > > As you have ipa 4.6.8-5, the ipa-cert-fix utility is available on your system. It will be easier to use this tool to fix the server: > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… > > Once the systems are up again, you can switch back to an externally-signed ipa CA: > - import the external CA chain using ipa-cacert-manage install + run ipa-certupdate on all the ipa nodes > - switch to externally-signed CA with ipa-cacert-manage renew --external-ca command > (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…) > > HTH, > flo >> >> My current tempory work around is to set the local clock of the OS >> back by over a month so the server belives the expired CA's are still valid. >> >> Kind Regards, >> >> Marc. >> ---------------------------------------------------------------------- >> -- >> *From:* Florence Blanc-Renaud <flo(a)redhat.com> >> *Sent:* 16 November 2020 14:35 >> *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >> *Cc:* Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com> >> *Subject:* Re: [Freeipa-users] subsystemCert appears out of date On >> 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: >>> Hi All, >>> >>> My subsystem cert appears to have gone out of date, and IÃ¢â,¬â"¢m >>> unable to get it to update. This has become an issue on my production >>> environment, and my current work around has been to take the system >>> date back by a month. IÃ¢â,¬â"¢ve tried the cert renew tool, but this >>> doesnÃ¢â,¬â"¢t seem to have updated this cert. >>> >>> Is anyone able to point me in the right direction to be able to >>> update this specific certificate as IÃ¢â,¬â"¢ve been unable to find anything online. >>> >>> [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n >>> 'subsystemCert cert-pki-ca' >>> >>> Certificate: >>> >>> Â Ã,Â Ã,Â Ã,Â Data: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Version: 3 (0x2) >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Serial Number: 42 (0x2a) >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 >>> With RSA Encryption >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Validity: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Not Before: Sun Nov 04 >>> 08:04:35 2018 >>> >>> Not After : Sat Oct 24 07:04:35 2020 >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject Public Key Info: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Public Key Algorithm: >>> PKCS #1 RSA Encryption >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â RSA Public Key: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Modulus: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Exponent: 65537 (0x10001) >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signed Extensions: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>> Authority Key Identifier >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Key ID: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> d5:08:c0:3a >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Authority >>> Information Access >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Method: PKIX Online >>> Certificate Status Protocol >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Location: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate Key >>> Usage >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Critical: True >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Usages: Digital >>> Signature >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â Non-Repudiation >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â Key Encipherment >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â Data Encipherment >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Extended Key >>> Usage >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>> Web Server Authentication Certificate >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>> Web Client Authentication Certificate >>> >>> Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 With RSA >>> Encryption >>> >>> Â Ã,Â Ã,Â Ã,Â Signature: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 >>> >>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA-256): >>> >>> >>> 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1: >>> 15:13:92:D3:7A:3D:F8:54:44 >>> >>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA1): >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 >>> >>> Â Ã,Â Ã,Â Ã,Â Mozilla-CA-Policy: false (attribute missing) >>> >>> Â Ã,Â Ã,Â Ã,Â Certificate Trust Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â SSL Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Email Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Object Signing Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>> >>> Thanks for the help, >>> >>> Marc. >>> >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to >>> freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: >>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedo >>> rahosted.org >>> >> Hi Marc, >> >> we need more information in order to help you: >> - do you have multiple master/replicas with the CA role: >> # kinit admin; ipa server-role-find --role "CA server" >> >> - which server is the renewal master: >> # kinit admin ; ipa config-show | grep "renewal" >> >> - which version is installed: >> # rpm -qa | grep ipa-server >> >> - Is the subsystemCert cert-pki-ca the only expired certificate: >> # getcert list >> >> flo >> > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >

2 1

Re: subsystemCert appears out of date
by Florence Blanc-Renaud 24 Nov '20

24 Nov '20

On 11/18/20 12:23 PM, Marc Pearson | i-Neda Ltd wrote: > Hi Flo, > > Thanks for the information. I've tried to run the cert fix utility just now and I'm hitting an issue, ironically with the SSL certificate: > > [root@red-auth01 ~]# ipa-cert-fix > Failed to get Server-Cert > The ipa-cert-fix command failed. > Hi, I failed to notice the first time but there is no tracking for the LDAP cert that is stored in /etc/dirsrv/slapd-$DOMAIN/. What is the output of # certutil -L -d /etc/dirsrc/slapd-$DOMAIN You should see Server-Cert (=the ldap server certificate), or maybe a different nickname is used? flo > From the message log: > Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: Forwarding request to dogtag-ipa-renew-agent > Nov 18 11:18:32 red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 > Nov 18 11:18:33 red-auth01 certmonger: 2020-11-18 11:18:33 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. > Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: Forwarding request to dogtag-ipa-renew-agent > Nov 18 11:18:35 red-auth01 dogtag-ipa-ca-renew-agent-submit: dogtag-ipa-renew-agent returned 3 > Nov 18 11:18:35 red-auth01 certmonger: 2020-11-18 11:18:35 [1164] Error 58 connecting to https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: Problem with the local SSL certificate. > > Any advice? > > Marc. > > -----Original Message----- > From: Florence Blanc-Renaud <flo(a)redhat.com> > Sent: 17 November 2020 10:57 > To: Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Subject: Re: [Freeipa-users] subsystemCert appears out of date > > On 11/17/20 10:19 AM, Marc Pearson | i-Neda Ltd wrote: >> Hi Flo, >> >> Thanks for the help. Included is the output of all the commands as you >> requested. These were all run from a single freeIPA server (red-auth01). >> >> kinit admin; ipa server-role-find --role "CA server" >> Password for admin(a)INT.I-NEDA.COM: >> ---------------------- >> 8 server roles matched >> ---------------------- >> Â Server name: power-auth03.int.i-neda.com Â Role name: CA server >> Â Role status: enabled >> >> Â Server name: power-auth04.int.i-neda.com Â Role name: CA server >> Â Role status: absent >> >> Â Server name: red-auth01.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: red-auth02.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: red-auth03.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: red-auth04.int.i-neda.com Â Role name: CA server Â >> Role status: enabled >> >> Â Server name: white-auth01.int.i-neda.com Â Role name: CA server >> Â Role status: enabled >> >> Â Server name: white-auth02.int.i-neda.com Â Role name: CA server >> Â Role status: enabled >> ---------------------------- >> Number of entries returned 8 >> ---------------------------- >> >> >> Â kinit admin; ipa config-show | grep "renewal" >> Password for admin(a)INT.I-NEDA.COM: >> Â IPA CA renewal master: red-auth01.int.i-neda.com >> >> >> rpm -qa | grep ipa-server >> ipa-server-common-4.6.8-5.el7.centos.noarch >> ipa-server-4.6.8-5.el7.centos.x86_64 >> ipa-server-dns-4.6.8-5.el7.centos.noarch >> >> >> getcert list >> Number of certificates and requests being tracked: 8. >> Request ID '20171101175244': >> status: MONITORING >> stuck: no >> key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' >> certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' >> CA: SelfSign >> issuer: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >> expires: 2021-08-10 14:04:07 UTC >> principal name: krbtgt/INT.I-NEDA.COM(a)INT.I-NEDA.COM >> certificate template/profile: KDCs_PKINIT_Certs pre-save command: >> post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert >> track: yes >> auto-renew: yes >> >> Request ID '20180722081853': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigning >> Cert cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigning >> Cert cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=CA Audit,O=INT.I-NEDA.COM >> expires: 2022-09-16 12:36:41 UTC >> key usage: digitalSignature,nonRepudiation pre-save command: >> /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "auditSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20180722081854': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningC >> ert cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningC >> ert cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=OCSP Subsystem,O=INT.I-NEDA.COM >> expires: 2022-09-16 12:35:31 UTC >> eku: id-kp-OCSPSigning >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "ocspSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> Request ID '20180722081855': >> status: CA_UNREACHABLE >> ca-error: Error 58 connecting to >> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >> Problem with the local SSL certificate. >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCer >> t cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCer >> t cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=CA Subsystem,O=INT.I-NEDA.COM >> expires: 2020-10-24 07:04:35 UTC >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >> /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "subsystemCert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20180722081856': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCer >> t cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCer >> t cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=Certificate Authority,O=INT.I-NEDA.COM >> expires: 2040-10-10 07:51:04 UTC >> key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "caSigningCert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20180722081857': >> status: CA_UNREACHABLE >> ca-error: Error 58 connecting to >> https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: >> Problem with the local SSL certificate. >> stuck: no >> key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' >> certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=IPA RA,O=INT.I-NEDA.COM >> expires: 2020-10-24 07:03:24 UTC >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: >> /usr/libexec/ipa/certmonger/renew_ra_cert_pre >> post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert >> track: yes >> auto-renew: yes >> >> Request ID '20180722081858': >> status: MONITORING >> stuck: no >> key pair storage: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >> cert-pki-ca',token='NSS Certificate DB',pin set >> certificate: >> type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert >> cert-pki-ca',token='NSS Certificate DB' >> CA: dogtag-ipa-ca-renew-agent >> issuer: CN=Certificate Authority,O=INT.I-NEDA.COM >> subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM >> expires: 2021-02-09 11:59:57 UTC >> key usage: >> digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment >> eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection >> pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad >> post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert >> "Server-Cert cert-pki-ca" >> track: yes >> auto-renew: yes >> >> Request ID '20200530130439': >> status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN >> stuck: yes >> key pair storage: >> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >> certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' >> CA: IPA >> issuer: >> subject: >> expires: unknown >> pre-save command: >> post-save command: >> track: yes >> auto-renew: yes >> > Hi Marc, > > so the current situation is the following: > - red-auth01 is the renewal master, with multiple replicas hosting the CA role. > - on this server, 'subsystemCert cert-pki-ca' is expired (expires: > 2020-10-24 07:04:35 UTC) as well as /var/lib/ipa/ra-agent.pem (expires: > 2020-10-24 07:03:24 UTC). > - there is also an issue with the tracking of the cert used by HTTP > > But one of your comments is puzzling me: > >> The signing SSL (int.i-neda.com) is a full wildcard block chain that >> is authorized by a recognised 3rd party. It's worth noting though, >> that we had some issues with the block chain back in April as the >> thrid parties block chain expired. So it's possible that this is as a >> result of that issue, and may require some fettling to resolve. All help is appreciated. > Did you import the new CA chain at that time using ipa-cacert-manage install / ipa-certupdate? > > According to getcert output, the IPA CA is now self-signed. It looks a lot like issue https://pagure.io/freeipa/issue/8176 where the externally-signed IPA CA is renewed/replaced with a self-signed CA. > > As you have ipa 4.6.8-5, the ipa-cert-fix utility is available on your system. It will be easier to use this tool to fix the server: > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… > > Once the systems are up again, you can switch back to an externally-signed ipa CA: > - import the external CA chain using ipa-cacert-manage install + run ipa-certupdate on all the ipa nodes > - switch to externally-signed CA with ipa-cacert-manage renew --external-ca command > (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…) > > HTH, > flo >> >> My current tempory work around is to set the local clock of the OS >> back by over a month so the server belives the expired CA's are still valid. >> >> Kind Regards, >> >> Marc. >> ---------------------------------------------------------------------- >> -- >> *From:* Florence Blanc-Renaud <flo(a)redhat.com> >> *Sent:* 16 November 2020 14:35 >> *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >> *Cc:* Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com> >> *Subject:* Re: [Freeipa-users] subsystemCert appears out of date On >> 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: >>> Hi All, >>> >>> My subsystem cert appears to have gone out of date, and IÃ¢â,¬â"¢m >>> unable to get it to update. This has become an issue on my production >>> environment, and my current work around has been to take the system >>> date back by a month. IÃ¢â,¬â"¢ve tried the cert renew tool, but this >>> doesnÃ¢â,¬â"¢t seem to have updated this cert. >>> >>> Is anyone able to point me in the right direction to be able to >>> update this specific certificate as IÃ¢â,¬â"¢ve been unable to find anything online. >>> >>> [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n >>> 'subsystemCert cert-pki-ca' >>> >>> Certificate: >>> >>> Â Ã,Â Ã,Â Ã,Â Data: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Version: 3 (0x2) >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Serial Number: 42 (0x2a) >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 >>> With RSA Encryption >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Validity: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Not Before: Sun Nov 04 >>> 08:04:35 2018 >>> >>> Not After : Sat Oct 24 07:04:35 2020 >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Subject Public Key Info: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Public Key Algorithm: >>> PKCS #1 RSA Encryption >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â RSA Public Key: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Modulus: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Exponent: 65537 (0x10001) >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Signed Extensions: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate >>> Authority Key Identifier >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Key ID: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> d5:08:c0:3a >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Authority >>> Information Access >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Method: PKIX Online >>> Certificate Status Protocol >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Location: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Certificate Key >>> Usage >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Critical: True >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Usages: Digital >>> Signature >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â Non-Repudiation >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â Key Encipherment >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> Ã,Â Ã,Â Data Encipherment >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Name: Extended Key >>> Usage >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>> Web Server Authentication Certificate >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â TLS >>> Web Client Authentication Certificate >>> >>> Â Ã,Â Ã,Â Ã,Â Signature Algorithm: PKCS #1 SHA-256 With RSA >>> Encryption >>> >>> Â Ã,Â Ã,Â Ã,Â Signature: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 >>> >>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA-256): >>> >>> >>> 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1: >>> 15:13:92:D3:7A:3D:F8:54:44 >>> >>> Â Ã,Â Ã,Â Ã,Â Fingerprint (SHA1): >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â >>> 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 >>> >>> Â Ã,Â Ã,Â Ã,Â Mozilla-CA-Policy: false (attribute missing) >>> >>> Â Ã,Â Ã,Â Ã,Â Certificate Trust Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â SSL Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Email Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Object Signing Flags: >>> >>> Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â Ã,Â User >>> >>> Thanks for the help, >>> >>> Marc. >>> >>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to >>> freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: >>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedo >>> rahosted.org >>> >> Hi Marc, >> >> we need more information in order to help you: >> - do you have multiple master/replicas with the CA role: >> # kinit admin; ipa server-role-find --role "CA server" >> >> - which server is the renewal master: >> # kinit admin ; ipa config-show | grep "renewal" >> >> - which version is installed: >> # rpm -qa | grep ipa-server >> >> - Is the subsystemCert cert-pki-ca the only expired certificate: >> # getcert list >> >> flo >> >

2 1

Certificate operation cannot be completed: Unable to communicate with CMS (403)
by Corey Devenport 23 Nov '20

23 Nov '20

Setup: Cluster of 3 FreeIPA Masters with one as the CA Renewal Master ipa version 4.8.4 Problem: One of our certs for one of our servers recently expired, but it was supposed to auto-renew. Looking into the issue I found that I couldn't access any certs via CLI or the webUI. When trying to do either, I get the following error: IPA Error 4301: CertificateOperationError Certificate operation cannot be completed: Unable to communicate with CMS (403) After doing some research it seems the issue may be with the IPA RA, though I found a userCertificate in the LDAP that was issued the same day as the one being used by the ipa server (it had the userCertificate being used by the ipa server as well as another userCertificate, both have the same dates, but different certificates), changing the ra-agent.pem did not seem to solve any problems. Looking in /var/log/pki/pki-tomcat/ca/debug I found the following errors: WARNING: CertProcessor: No authenticator credentials required SEVERE: AgentCertAuthentication: No SSL Client Certs Found SEVERE: CAProcessor: authentication error: Invalid Credential. I'm a little lost and not sure what to do next, any help would be greatly appreciated.

3 19

freeIPA / DNS Override
by Nico Maas 23 Nov '20

23 Nov '20

Dear all, I have a freeIPA instance which is also connected to upstream / internet DNS servers, but mostly working in a local network which is for most parts seperated from the internet, using a DNS like company.local - where also freeIPA is using this as a kerberos realm. However, we got also domains at the - not freeIPA controlled company.com - and especially some names like testsystem.company.com which are hosted internally in our network and are exposed via DMZ and NAT, so they get different IP addresses. We now would like to have the system test1.company.com not only be available via test1.company.com (with external IP) or test1.company.local (with internal IP), but with the external DNS name and internal IP - so we'd need to somehow rewrite the DNS Name to another IP. Is there a possibility, other than local hosts files etc - to just rewrite one DNS entry in the server? It is important that the rest of the upstream DNS is untouched (i.e. the rest of the company.com names are served as ususally) Kind regards and thanks, Nico

2 1

mixed versions freeIPA domain
by lejeczek 20 Nov '20

20 Nov '20

hi guys, I have a working domain off Centos 7's VERSION: 4.6.8, API_VERSION: 2.237 and now I'm adding Centos 8's VERSION: 4.8.4, API_VERSION: 2.235. Adding Centos 8 replica worked okey and now with on that new replica/master: $ ipa-ca-install I get: Run connection check to master Connection check OK Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/27]: creating certificate server db [2/27]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 8 seconds elapsed Update succeeded [3/27]: creating ACIs for admin [4/27]: creating installation admin user [5/27]: configuring certificate server instance ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmpwodqkt5b'] returned non-zero exit status 1: 'Notice: Trust flag u is set automatically if the private key is present.\nWARNING: Unable to modify o=ipaca: netscape.ldap.LDAPException: error result (20); Type or value exists\nERROR: Exception: Server unreachable due to SSL error: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:897)\n File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 562, in main\n scriptlet.spawn(deployer)\n File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 836, in spawn\n request_timeout=status_request_timeout,\n File "/usr/lib/python3.6/site-packages/pki/server/deployment/pkihelper.py", line 911, in wait_for_startup\n raise Exception(\'Server unreachable due to SSL error: %s\' % reason) from exc\n\n') ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information: ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. and I wonder if it fails because it should, because these two versions will not! work together or the problem of some other cause not related to the fact different versions are used? Many thanks, L.

2 1

FreeIPA 4.6 and ACME
by chriz.r＠web.de 20 Nov '20

20 Nov '20

Hey, we are currently running FreeIPA 4.6.8 on CentOS 7 and found out to manage our Certificates in a Kubernetes Cluster FreeIPA now Supports ACME as a service. On CentOS 7 However ACME is not available in the current FreeIPA package. Has anyone found a viable alternative to ACME or a way to install the acme create/deploy plugin für FreeIPA in CentOS 7? Thanks in advance!

3 2

Freeipa-client authentication against AD
by kotelnikova9314＠gmail.com 20 Nov '20

20 Nov '20

Hello all, sorry if this question was already several times discussed, nevertheless, i am stuck with setting up a trust between FreeIPA and AD. To be more precise, the one way Trus is setup and i can log in into Freeipa server with AD credentials. I have also a bunch of servers with ipa-client configured and i am able to login to them with Freeipa accounts, but not ADs. 1) Did i understood correctly, that clients should "somehow" authenticate to AD via Freeipa? Or do they need to contact directly AD? 2) If the clients should be configured to talk to AD, which configurations are needed? 3) The way i am trying to login is as follows: > ssh -v -l ad_user@ad_domain hostname 4) In logs i have such errors during authentication: sshd[11294]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.45.33.1 user=ad_user@ad_domain sshd[11294]: pam_sss(sshd:auth): received for user ad_user@ad_domain: 6 (Permission denied) sshd[11290]: error: PAM: Authentication failure for ad_user@ad_domain from 10.45.33.1 sshd[11290]: Connection closed by authenticating user user_ad@ad_domain 10.45.33.1 port 40108 [preauth] Thanks in advance!

3 5

DNS issue with CNAME and dnsmasq forwards
by Boris Behrens 20 Nov '20

20 Nov '20

Hi, I have a very strange problem: I would like to add a CNAME to the IPA DNS server, that resolves to an internal domain which is forwarded from our central DNSmasq to our consul. I created a zone called test.boris and added a CNAME record cname.test.boris IN CNAME cname.stage.consul. The DNSmasq config forwards consul to 10.1.2.3:8600. When I now query for the cname.test.boris. I get cname.test.boris. in CNAME cname.stage.consul. cname.stage.consul. NXDOMAIN. After some debugging I came to the conclusion that the NXDOMAIN response comes from freeIPA which tries to resolv this, but consul. is not in the world wide root zone it does not work. Now I added a forward zone which tells IPA to forward this request back to DNSmasq. In the TCP dump I can trace the package and I see that DNSmasq send the correct address back to freeIPA which answers with an empty A record. What am I doing wrong? -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groÃƒ¼en Saal.

2 3

Problems after updating to OL 8.3 (Ootpa)
by Ronald Wimmer 18 Nov '20

18 Nov '20

After upgrading our IPA servers AD user resolution seems to have stopped working. id myADUser says: id: ‘myADUser’: no such user Why? The log say: ==> /var/log/sssd/sssd_nss.log <== (2020-11-18 9:09:59): [nss] [accept_fd_handler] (0x0400): Client [0x55b92cb403e0][26] connected! (2020-11-18 9:09:59): [nss] [sss_cmd_get_version] (0x0200): Received client version [1]. (2020-11-18 9:09:59): [nss] [sss_cmd_get_version] (0x0200): Offered version [1]. (2020-11-18 9:09:59): [nss] [nss_getby_name] (0x0400): Input name: myADUser (2020-11-18 9:09:59): [nss] [cache_req_send] (0x0400): CR #0: New request 'User by name' (2020-11-18 9:09:59): [nss] [cache_req_process_input] (0x0400): CR #0: Parsing input name [myADUser] (2020-11-18 9:09:59): [nss] [sss_parse_name_for_domains] (0x0200): name 'myADUser' matched without domain, user is myADUser (2020-11-18 9:09:59): [nss] [nss_get_object_send] (0x0400): Client [0x55b92cb403e0][26]: sent cache request #0 (2020-11-18 9:09:59): [nss] [cache_req_set_name] (0x0400): CR #0: Setting name [myADUser] (2020-11-18 9:09:59): [nss] [cache_req_select_domains] (0x0400): CR #0: Performing a multi-domain search (2020-11-18 9:09:59): [nss] [cache_req_search_domains] (0x0400): CR #0: Search will check the cache and check the data provider (2020-11-18 9:09:59): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [implicit_files] (2020-11-18 9:09:59): [nss] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [implicit_files] rules (2020-11-18 9:09:59): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up myADUser@implicit_files (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myADUser@implicit_files] (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: [myADUser@implicit_files] is not present in negative cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser@implicit_files] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser@implicit_files] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [myADUser@implicit_files] in data provider (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser@implicit_files] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser@implicit_files] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [myADUser@implicit_files] to negative cache (2020-11-18 9:09:59): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/implicit_files/myADUser@implicit_files] to negative cache (2020-11-18 9:09:59): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [org.mydomain.at] (2020-11-18 9:09:59): [nss] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [org.mydomain.at] rules (2020-11-18 9:09:59): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up myADUser(a)org.mydomain.at (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myADUser(a)org.mydomain.at] (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: [myADUser(a)org.mydomain.at] is not present in negative cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)org.mydomain.at] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)org.mydomain.at] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [myADUser(a)org.mydomain.at] in data provider (2020-11-18 9:09:59): [nss] [sss_dp_get_account_send] (0x0400): Creating request for [org.mydomain.at][0x1][BE_REQ_USER][name=myADUser@org.mydomain.at:-] ==> /var/log/sssd/sssd_linux.mydomain.at.log <== (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=myADUser(a)org.mydomain.at] (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): DP Request [Account #1]: New request. Flags [0x0001]. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): Number of active DP request: 1 (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=myADUser))][cn=Default Trust View,cn=views,cn=accounts,dc=linux,dc=mydomain,dc=at]. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (2020-11-18 9:09:59): [be[linux.mydomain.at]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [myADUser] to IPA server (2020-11-18 9:09:59): [be[linux.mydomain.at]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (2020-11-18 9:09:59): [be[linux.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sysdb_search_by_name] (0x0400): No such entry (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_req_done] (0x0400): DP Request [Account #1]: Request handler finished [0]: Success (2020-11-18 9:09:59): [be[linux.mydomain.at]] [_dp_req_recv] (0x0400): DP Request [Account #1]: Receiving request data. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): DP Request [Account #1]: Request removed. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success ==> /var/log/sssd/sssd_nss.log <== (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)org.mydomain.at] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)org.mydomain.at] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [myADUser(a)org.mydomain.at] to negative cache (2020-11-18 9:09:59): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/org.mydomain.at/myADUser(a)org.mydomain.at] to negative cache (2020-11-18 9:09:59): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [linux.mydomain.at] (2020-11-18 9:09:59): [nss] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [linux.mydomain.at] rules (2020-11-18 9:09:59): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up myADUser(a)linux.mydomain.at (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myADUser(a)linux.mydomain.at] (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: [myADUser(a)linux.mydomain.at] is not present in negative cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)linux.mydomain.at] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)linux.mydomain.at] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [myADUser(a)linux.mydomain.at] in data provider (2020-11-18 9:09:59): [nss] [sss_dp_get_account_send] (0x0400): Creating request for [linux.mydomain.at][0x1][BE_REQ_USER][name=myADUser@linux.mydomain.at:-] ==> /var/log/sssd/sssd_linux.mydomain.at.log <== (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=myADUser(a)linux.mydomain.at] (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): DP Request [Account #2]: New request. Flags [0x0001]. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): Number of active DP request: 1 (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_search_user_next_base] (0x0400): Searching for users with base [cn=accounts,dc=linux,dc=mydomain,dc=at] (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(uid=myADUser)(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=linux,dc=mydomain,dc=at]. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sysdb_search_by_name] (0x0400): No such entry (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sysdb_search_by_name] (0x0400): No such entry (2020-11-18 9:09:59): [be[linux.mydomain.at]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_req_done] (0x0400): DP Request [Account #2]: Request handler finished [0]: Success (2020-11-18 9:09:59): [be[linux.mydomain.at]] [_dp_req_recv] (0x0400): DP Request [Account #2]: Receiving request data. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): DP Request [Account #2]: Request removed. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success ==> /var/log/sssd/sssd_nss.log <== (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)linux.mydomain.at] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)linux.mydomain.at] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [myADUser(a)linux.mydomain.at] to negative cache (2020-11-18 9:09:59): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/linux.mydomain.at/myADUser(a)linux.mydomain.at] to negative cache (2020-11-18 9:09:59): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [buero.mydomain.at] (2020-11-18 9:09:59): [nss] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [buero.mydomain.at] rules (2020-11-18 9:09:59): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up myADUser(a)buero.mydomain.at (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myADUser(a)buero.mydomain.at] (2020-11-18 9:09:59): [nss] [cache_req_search_ncache] (0x0400): CR #0: [myADUser(a)buero.mydomain.at] is not present in negative cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)buero.mydomain.at] in cache (2020-11-18 9:09:59): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)buero.mydomain.at] was not found in cache (2020-11-18 9:09:59): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [myADUser(a)buero.mydomain.at] in data provider (2020-11-18 9:09:59): [nss] [sss_dp_get_account_send] (0x0400): Creating request for [buero.mydomain.at][0x1][BE_REQ_USER][name=myADUser@buero.mydomain.at:-] ==> /var/log/sssd/sssd_linux.mydomain.at.log <== (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=myADUser(a)buero.mydomain.at] (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): DP Request [Account #3]: New request. Flags [0x0001]. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): Number of active DP request: 1 (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=myADUser))][cn=Default Trust View,cn=views,cn=accounts,dc=linux,dc=mydomain,dc=at]. (2020-11-18 9:09:59): [be[linux.mydomain.at]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (2020-11-18 9:09:59): [be[linux.mydomain.at]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [myADUser] to IPA server (2020-11-18 9:09:59): [be[linux.mydomain.at]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sysdb_search_by_name] (0x0400): No such entry (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_done] (0x0400): DP Request [Account #3]: Request handler finished [0]: Success (2020-11-18 9:10:00): [be[linux.mydomain.at]] [_dp_req_recv] (0x0400): DP Request [Account #3]: Receiving request data. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): DP Request [Account #3]: Request removed. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success ==> /var/log/sssd/sssd_nss.log <== (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)buero.mydomain.at] in cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)buero.mydomain.at] was not found in cache (2020-11-18 9:10:00): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [myADUser(a)buero.mydomain.at] to negative cache (2020-11-18 9:10:00): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/buero.mydomain.at/myADUser(a)buero.mydomain.at] to negative cache (2020-11-18 9:10:00): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [mydomain.at] (2020-11-18 9:10:00): [nss] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [mydomain.at] rules (2020-11-18 9:10:00): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up myADUser(a)mydomain.at (2020-11-18 9:10:00): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myADUser(a)mydomain.at] (2020-11-18 9:10:00): [nss] [cache_req_search_ncache] (0x0400): CR #0: [myADUser(a)mydomain.at] is not present in negative cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)mydomain.at] in cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)mydomain.at] was not found in cache (2020-11-18 9:10:00): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [myADUser(a)mydomain.at] in data provider (2020-11-18 9:10:00): [nss] [sss_dp_get_account_send] (0x0400): Creating request for [mydomain.at][0x1][BE_REQ_USER][name=myADUser@mydomain.at:-] ==> /var/log/sssd/sssd_linux.mydomain.at.log <== (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=myADUser(a)mydomain.at] (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): DP Request [Account #4]: New request. Flags [0x0001]. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): Number of active DP request: 1 (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=myADUser))][cn=Default Trust View,cn=views,cn=accounts,dc=linux,dc=mydomain,dc=at]. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [myADUser] to IPA server (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sysdb_search_by_name] (0x0400): No such entry (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_done] (0x0400): DP Request [Account #4]: Request handler finished [0]: Success (2020-11-18 9:10:00): [be[linux.mydomain.at]] [_dp_req_recv] (0x0400): DP Request [Account #4]: Receiving request data. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): DP Request [Account #4]: Request removed. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success ==> /var/log/sssd/sssd_nss.log <== (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)mydomain.at] in cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)mydomain.at] was not found in cache (2020-11-18 9:10:00): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [myADUser(a)mydomain.at] to negative cache (2020-11-18 9:10:00): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/mydomain.at/myADUser(a)mydomain.at] to negative cache (2020-11-18 9:10:00): [nss] [cache_req_set_domain] (0x0400): CR #0: Using domain [tk.mydomain.at] (2020-11-18 9:10:00): [nss] [cache_req_prepare_domain_data] (0x0400): CR #0: Preparing input data for domain [tk.mydomain.at] rules (2020-11-18 9:10:00): [nss] [cache_req_search_send] (0x0400): CR #0: Looking up myADUser(a)tk.mydomain.at (2020-11-18 9:10:00): [nss] [cache_req_search_ncache] (0x0400): CR #0: Checking negative cache for [myADUser(a)tk.mydomain.at] (2020-11-18 9:10:00): [nss] [cache_req_search_ncache] (0x0400): CR #0: [myADUser(a)tk.mydomain.at] is not present in negative cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)tk.mydomain.at] in cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)tk.mydomain.at] was not found in cache (2020-11-18 9:10:00): [nss] [cache_req_search_dp] (0x0400): CR #0: Looking up [myADUser(a)tk.mydomain.at] in data provider (2020-11-18 9:10:00): [nss] [sss_dp_get_account_send] (0x0400): Creating request for [tk.mydomain.at][0x1][BE_REQ_USER][name=myADUser@tk.mydomain.at:-] ==> /var/log/sssd/sssd_linux.mydomain.at.log <== (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][name=myADUser(a)tk.mydomain.at] (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): DP Request [Account #5]: New request. Flags [0x0001]. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_attach_req] (0x0400): Number of active DP request: 1 (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=myADUser))][cn=Default Trust View,cn=views,cn=accounts,dc=linux,dc=mydomain,dc=at]. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [myADUser] to IPA server (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (2020-11-18 9:10:00): [be[linux.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sysdb_search_by_name] (0x0400): No such entry (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_done] (0x0400): DP Request [Account #5]: Request handler finished [0]: Success (2020-11-18 9:10:00): [be[linux.mydomain.at]] [_dp_req_recv] (0x0400): DP Request [Account #5]: Receiving request data. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): DP Request [Account #5]: Request removed. (2020-11-18 9:10:00): [be[linux.mydomain.at]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (2020-11-18 9:10:00): [be[linux.mydomain.at]] [sbus_issue_request_done] (0x0400): sssd.dataprovider.getAccountInfo: Success ==> /var/log/sssd/sssd_nss.log <== (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Looking up [myADUser(a)tk.mydomain.at] in cache (2020-11-18 9:10:00): [nss] [cache_req_search_cache] (0x0400): CR #0: Object [myADUser(a)tk.mydomain.at] was not found in cache (2020-11-18 9:10:00): [nss] [cache_req_search_ncache_add_to_domain] (0x0400): CR #0: Adding [myADUser(a)tk.mydomain.at] to negative cache (2020-11-18 9:10:00): [nss] [sss_ncache_set_str] (0x0400): Adding [NCE/USER/tk.mydomain.at/myADUser(a)tk.mydomain.at] to negative cache (2020-11-18 9:10:00): [nss] [cache_req_process_result] (0x0400): CR #0: Finished: Not found (2020-11-18 9:10:00): [nss] [client_recv] (0x0200): Client disconnected!

2 4

certlist shows ca-error after upgrade
by Cody Ashe-McNalley 18 Nov '20

18 Nov '20

Hi All, My primary CA's httpd and slapd certs show a 'ca-error' warning "4027 (RPC failed at server. The search criteria was not specific enough. Expected 1 and found 2." RHEL 7.9 ipa-server-4.6.8-5.el7.x86_64 CA and DNS enabled Request ID '20180927235641': status: CA_UNREACHABLE ca-error: Server at https://<ipaserver>/ipa/xml failed request, will retry: 4027 (RPC failed at server. The search criteria was not specific enough. Expected 1 and found 2.). stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-<DOMAIN>',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-<DOMAIN>/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-<DOMAIN>',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=<DOMAIN> subject: CN=<ipaserver>,O=<DOMAIN> expires: 2022-05-05 23:59:26 UTC principal name: ldap/<ipaserver>@<DOMAIN> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv <DOMAIN> track: yes auto-renew: yes Request ID '20180927235642': status: CA_UNREACHABLE ca-error: Server at https://<ipaserver>/ipa/xml failed request, will retry: 4027 (RPC failed at server. The search criteria was not specific enough. Expected 1 and found 2.). stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=<DOMAIN> subject: CN=<ipaserver>,O=<DOMAIN> expires: 2022-05-05 23:59:25 UTC principal name: HTTP/<ipaserver>@<DOMAIN> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Advice and experience would be greatly appreciated. Best regards, Cody

2 10

Disable self service for TOTP tokens
by Kevin Cassar 18 Nov '20

18 Nov '20

Hi all, In my setup I have TOTP (software token) enabled, and it works as intended. My only concern is, that I want only the "admin" to be able to generate software tokens, that they later can assign to users. Essentially, I want to do away with user-managed tokens, and only have administrator-managed tokens. I was wondering if such a thing is possible? Thank you.

2 1

Re: subsystemCert appears out of date
by Florence Blanc-Renaud 18 Nov '20

18 Nov '20

On 11/17/20 10:19 AM, Marc Pearson | i-Neda Ltd wrote: > Hi Flo, > > Thanks for the help. Included is the output of all the commands as you > requested. These were all run from a single freeIPA server (red-auth01). > > kinit admin; ipa server-role-find --role "CA server" > Password for admin(a)INT.I-NEDA.COM: > ---------------------- > 8 server roles matched > ---------------------- > Â Server name: power-auth03.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > > Â Server name: power-auth04.int.i-neda.com > Â Role name: CA server > Â Role status: absent > > Â Server name: red-auth01.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > > Â Server name: red-auth02.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > > Â Server name: red-auth03.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > > Â Server name: red-auth04.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > > Â Server name: white-auth01.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > > Â Server name: white-auth02.int.i-neda.com > Â Role name: CA server > Â Role status: enabled > ---------------------------- > Number of entries returned 8 > ---------------------------- > > > Â kinit admin; ipa config-show | grep "renewal" > Password for admin(a)INT.I-NEDA.COM: > Â IPA CA renewal master: red-auth01.int.i-neda.com > > > rpm -qa | grep ipa-server > ipa-server-common-4.6.8-5.el7.centos.noarch > ipa-server-4.6.8-5.el7.centos.x86_64 > ipa-server-dns-4.6.8-5.el7.centos.noarch > > > getcert list > Number of certificates and requests being tracked: 8. > Request ID '20171101175244': > status: MONITORING > stuck: no > key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' > certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' > CA: SelfSign > issuer: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM > subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM > expires: 2021-08-10 14:04:07 UTC > principal name: krbtgt/INT.I-NEDA.COM(a)INT.I-NEDA.COM > certificate template/profile: KDCs_PKINIT_Certs > pre-save command: > post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert > track: yes > auto-renew: yes > > Request ID '20180722081853': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=INT.I-NEDA.COM > subject: CN=CA Audit,O=INT.I-NEDA.COM > expires: 2022-09-16 12:36:41 UTC > key usage: digitalSignature,nonRepudiation > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "auditSigningCert cert-pki-ca" > track: yes > auto-renew: yes > > Request ID '20180722081854': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS > Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=INT.I-NEDA.COM > subject: CN=OCSP Subsystem,O=INT.I-NEDA.COM > expires: 2022-09-16 12:35:31 UTC > eku: id-kp-OCSPSigning > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "ocspSigningCert cert-pki-ca" > track: yes > auto-renew: yes > Request ID '20180722081855': > status: CA_UNREACHABLE > ca-error: Error 58 connecting to > https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: > Problem with the local SSL certificate. > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=INT.I-NEDA.COM > subject: CN=CA Subsystem,O=INT.I-NEDA.COM > expires: 2020-10-24 07:04:35 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "subsystemCert cert-pki-ca" > track: yes > auto-renew: yes > > Request ID '20180722081856': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=INT.I-NEDA.COM > subject: CN=Certificate Authority,O=INT.I-NEDA.COM > expires: 2040-10-10 07:51:04 UTC > key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "caSigningCert cert-pki-ca" > track: yes > auto-renew: yes > > Request ID '20180722081857': > status: CA_UNREACHABLE > ca-error: Error 58 connecting to > https://red-auth01.int.i-neda.com:8443/ca/agent/ca/profileReview: > Problem with the local SSL certificate. > stuck: no > key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' > certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=INT.I-NEDA.COM > subject: CN=IPA RA,O=INT.I-NEDA.COM > expires: 2020-10-24 07:03:24 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth > pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre > post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert > track: yes > auto-renew: yes > > Request ID '20180722081858': > status: MONITORING > stuck: no > key pair storage: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB',pin set > certificate: > type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert > cert-pki-ca',token='NSS Certificate DB' > CA: dogtag-ipa-ca-renew-agent > issuer: CN=Certificate Authority,O=INT.I-NEDA.COM > subject: CN=red-auth01.int.i-neda.com,O=INT.I-NEDA.COM > expires: 2021-02-09 11:59:57 UTC > key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment > eku: id-kp-serverAuth,id-kp-clientAuth,id-kp-emailProtection > pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad > post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert > "Server-Cert cert-pki-ca" > track: yes > auto-renew: yes > > Request ID '20200530130439': > status: NEWLY_ADDED_NEED_KEYINFO_READ_PIN > stuck: yes > key pair storage: > type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' > certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert' > CA: IPA > issuer: > subject: > expires: unknown > pre-save command: > post-save command: > track: yes > auto-renew: yes > Hi Marc, so the current situation is the following: - red-auth01 is the renewal master, with multiple replicas hosting the CA role. - on this server, 'subsystemCert cert-pki-ca' is expired (expires: 2020-10-24 07:04:35 UTC) as well as /var/lib/ipa/ra-agent.pem (expires: 2020-10-24 07:03:24 UTC). - there is also an issue with the tracking of the cert used by HTTP But one of your comments is puzzling me: > The signing SSL (int.i-neda.com) is a full wildcard block chain that is > authorized by a recognised 3rd party. It's worth noting though, that we > had some issues with the block chain back in April as the thrid parties > block chain expired. So it's possible that this is as a result of that > issue, and may require some fettling to resolve. All help is appreciated. Did you import the new CA chain at that time using ipa-cacert-manage install / ipa-certupdate? According to getcert output, the IPA CA is now self-signed. It looks a lot like issue https://pagure.io/freeipa/issue/8176 where the externally-signed IPA CA is renewed/replaced with a self-signed CA. As you have ipa 4.6.8-5, the ipa-cert-fix utility is available on your system. It will be easier to use this tool to fix the server: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Once the systems are up again, you can switch back to an externally-signed ipa CA: - import the external CA chain using ipa-cacert-manage install + run ipa-certupdate on all the ipa nodes - switch to externally-signed CA with ipa-cacert-manage renew --external-ca command (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…) HTH, flo > > My current tempory work around is to set the local clock of the OS back > by over a month so the server belives the expired CA's are still valid. > > Kind Regards, > > Marc. > ------------------------------------------------------------------------ > *From:* Florence Blanc-Renaud <flo(a)redhat.com> > *Sent:* 16 November 2020 14:35 > *To:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *Cc:* Marc Pearson | i-Neda Ltd <mpearson(a)i-neda.com> > *Subject:* Re: [Freeipa-users] subsystemCert appears out of date > On 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: >> Hi All, >> >> My subsystem cert appears to have gone out of date, and IÃ¢â‚¬â„¢m unable to >> get it to update. This has become an issue on my production environment, >> and my current work around has been to take the system date back by a >> month. IÃ¢â‚¬â„¢ve tried the cert renew tool, but this doesnÃ¢â‚¬â„¢t seem to have >> updated this cert. >> >> Is anyone able to point me in the right direction to be able to update >> this specific certificate as IÃ¢â‚¬â„¢ve been unable to find anything online. >> >> [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >> cert-pki-ca' >> >> Certificate: >> >>Â Ã‚Â Ã‚Â Ã‚Â Data: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Version: 3 (0x2) >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Serial Number: 42 (0x2a) >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Validity: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Not Before: Sun Nov 04 08:04:35 2018 >> >> Not After : Sat Oct 24 07:04:35 2020 >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Subject Public Key Info: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Public Key Algorithm: PKCS #1 RSA Encryption >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â RSA Public Key: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Modulus: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Exponent: 65537 (0x10001) >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Signed Extensions: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Name: Certificate Authority Key Identifier >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Key ID: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â d5:08:c0:3a >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Name: Authority Information Access >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Method: PKIX Online Certificate Status Protocol >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Location: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Name: Certificate Key Usage >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Critical: True >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Usages: Digital Signature >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Non-Repudiation >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Key Encipherment >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Data Encipherment >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Name: Extended Key Usage >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â TLS Web Server Authentication Certificate >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â TLS Web Client Authentication Certificate >> >>Â Ã‚Â Ã‚Â Ã‚Â Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption >> >>Â Ã‚Â Ã‚Â Ã‚Â Signature: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 >> >>Â Ã‚Â Ã‚Â Ã‚Â Fingerprint (SHA-256): >> >> >> 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1:15:13:92:D3:7A:3D:F8:54:44 >> >>Â Ã‚Â Ã‚Â Ã‚Â Fingerprint (SHA1): >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 >> >>Â Ã‚Â Ã‚Â Ã‚Â Mozilla-CA-Policy: false (attribute missing) >> >>Â Ã‚Â Ã‚Â Ã‚Â Certificate Trust Flags: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â SSL Flags: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â User >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Email Flags: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â User >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Object Signing Flags: >> >>Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â Ã‚Â User >> >> Thanks for the help, >> >> Marc. >> >> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >> > Hi Marc, > > we need more information in order to help you: > - do you have multiple master/replicas with the CA role: > # kinit admin; ipa server-role-find --role "CA server" > > - which server is the renewal master: > # kinit admin ; ipa config-show | grep "renewal" > > - which version is installed: > # rpm -qa | grep ipa-server > > - Is the subsystemCert cert-pki-ca the only expired certificate: > # getcert list > > flo >

2 1

when will my ca certificate expire?
by Harald Dunkel 18 Nov '20

18 Nov '20

Hi folks, how can I list the expiration dates of the ca certificate chain, before it is too late? External ca. Regards Harri

2 1

FreeIPA using external CA
by A. Karampatziakis 18 Nov '20

18 Nov '20

Hi all, For a project we want to use FreeIPA with external CA. We are using v4.6.6 on centos7.8. The guides instruct to use command ”ipa-server-install --external-ca”, get the CSR and run the install command again using the signed certificate. Issue 1: key length is 2048 Fix: Found that this can be changed in file /usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py Add under: # CA key algorithm # config.set("CA", "pki_ca_signing_key_size", 4096) Issue 2: Subject DN The subject on the certificate request is “CN=Certificate Authority,O=[realm]” but the root-ca requires us to have in the format: CN=FREEIPA 2020,serialNumber=XxXx,O=xxx,C=XX Q: Is it possible to install the FreeIPA server using the external root-ca and a signed certificate from the beginning? (csr created outside ipa-server-install command) Q: Is it possible to alter the information on the certificate request to match the root-ca’s requirements? Thanks, Anestis

2 4

FreeIPA 4.9.0 release candidate 1 released
by Alexander Bokovoy 17 Nov '20

17 Nov '20

The FreeIPA team would like to announce FreeIPA 4.9.0 release candidate 1! It can be downloaded from http://www.freeipa.org/page/Downloads. At this point, we do not plan to provide releases to Fedora 33 or earlier versions due to a large number of changes coming with FreeIPA 4.9 series. This is a short version of the release notes. A full changelog can be found at https://www.freeipa.org/page/Releases/4.9.0rc1 == Highlights in 4.9.0 release candidate 1 * 298: [RFE] Add support for cracklib to password policies FreeIPA password quality checking plugin has been extended to use libpwquality library. Password policies can now check for a reuse of a user name, dictionary words using a cracklib package, numbers and symbols replacement and repeating characters in the passwords. * 2445: [RFE] IdM password policy should include checks for repeating characters FreeIPA password quality checking plugin has been extended to use libpwquality library. Password policies can now check for a reuse of a user name, dictionary words using a cracklib package, numbers and symbols replacement and repeating characters in the passwords. * 3687: [RFE] IPA user account expiry warning. EPN stands for Expiring Password Notification. It is a standalone tool designed to build a list of users whose password would expire in the near future, and either display the list in a machine-readable (JSON) format, or send email notifications to these users. EPN provides command-line options to display the list of affected users. This provides data introspection and helps understand how many emails would be sent for a given day, or a given date range. The command-line options can also be used by a monitoring system to alert whenever a number of emails over the SMTP quota would be sent. EPN is meant to be launched once a day from an IPA client (preferred) or replica from a systemd timer. EPN does not keep state: the list of affected users is built at runtime but never kept. * 3827: [RFE] Expose TTL in web UI DNS record time to live (TTL) parameters can be edited in Web UI * 3999: [RFE] Fix and Document how to set up Samba File Server with IPA Samba file server can now be configured on the FreeIPA-enrolled system to provide file services to users in IPA domain and to users from trusted Active Directory forests * 4751: Implement ACME certificate enrolment Configure the Automatic Certificate Management Environment (ACME) protocol support provided by the dogtag CA. * 5011: [RFE] Forward CA requests to dogtag or helper by GSSAPI * 5608: [RFE] Add Dogtag configuration extensions * 5662: ID Views: do not allow custom Views for the masters Custom ID views cannot be applied to IPA masters. A check was added to both IPA CLI and Web UI to prevent applying custom ID views to avoid confusion and unintended side-effects. * 5948: [RFE] Implement pam_pwquality featureset in IPA password policies * 6783: [RFE] Host-group names command rename host groups can now be renamed with IPA CLI: 'ipa hostgroup-mod group-name --rename new-name'. Protected hostgroups ('ipaservers') cannot be renamed. * 7137: [RFE]: Able to browse different links from IPA web gui in new tabs * 7181: ipa-replica-prepare fails for 2nd replica when passwordHistory is enabled FreeIPA password policy plugin in 389-ds was extended to exempt non-Kerberos LDAP objects from checking Kerberos policy during password changes by the Directory Manager or a password synchronization manager. This issue affected, among others, an integrated CA administrator account during deployment of more than one replica in some cases. * 7522: Disable cert publishing in dogtag Dogtag certificate publishing facility is not configured anymore as it is not used in FreeIPA. * 7577: [RFE] DNS package check should be called earlier in installation routine The ``--setup-dns`` knob and interactive installer now both check for the presence of freeipa-server-dns early and abort the installer with an error before starting actual deployment. * 7695: ipa service-del should display principal name instead of Invalid 'principal'. When deleting services, report exact name of a system required principal that couldn't be deleted. * 7966: Add support for JSON-RPC in ipa-join ipa-join tool defaults to use of JSON-RPC protocol when communicating to IPA masters by default. The choice of JSON-RPC or XML-RPC is a compile-time setting now. * 7971: [RFE] Include hint for replication_wait_timeout if timeout fails * 8106: ca-certificate file not being parsed correctly on Ubuntu with p11-kit-trust.so due to data inserted by FreeIPA Client install On Debian-based platforms update-ca-certificates does not support multiple certificates in a single file. IPA installers now write individual files per each certificate for Debian-based platforms. * 8114: [RFE] Delegate group membership management It is now possible to associate group managers with the groups. Group managers have rights to add and remove members of the individual group rather than being administrators for every group. * 8217: RFE: ipa-backup should compare locally and globally installed server roles ipa-backup now checks whether the local replica's roles match those used in the cluster and exits with a warning if this is not the case as backups taken on this host would not be sufficient for a proper restore. FreeIPA administrators are advised to double check whether the host backups are run has all the necessary (used) roles. * 8222: Upgrade dojo.js Version of dojo.js framework used by FreeIPA Web UI was upgraded to 1.16.2. * 8233: 4.8.5 master Installation error On Debian and ALT Linux setup of AJP connector did restart Apache instance before it was configured. The restart wasn't actually needed and thus was removed. * 8236: Enforce a check to prevent adding objects from IPA as external members of external groups Command 'ipa group-add-member' allowed to specify any user or group for '--external' option. A stricter check is added to verify that a group or user to be added as an external member does not come from IPA domain. * 8239: Actualize Bootstrap version Bootstrap Javascript framework used by FreeIPA web UI was updated to version 3.4.1. * 8241: Build fails on Fedora 30 SELinux rules for ipa-custodia were merged into FreeIPA SELinux policy. The policy relied on an SELinux interface that is not available in Fedora 30. The logic was changed to allow better portability across SELinux versions. * 8268: Prevent use of too long passwords Kerberos tools limit password entered in kpasswd or kadmin tools to 1024 characters but do not allow to distinguish between passwords cut off at 1024 characters and passwords with 1024 characters. Thus, a limit of 1000 characters is now applied everywhere in FreeIPA. * 8275: Support systemd-resolved FreeIPA DNS servers now detect systemd-resolved and configure it to pass through itself. * 8276: Add default password policy for sysaccounts cn=sysaccounts,cn=etc now has a default password policy to permit system accounts with krbPrincipalAux object class. This allows system accounts to have a keytab that does not expire. The "Default System Accounts Password Policy" has a minimum password length in case the password is directly modified with LDAP. * 8284: Upgrade jQuery version to actual one Version of jQuery framework used by FreeIPA Web UI was updated to 3.4.1. * 8289: ipa servicedelegationtarget-add-member does not allow to add hosts as targets service delegation rules and targets now allow to specify hosts as a rule or a target's member principal. * 8291: krb5kdc crashes in IPA plugin on use of IPA Windows principal alias Memory handling in various FreeIPA KDC functions was improved, preventing potential crashes when looking up machine account aliases for Windows machines. * 8301: The value of the first character in target* keywords is expected to be a double quote 389-ds 1.4 enforces syntax for target* keywords (targetattr, targetfilter, etc) to have quoted attributes. Otherwise the aci that contains unquoted parameters is ignored. Default FreeIPA access controls were fixed to follow 389-ds syntax. Any third-party ACIs need to be updated manually. * 8304: [fed32] client-install does not properly set ChallengeResponseAuthentication yes in sshd conf ipa-client-installation now writes the sshd configuration to the drop-in directory /etc/ssh/sshd_config.d/, in the 04-ipa.conf snippet, thus ensuring that the setting "ChallengeResponseAuthentication yes" take precedence. * 8315: [dirsrv] set 'nsslapd-enable-upgrade-hash: off' as this raises warnings 389-ds 1.4.1.6 introduced automatic password hash upgrade on LDAP binds. FreeIPA now disables this feature because changing password hash in FreeIPA is not allowed by the internal plugins that synchronize password hashes between LDAP and Kerberos. * 8322: [RFE] Changing default hostgroup is too easy In Web UI a confirmation dialog was added to automember configuration to prevent unintended modification of a default host group. * 8325: [WebUI] Fix htmlPrefilter issue in jQuery CVE-2020-11022: In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. FreeIPA is not allowing to pass arbitrary code into affected jQuery path but we applied jQuery fix anyway. * 8335: [WebUI] manage IPA resources as a user from a trusted Active Directory domain When users from trusted Active Directory domains have permissions to manage IPA resources, they can do so through a Web UI management console. * 8348: Allow managed permissions with ldap:///self bind rule Managed permissions can now address self-service operations. This makes possible for 3rd-party plugins to supply full set of managed permissions. * 8357: Allow managing IPA resources as a user from a trusted Active Directory forest A 3rd-party plugin to provide management of IPA resources as users from trusted Active Directory domains was merged into FreeIPA core. ID user overrides can now be added to IPA management groups and roles and thus allow AD users to manage IPA. * 8362: IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp LDAP authentication now handles Kerberos principal and password expiration time in UTC time zone. Previously, a local server time zone was applied even though UTC was implied in the settings. * 8374: EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in freeipa-client-epn EPN did not ship any configuration file. This was an oversight, but the tool itself would work fine as it had sane defaults ; moreover, the man page for the configuration file was present. * 8401: Create platform definitions for freeipa-container ipaplatform now provides container platform flavors for freeipa/freeipa-container * 8404: Detect and fail if not enough memory is available for installation FreeIPA server now requires at least 1.2 GiB RAM for installation to prevent performance degradation. * 8444: EPN: enhance input validation Various input validation checks were added to EPN. * 8445: EPN: '[Errno 111] Connection refused' when the SMTP is down EPN now displays a proper message if the configured SMTP server cannot be contacted. * 8449: EPN: enhance CLI option tests EPN: enhance existing tests for --dry-run, --from-nbdays and --to-nbdays. * 8488: SELinux blocks custodia key replication / retrieval for sub-CAs SELinux: Make sure ipa_custodia_t has the necessary rights ; add dedicated policy rules for ipa-pki-retrieve-key. * 8490: It is not possible to edit KDC database when the FreeIPA server is running kadmin.local command 'getprincs' is now supported * 8493: Synchronize index LDIF and index update files Configuration of LDAP indices was moved into a single place. New indices were added to attributes related to trusted domains operations. Performance improvement is expected for Kerberos service tickets requested by users from trusted Active Directory domains. * 8503: pkispawn logs files are empty On recent versions of Dogtag PKI, pkispawn does not create logs by default, making debugging failed IPA installs impossible. Invoke pkispawn with --debug to revert to the previous behavior. * 8507: [WebUI] Backport jQuery patches from newer versions of the library (e.g. 3.5.0) Support reproducible builds for jQuery library * 8510: create_active_user and kinit_as_user should collect kdcinfo.REALM on failure Sometimes, requesting a TGT after a password reset fails because SSSD seems to select different hosts for these two sequential tasks, leaving no time for replication to replicate the password hashes. Add debug information to the test suites that exhibit the problem and always display the kdcinfo file maintained by SSSD that contains the KRB5KDC IP it should be pinned to. * 8530: Running ipa-server-install fails on machine where libsss_sudo is not installed The FreeIPA client RPM now has a soft dependency on libsss_sudo and sudo itself. === Known Issues * 8240: KRA install fails if all KRA members are Hidden Replicas If the first KRA instance is installed on a hidden replica, more KRA instances cannot be added to the cluster. As a workaround, temporarily make the the hidden replica with the KRA role visible before adding more KRA instances. The previously-hidden replica can be hidden again as soon as ipa-kra-install is complete. === Bug fixes FreeIPA 4.9.0 release candidate 1 is a stabilization release for the features delivered as a part of 4.9 version series. There are more than 350 bug-fixes since FreeIPA 4.8.10 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/298[#298] (https://bugzilla.redhat.com/show_bug.cgi?id=587752[rhbz#587752]) [RFE] Add support for cracklib to password policies * https://pagure.io/freeipa/issue/2018[#2018] (https://bugzilla.redhat.com/show_bug.cgi?id=1703564[rhbz#1703564]) Change hostname length limit to 64 * https://pagure.io/freeipa/issue/2445[#2445] (https://bugzilla.redhat.com/show_bug.cgi?id=798359[rhbz#798359]) [RFE] IdM password policy should include checks for repeating characters * https://pagure.io/freeipa/issue/3473[#3473] Switch to using RESTful interface in dogtag CA interface * https://pagure.io/freeipa/issue/3687[#3687] (https://bugzilla.redhat.com/show_bug.cgi?id=913799[rhbz#913799]) [RFE] IPA user account expiry warning. * https://pagure.io/freeipa/issue/3827[#3827] [RFE] Expose TTL in web UI * https://pagure.io/freeipa/issue/3999[#3999] (https://bugzilla.redhat.com/show_bug.cgi?id=837604[rhbz#837604]) [RFE] Fix and Document how to set up Samba File Server with IPA * https://pagure.io/freeipa/issue/4751[#4751] (https://bugzilla.redhat.com/show_bug.cgi?id=1851835[rhbz#1851835]) Implement ACME certificate enrolment * https://pagure.io/freeipa/issue/4972[#4972] (https://bugzilla.redhat.com/show_bug.cgi?id=1206690[rhbz#1206690]) check for existence of private group is done even if UPG definition is disabled * https://pagure.io/freeipa/issue/5011[#5011] (https://bugzilla.redhat.com/show_bug.cgi?id=1527185[rhbz#1527185]) [RFE] Forward CA requests to dogtag or helper by GSSAPI * https://pagure.io/freeipa/issue/5062[#5062] (https://bugzilla.redhat.com/show_bug.cgi?id=1229657[rhbz#1229657]) [WebUI] Unlock option is enabled for all user. * https://pagure.io/freeipa/issue/5566[#5566] Permit creation of PTR records in non-.arpa master zones via the DNS UI * https://pagure.io/freeipa/issue/5608[#5608] (https://bugzilla.redhat.com/show_bug.cgi?id=1405935[rhbz#1405935]) [RFE] Add Dogtag configuration extensions * https://pagure.io/freeipa/issue/5628[#5628] webui: Unclear(UX) purpose of OTP field in password reset form on login * https://pagure.io/freeipa/issue/5662[#5662] (https://bugzilla.redhat.com/show_bug.cgi?id=1404770[rhbz#1404770]) ID Views: do not allow custom Views for the masters * https://pagure.io/freeipa/issue/5879[#5879] (https://bugzilla.redhat.com/show_bug.cgi?id=1334619[rhbz#1334619]) Attempt to fix capitalization fails with ipa: ERROR: Type or value exists: * https://pagure.io/freeipa/issue/5914[#5914] (https://bugzilla.redhat.com/show_bug.cgi?id=1298288[rhbz#1298288]) invalid setting of DS lock table size * https://pagure.io/freeipa/issue/5948[#5948] (https://bugzilla.redhat.com/show_bug.cgi?id=1340463[rhbz#1340463]) [RFE] Implement pam_pwquality featureset in IPA password policies * https://pagure.io/freeipa/issue/6115[#6115] (https://bugzilla.redhat.com/show_bug.cgi?id=1357495[rhbz#1357495]) ipa command provides stack trace when provided with single hypen commands * https://pagure.io/freeipa/issue/6210[#6210] (https://bugzilla.redhat.com/show_bug.cgi?id=1364139[rhbz#1364139], https://bugzilla.redhat.com/show_bug.cgi?id=1751951[rhbz#1751951]) When master's IP address does not resolve to its name, ipa-replica-install fails * https://pagure.io/freeipa/issue/6423[#6423] Validate cert requests in Dogtag * https://pagure.io/freeipa/issue/6474[#6474] Remove ipaplatform dependency from ipa modules * https://pagure.io/freeipa/issue/6708[#6708] Unused config options * https://pagure.io/freeipa/issue/6783[#6783] (https://bugzilla.redhat.com/show_bug.cgi?id=1430365[rhbz#1430365]) [RFE] Host-group names command rename * https://pagure.io/freeipa/issue/6843[#6843] (https://bugzilla.redhat.com/show_bug.cgi?id=1428690[rhbz#1428690]) ipa-backup does not create log file at /var/log/ * https://pagure.io/freeipa/issue/6857[#6857] ipa_pwd.c: Use OpenSSL instead of NSS for hashing * https://pagure.io/freeipa/issue/6884[#6884] (https://bugzilla.redhat.com/show_bug.cgi?id=1441262[rhbz#1441262]) ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group * https://pagure.io/freeipa/issue/6891[#6891] (https://bugzilla.redhat.com/show_bug.cgi?id=1461914[rhbz#1461914]) Move FreeIPA SELinux policy from system policy to project policy * https://pagure.io/freeipa/issue/6951[#6951] (https://bugzilla.redhat.com/show_bug.cgi?id=1449133[rhbz#1449133]) Update samba config file and use sss idmap module * https://pagure.io/freeipa/issue/6964[#6964] (https://bugzilla.redhat.com/show_bug.cgi?id=1442413[rhbz#1442413]) IPA password policy has no password difference checking * https://pagure.io/freeipa/issue/7125[#7125] (https://bugzilla.redhat.com/show_bug.cgi?id=1480102[rhbz#1480102]) ipa-server-upgrade failes with "This entry already exists" * https://pagure.io/freeipa/issue/7137[#7137] (https://bugzilla.redhat.com/show_bug.cgi?id=1484088[rhbz#1484088]) [RFE]: Able to browse different links from IPA web gui in new tabs * https://pagure.io/freeipa/issue/7181[#7181] (https://bugzilla.redhat.com/show_bug.cgi?id=1545755[rhbz#1545755]) ipa-replica-prepare fails for 2nd replica when passwordHistory is enabled * https://pagure.io/freeipa/issue/7188[#7188] Issues after promoting one CA-less IPA server to CA-full * https://pagure.io/freeipa/issue/7255[#7255] baseidoverride.get_dn() does not default to a default ID view when resolving user IDs * https://pagure.io/freeipa/issue/7305[#7305] (https://bugzilla.redhat.com/show_bug.cgi?id=1518153[rhbz#1518153]) PKINIT status not displayed in the web UI (IPA Server > Configuration) * https://pagure.io/freeipa/issue/7307[#7307] (https://bugzilla.redhat.com/show_bug.cgi?id=1518939[rhbz#1518939]) RFE: Extend IPA to support unadvertised replicas * https://pagure.io/freeipa/issue/7323[#7323] IPv6 hack for Travis CI * https://pagure.io/freeipa/issue/7329[#7329] update_ra_cert_store does not remove private key from NSSDB * https://pagure.io/freeipa/issue/7416[#7416] Uninstalling IPA requires on being in a existent working directory * https://pagure.io/freeipa/issue/7522[#7522] Disable cert publishing in dogtag * https://pagure.io/freeipa/issue/7534[#7534] (https://bugzilla.redhat.com/show_bug.cgi?id=1569011[rhbz#1569011]) Investigate failures to restore 389-ds attriubtes on upgrade failure * https://pagure.io/freeipa/issue/7548[#7548] Need integration test for --external-ca-type=ms-cs * https://pagure.io/freeipa/issue/7566[#7566] (https://bugzilla.redhat.com/show_bug.cgi?id=1591824[rhbz#1591824]) Installation of replica against a specific master * https://pagure.io/freeipa/issue/7577[#7577] (https://bugzilla.redhat.com/show_bug.cgi?id=1579296[rhbz#1579296]) [RFE] DNS package check should be called earlier in installation routine * https://pagure.io/freeipa/issue/7597[#7597] (https://bugzilla.redhat.com/show_bug.cgi?id=1583950[rhbz#1583950]) IPA: IDM drops all custom attributes when moving account from preserved to stage * https://pagure.io/freeipa/issue/7600[#7600] (https://bugzilla.redhat.com/show_bug.cgi?id=1585020[rhbz#1585020]) Enable compat tree to provide information about AD users and groups on trust agents * https://pagure.io/freeipa/issue/7610[#7610] ldapupdate.py users ldap.LOCAL_ERROR and other direct ldap exceptions while relying on ipaldap * https://pagure.io/freeipa/issue/7630[#7630] (https://bugzilla.redhat.com/show_bug.cgi?id=1613015[rhbz#1613015]) ipa-restore should check that optional feature packages are installed before restoring a backup using a feature * https://pagure.io/freeipa/issue/7677[#7677] HSM: ipa ca-add fails with error in ipa-pki-retrieve-key * https://pagure.io/freeipa/issue/7695[#7695] (https://bugzilla.redhat.com/show_bug.cgi?id=1623763[rhbz#1623763]) ipa service-del should display principal name instead of Invalid 'principal'. * https://pagure.io/freeipa/issue/7725[#7725] (https://bugzilla.redhat.com/show_bug.cgi?id=1636765[rhbz#1636765]) ipa-restore set wrong file permissions and ownership for /var/log/dirsrv/slapd- directory * https://pagure.io/freeipa/issue/7804[#7804] (https://bugzilla.redhat.com/show_bug.cgi?id=1777811[rhbz#1777811]) `ipa otptoken-sync` fails with stack trace * https://pagure.io/freeipa/issue/7810[#7810] [F28] Require NSS with fix for p11-kit issue. * https://pagure.io/freeipa/issue/7816[#7816] (https://bugzilla.redhat.com/show_bug.cgi?id=1642395[rhbz#1642395]) [WebUI] not able to set a password for user as Active Directory Administrator user * https://pagure.io/freeipa/issue/7870[#7870] (https://bugzilla.redhat.com/show_bug.cgi?id=1680039[rhbz#1680039]) [certmonger][upgrade] "Failed to get request: bus, object_path and dbus_interface must not be None." * https://pagure.io/freeipa/issue/7895[#7895] (https://bugzilla.redhat.com/show_bug.cgi?id=1686302[rhbz#1686302]) ipa trust fetch-domains, server parameter ignored * https://pagure.io/freeipa/issue/7902[#7902] 389-ds-base-1.4.0.22-1 breaks TestAutomemberFindOrphans.test_find_orphan_automember_rules * https://pagure.io/freeipa/issue/7908[#7908] Write tests for interactive prompt for NTP options. * https://pagure.io/freeipa/issue/7929[#7929] (https://bugzilla.redhat.com/show_bug.cgi?id=1712794[rhbz#1712794]) ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled * https://pagure.io/freeipa/issue/7932[#7932] FreeIPA queries rely on missing attribute altsecurityidentities * https://pagure.io/freeipa/issue/7933[#7933] FreeIPA must index certmap attributes. * https://pagure.io/freeipa/issue/7938[#7938] 'ipa dnszone-show/find' should display "Dynamic Update" and "Bind update policy" by default * https://pagure.io/freeipa/issue/7949[#7949] test_integration/test_nfs.py fails at cleanup * https://pagure.io/freeipa/issue/7958[#7958] (https://bugzilla.redhat.com/show_bug.cgi?id=1782169[rhbz#1782169]) traceback in idview * https://pagure.io/freeipa/issue/7961[#7961] [WebUI] Identity Manager WebUI requires you to save changes after changing specifications before making other change * https://pagure.io/freeipa/issue/7966[#7966] Add support for JSON-RPC in ipa-join * https://pagure.io/freeipa/issue/7971[#7971] (https://bugzilla.redhat.com/show_bug.cgi?id=1715961[rhbz#1715961]) [RFE] Include hint for replication_wait_timeout if timeout fails * https://pagure.io/freeipa/issue/7985[#7985] test failure in test_dnssec.py::TestInstallDNSSECLast::()::test_disable_reenable_signing_replica::teardown * https://pagure.io/freeipa/issue/7987[#7987] Python shebang: Use isolated mode * https://pagure.io/freeipa/issue/7989[#7989] Pytest4.2+ errors * https://pagure.io/freeipa/issue/7991[#7991] Use profile-based renewal for system certificates * https://pagure.io/freeipa/issue/7995[#7995] (https://bugzilla.redhat.com/show_bug.cgi?id=1711172[rhbz#1711172]) Removing TLSv1.0, TLSv1.1 from nss.conf * https://pagure.io/freeipa/issue/7996[#7996] `test_selinuxusermap_plugin` fails against not default SELinux settings * https://pagure.io/freeipa/issue/8001[#8001] Need default authentication indicators for SPAKE, PKINIT and encrypted challenge preauth * https://pagure.io/freeipa/issue/8004[#8004] RHEL 8 uses nis-domainname instead of rhel-domainname * https://pagure.io/freeipa/issue/8005[#8005] (https://bugzilla.redhat.com/show_bug.cgi?id=1729099[rhbz#1729099]) User field separator uses '$$' within ipaSELinuxUserMapOrder * https://pagure.io/freeipa/issue/8007[#8007] Not stable nodeids within pytest * https://pagure.io/freeipa/issue/8008[#8008] Azure Pipeline slicing * https://pagure.io/freeipa/issue/8009[#8009] Missing execution bit on `ipa-run-tests` within virtualenv * https://pagure.io/freeipa/issue/8010[#8010] Extended Kerberos Ticket Policy * https://pagure.io/freeipa/issue/8012[#8012] test_webui/test_loginscreen.py::TestLoginScreen::()::test_reset_password_and_login_view failure * https://pagure.io/freeipa/issue/8013[#8013] (https://bugzilla.redhat.com/show_bug.cgi?id=1731433[rhbz#1731433]) ipa service-find does not list cifs service created by ipa-client-samba * https://pagure.io/freeipa/issue/8015[#8015] p11helper: insufficient logging when loading LIBSOFTHSM2_SO * https://pagure.io/freeipa/issue/8017[#8017] (https://bugzilla.redhat.com/show_bug.cgi?id=1817927[rhbz#1817927]) host-add --password logs cleartext userpassword to Apache error log * https://pagure.io/freeipa/issue/8019[#8019] (https://bugzilla.redhat.com/show_bug.cgi?id=1732524[rhbz#1732524]) repeated uninstallation of ipa-client-samba crashes * https://pagure.io/freeipa/issue/8020[#8020] support AES in LWCA key replication * https://pagure.io/freeipa/issue/8021[#8021] (https://bugzilla.redhat.com/show_bug.cgi?id=1732528[rhbz#1732528]) ipa-client-samba can not install samba after uninstallation * https://pagure.io/freeipa/issue/8022[#8022] azure pipeline: fail if dnf builddep exits on failure * https://pagure.io/freeipa/issue/8024[#8024] [WebUI] test_webui/test_trust.py failed because of request timeout * https://pagure.io/freeipa/issue/8026[#8026] Update pr-ci definitions with master_3client topology * https://pagure.io/freeipa/issue/8027[#8027] test_nfs.py: migrate to master_3client * https://pagure.io/freeipa/issue/8029[#8029] (https://bugzilla.redhat.com/show_bug.cgi?id=1749788[rhbz#1749788]) ipa host-find --pkey-only includes SSH keys in output * https://pagure.io/freeipa/issue/8030[#8030] azure pipelines fail at "Install prerequisites" of Tox job * https://pagure.io/freeipa/issue/8031[#8031] (https://bugzilla.redhat.com/show_bug.cgi?id=1734369[rhbz#1734369]) HBAC Test Validation error when running the HBAC test the second time round via the IPA Web GUI * https://pagure.io/freeipa/issue/8034[#8034] Existing p11-kit config file is not restored on uninstall * https://pagure.io/freeipa/issue/8038[#8038] (https://bugzilla.redhat.com/show_bug.cgi?id=1740167[rhbz#1740167]) ipa-client-automount --uninstall is not restoring nsswitch.conf * https://pagure.io/freeipa/issue/8040[#8040] (https://bugzilla.redhat.com/show_bug.cgi?id=1731963[rhbz#1731963]) ipa migrate-ds fails with internal error. * https://pagure.io/freeipa/issue/8044[#8044] (https://bugzilla.redhat.com/show_bug.cgi?id=1717008[rhbz#1717008]) Extdom plugin should not return LDAP_NO_SUCH_OBJECT if there are timeout or other errors * https://pagure.io/freeipa/issue/8048[#8048] Travis-CI sometimes fails at dnf * https://pagure.io/freeipa/issue/8052[#8052] test failure in test_integration/test_sudo.py::TestSudo::()::test_domain_resolution_order on fedora29 * https://pagure.io/freeipa/issue/8053[#8053] [WebUI] Fix login screen loading issue in test_loginscreen * https://pagure.io/freeipa/issue/8054[#8054] (https://bugzilla.redhat.com/show_bug.cgi?id=1746557[rhbz#1746557]) ipa-client-install calls "authselect select sssd --force" at uninstall time before restoring user-nsswitch.conf * https://pagure.io/freeipa/issue/8055[#8055] Test for PG6843: ipa-backup does not create log file at /var/log is failing * https://pagure.io/freeipa/issue/8056[#8056] (https://bugzilla.redhat.com/show_bug.cgi?id=1746882[rhbz#1746882]) BuildRequires is not compatible with %\{_libdir} * https://pagure.io/freeipa/issue/8057[#8057] (https://bugzilla.redhat.com/show_bug.cgi?id=1747895[rhbz#1747895]) Running ipa-server-install produces SyntaxWarning: "is not" with a literal. Did you mean "!="? * https://pagure.io/freeipa/issue/8062[#8062] Re-add configure_nsswitch_database, configure_nsswitch, ... to ipaclient.install * https://pagure.io/freeipa/issue/8063[#8063] Nightly test failure in test_integration/test_nfs.py::TestIpaClientAutomountFileRestore::()::test_nsswitch_backup_restore_sssd * https://pagure.io/freeipa/issue/8064[#8064] Request for IPA CI to enable DS audit/auditfail logging * https://pagure.io/freeipa/issue/8066[#8066] (https://bugzilla.redhat.com/show_bug.cgi?id=1750242[rhbz#1750242]) Don't use -t option to klist in adtrust code when timestamp is not needed * https://pagure.io/freeipa/issue/8067[#8067] (https://bugzilla.redhat.com/show_bug.cgi?id=1750700[rhbz#1750700]) add default access control configuration to trusted domain objects * https://pagure.io/freeipa/issue/8070[#8070] Test failure in test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion::()::test_hidden_replica_install * https://pagure.io/freeipa/issue/8073[#8073] Backup/restore does not restore /etc/pkcs11/modules/softhsm2.module * https://pagure.io/freeipa/issue/8075[#8075] Don't create log file for helper scripts * https://pagure.io/freeipa/issue/8077[#8077] New pylint 2.4.0 errors * https://pagure.io/freeipa/issue/8079[#8079] (https://bugzilla.redhat.com/show_bug.cgi?id=1754530[rhbz#1754530]) [Security] By default, DNS recursion is open, breaking best practices * https://pagure.io/freeipa/issue/8082[#8082] (https://bugzilla.redhat.com/show_bug.cgi?id=1756432[rhbz#1756432]) Default client configuration breaks ssh in FIPS mode. * https://pagure.io/freeipa/issue/8084[#8084] (https://bugzilla.redhat.com/show_bug.cgi?id=1758406[rhbz#1758406]) KRA authentication fails when IPA CA has custom Subject DN * https://pagure.io/freeipa/issue/8086[#8086] (https://bugzilla.redhat.com/show_bug.cgi?id=1756568[rhbz#1756568]) ipa-server-certinstall man page does not match built-in help. * https://pagure.io/freeipa/issue/8094[#8094] Allow using of a custom OpenSSL engine for ISC BIND * https://pagure.io/freeipa/issue/8097[#8097] ipa user-add-certmapdata is not able to add several entries correctly * https://pagure.io/freeipa/issue/8098[#8098] Host principals lack ACI to look up DNS objects in LDAP * https://pagure.io/freeipa/issue/8099[#8099] (https://bugzilla.redhat.com/show_bug.cgi?id=1762317[rhbz#1762317]) ipa-backup command is failing on rhel-7.8 * https://pagure.io/freeipa/issue/8101[#8101] Wrong pytest requirement in specfile * https://pagure.io/freeipa/issue/8102[#8102] Pylint 2.4.3 + Astroid 2.3.2 errors * https://pagure.io/freeipa/issue/8104[#8104] RFE: Disable Stale/Inactive Users - Upstream Design Document * https://pagure.io/freeipa/issue/8105[#8105] (https://bugzilla.redhat.com/show_bug.cgi?id=1759281[rhbz#1759281]) getcert with -F option returns before cacert file is created * https://pagure.io/freeipa/issue/8106[#8106] ca-certificate file not being parsed correctly on Ubuntu with p11-kit-trust.so due to data inserted by FreeIPA Client install * https://pagure.io/freeipa/issue/8110[#8110] (https://bugzilla.redhat.com/show_bug.cgi?id=1768015[rhbz#1768015]) Enable AES SHA 256 and 384 Kerberos enctypes * https://pagure.io/freeipa/issue/8111[#8111] (https://bugzilla.redhat.com/show_bug.cgi?id=1768959[rhbz#1768959]) [FIPS] Don't add camellia KRB5 encsalttypes in FIPS mode * https://pagure.io/freeipa/issue/8113[#8113] (https://bugzilla.redhat.com/show_bug.cgi?id=1755535[rhbz#1755535]) ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client * https://pagure.io/freeipa/issue/8114[#8114] [RFE] Delegate group membership management * https://pagure.io/freeipa/issue/8115[#8115] Nightly test failure in fedora-30/test_smb and fedora-29/test_smb * https://pagure.io/freeipa/issue/8116[#8116] Pylint parallel execution with custom plugin * https://pagure.io/freeipa/issue/8118[#8118] Run smoke tests in FIPS mode * https://pagure.io/freeipa/issue/8120[#8120] (https://bugzilla.redhat.com/show_bug.cgi?id=1769791[rhbz#1769791]) Invisible part of notification area in Web UI intercepts clicks of some page elements * https://pagure.io/freeipa/issue/8122[#8122] (https://bugzilla.redhat.com/show_bug.cgi?id=1773528[rhbz#1773528]) group-add-member-manager does not report errors * https://pagure.io/freeipa/issue/8123[#8123] (https://bugzilla.redhat.com/show_bug.cgi?id=1773528[rhbz#1773528]) [WebUI] Finish group membership management UI * https://pagure.io/freeipa/issue/8124[#8124] Add option to ipa-cacert-manage to delete certificates * https://pagure.io/freeipa/issue/8125[#8125] (https://bugzilla.redhat.com/show_bug.cgi?id=1777809[rhbz#1777809]) Use default crypto policy for TLS and enable TLS 1.3 support * https://pagure.io/freeipa/issue/8129[#8129] Tests: Replace paramiko with OpenSSH * https://pagure.io/freeipa/issue/8131[#8131] (https://bugzilla.redhat.com/show_bug.cgi?id=1777920[rhbz#1777920]) covscan memory leaks report * https://pagure.io/freeipa/issue/8133[#8133] check_client_configuration() no longer works with IPA_CONFDIR * https://pagure.io/freeipa/issue/8134[#8134] ipa user-add is inefficient * https://pagure.io/freeipa/issue/8135[#8135] (https://bugzilla.redhat.com/show_bug.cgi?id=1777806[rhbz#1777806]) When Service weight is set as 0 for server in IPA location "IPA Error 903: InternalError" is displayed * https://pagure.io/freeipa/issue/8137[#8137] reinstall failed in adding delegation layout * https://pagure.io/freeipa/issue/8138[#8138] (https://bugzilla.redhat.com/show_bug.cgi?id=1780548[rhbz#1780548]) Man page ipa-cacert-manage does not display correctly on RHEL * https://pagure.io/freeipa/issue/8142[#8142] check Not Before / Not After in externally signed CA sanity check * https://pagure.io/freeipa/issue/8143[#8143] service.ldap_disable() does not remove "enabledService" * https://pagure.io/freeipa/issue/8144[#8144] test_nfs.py: umount.nfs4: /home: device is busy * https://pagure.io/freeipa/issue/8148[#8148] (https://bugzilla.redhat.com/show_bug.cgi?id=1782587[rhbz#1782587]) add "systemctl restart sssd" to warning message when adding trust agents to replicas * https://pagure.io/freeipa/issue/8149[#8149] (https://bugzilla.redhat.com/show_bug.cgi?id=1783046[rhbz#1783046]) SIDs of AD domains do not display in ipa-client-samba installer * https://pagure.io/freeipa/issue/8150[#8150] (https://bugzilla.redhat.com/show_bug.cgi?id=1784003[rhbz#1784003]) IPA Server install fail * https://pagure.io/freeipa/issue/8151[#8151] test_commands timing-out * https://pagure.io/freeipa/issue/8153[#8153] (https://bugzilla.redhat.com/show_bug.cgi?id=1784761[rhbz#1784761]) Kerberos ticket policy reset does not reset per-indicator policies * https://pagure.io/freeipa/issue/8157[#8157] NIghtly test failure in fedora-rawhide/test_webui_network * https://pagure.io/freeipa/issue/8159[#8159] please migrate to the new Fedora translation platform * https://pagure.io/freeipa/issue/8163[#8163] (https://bugzilla.redhat.com/show_bug.cgi?id=1782572[rhbz#1782572]) "Internal Server Error" reported for minor issues implies IPA is broken [IdmHackfest2019] * https://pagure.io/freeipa/issue/8164[#8164] (https://bugzilla.redhat.com/show_bug.cgi?id=1788907[rhbz#1788907]) Renewed certs are not picked up by IPA CAs * https://pagure.io/freeipa/issue/8169[#8169] NIghtly test failure in fedora-rawhide/test_webui_policy * https://pagure.io/freeipa/issue/8170[#8170] Nightly test failure in fedora-rawhide/test_backup_and_restore_TestBackupReinstallRestoreWithDNS * https://pagure.io/freeipa/issue/8173[#8173] Broken -k argument parsing in ipa-run-tests 4.8.4-1 package * https://pagure.io/freeipa/issue/8176[#8176] External CA is tracked for renewals and replaced with a self-signed certificate * https://pagure.io/freeipa/issue/8179[#8179] Tests broken with python version < 3.7 (module 're' has no attribute 'Pattern') * https://pagure.io/freeipa/issue/8186[#8186] Add ipa-ca.$DOMAIN alias to IPA server HTTP certificates * https://pagure.io/freeipa/issue/8189[#8189] (https://bugzilla.redhat.com/show_bug.cgi?id=1810179[rhbz#1810179]) NIghtly test failure in test_integration/test_nfs.py::TestIpaClientAutomountFileRestore::test_nsswitch_backup_restore_sssd * https://pagure.io/freeipa/issue/8190[#8190] (https://bugzilla.redhat.com/show_bug.cgi?id=1790886[rhbz#1790886]) ipa-client-automount fails after repeated installation/uninstallation * https://pagure.io/freeipa/issue/8192[#8192] (https://bugzilla.redhat.com/show_bug.cgi?id=1665051[rhbz#1665051]) ipa-adtrust-install does not list service records for manual addition to DNS zone * https://pagure.io/freeipa/issue/8193[#8193] (https://bugzilla.redhat.com/show_bug.cgi?id=1801791[rhbz#1801791]) Re-order 50-externalmembers.update to be after 80-schema_compat.update * https://pagure.io/freeipa/issue/8196[#8196] API: dnsrecord_del failure with empty list aaaarecord * https://pagure.io/freeipa/issue/8200[#8200] (https://bugzilla.redhat.com/show_bug.cgi?id=1803786[rhbz#1803786]) ipa krb5kdc db: krb5kdc coredump * https://pagure.io/freeipa/issue/8201[#8201] update ssbrowser.html * https://pagure.io/freeipa/issue/8202[#8202] Azure: add support for multi-container tests * https://pagure.io/freeipa/issue/8204[#8204] (https://bugzilla.redhat.com/show_bug.cgi?id=1810148[rhbz#1810148]) ipa-server-certinstall -> certmonger add_subject template-subject dbus 'unable to set arguments' a\{sv} * https://pagure.io/freeipa/issue/8207[#8207] Extend Web UI for Kerberos ticket policy to add authentication indicator support * https://pagure.io/freeipa/issue/8214[#8214] Support for opendnssec 2.1.6 * https://pagure.io/freeipa/issue/8217[#8217] (https://bugzilla.redhat.com/show_bug.cgi?id=1810154[rhbz#1810154]) RFE: ipa-backup should compare locally and globally installed server roles * https://pagure.io/freeipa/issue/8219[#8219] ipatests: unify editing of sssd.conf * https://pagure.io/freeipa/issue/8221[#8221] (https://bugzilla.redhat.com/show_bug.cgi?id=1812169[rhbz#1812169]) Secure AJP connector between Dogtag and Apache proxy * https://pagure.io/freeipa/issue/8222[#8222] Upgrade dojo.js * https://pagure.io/freeipa/issue/8226[#8226] (https://bugzilla.redhat.com/show_bug.cgi?id=1813330[rhbz#1813330]) ipa-restore does not restart httpd * https://pagure.io/freeipa/issue/8228[#8228] Nightly failure in backup/restore while calling 'id admin' * https://pagure.io/freeipa/issue/8233[#8233] 4.8.5 master Installation error * https://pagure.io/freeipa/issue/8236[#8236] (https://bugzilla.redhat.com/show_bug.cgi?id=1809835[rhbz#1809835]) Enforce a check to prevent adding objects from IPA as external members of external groups * https://pagure.io/freeipa/issue/8239[#8239] Actualize Bootstrap version * https://pagure.io/freeipa/issue/8240[#8240] (https://bugzilla.redhat.com/show_bug.cgi?id=1816784[rhbz#1816784]) KRA install fails if all KRA members are Hidden Replicas * https://pagure.io/freeipa/issue/8241[#8241] Build fails on Fedora 30 * https://pagure.io/freeipa/issue/8247[#8247] test_fips PR-CI templates have a too-short timeout * https://pagure.io/freeipa/issue/8248[#8248] httpd ccaches created during server upgrade aren't cleaned up on uninstall/install * https://pagure.io/freeipa/issue/8251[#8251] [Azure] Catch coredumps * https://pagure.io/freeipa/issue/8254[#8254] [Azure] 'Tox' task fails against Python3.8 * https://pagure.io/freeipa/issue/8261[#8261] [ipatests] Integration tests fail on non-firewalld distros * https://pagure.io/freeipa/issue/8262[#8262] test_ipahealthcheck needs a higher timeout than 3600 * https://pagure.io/freeipa/issue/8264[#8264] Nightly test failure in test_integration.test_commands.TestIPACommand.test_hbac_systemd_user * https://pagure.io/freeipa/issue/8265[#8265] [ipatests] `/var/log/ipaupgrade.log` is not collected * https://pagure.io/freeipa/issue/8266[#8266] test_webui_server requires a higher timeout than 3600 * https://pagure.io/freeipa/issue/8268[#8268] Prevent use of too long passwords * https://pagure.io/freeipa/issue/8272[#8272] Use /run instead of /var/run * https://pagure.io/freeipa/issue/8273[#8273] (https://bugzilla.redhat.com/show_bug.cgi?id=1834385[rhbz#1834385]) Man page syntax issue detected by rpminspect * https://pagure.io/freeipa/issue/8275[#8275] (https://bugzilla.redhat.com/show_bug.cgi?id=1880628[rhbz#1880628]) Support systemd-resolved * https://pagure.io/freeipa/issue/8276[#8276] Add default password policy for sysaccounts * https://pagure.io/freeipa/issue/8283[#8283] Failures and AVCs with OpenDNSSEC 2.1 * https://pagure.io/freeipa/issue/8284[#8284] Upgrade jQuery version to actual one * https://pagure.io/freeipa/issue/8287[#8287] named not starting after #8079, ipa-ext.conf breaks bind * https://pagure.io/freeipa/issue/8289[#8289] ipa servicedelegationtarget-add-member does not allow to add hosts as targets * https://pagure.io/freeipa/issue/8290[#8290] API inconsistencies * https://pagure.io/freeipa/issue/8291[#8291] krb5kdc crashes in IPA plugin on use of IPA Windows principal alias * https://pagure.io/freeipa/issue/8297[#8297] Fix new pylint 2.5.0 warnings and errors * https://pagure.io/freeipa/issue/8298[#8298] [WebUI] Cover membership management with UI tests * https://pagure.io/freeipa/issue/8300[#8300] Replace uglify-js with python3-rjsmin * https://pagure.io/freeipa/issue/8301[#8301] The value of the first character in target* keywords is expected to be a double quote * https://pagure.io/freeipa/issue/8304[#8304] [fed32] client-install does not properly set ChallengeResponseAuthentication yes in sshd conf * https://pagure.io/freeipa/issue/8306[#8306] Adopt Black code style * https://pagure.io/freeipa/issue/8307[#8307] make devcheck fails for test_ipatests_plugins/test_ipa_run_tests.py * https://pagure.io/freeipa/issue/8308[#8308] (https://bugzilla.redhat.com/show_bug.cgi?id=1829787[rhbz#1829787]) ipa service-del deletes the required principal when specified in lower/upper case * https://pagure.io/freeipa/issue/8309[#8309] Convert ipaplatform from namespace package to regular package * https://pagure.io/freeipa/issue/8311[#8311] (https://bugzilla.redhat.com/show_bug.cgi?id=1825829[rhbz#1825829]) ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3 * https://pagure.io/freeipa/issue/8312[#8312] Fix api.env.in_tree detection logic * https://pagure.io/freeipa/issue/8313[#8313] Values of api.env.mode are inconsistent * https://pagure.io/freeipa/issue/8315[#8315] (https://bugzilla.redhat.com/show_bug.cgi?id=1833266[rhbz#1833266]) [dirsrv] set 'nsslapd-enable-upgrade-hash: off' as this raises warnings * https://pagure.io/freeipa/issue/8316[#8316] [Azure] Whitelist clock_adjtime syscall * https://pagure.io/freeipa/issue/8317[#8317] XML-RCP and CLI tests depend on internal --force option * https://pagure.io/freeipa/issue/8319[#8319] Support server referrals for enterprise principals * https://pagure.io/freeipa/issue/8322[#8322] [RFE] Changing default hostgroup is too easy * https://pagure.io/freeipa/issue/8323[#8323] [Build failure] Race: make po fails on parallel build * https://pagure.io/freeipa/issue/8325[#8325] [WebUI] Fix htmlPrefilter issue in jQuery * https://pagure.io/freeipa/issue/8326[#8326] CVE-2020-10747 * https://pagure.io/freeipa/issue/8328[#8328] krbtpolicy-mod cannot handle two auth ind options of the same type at the same time * https://pagure.io/freeipa/issue/8330[#8330] [Azure] Build job fails on `tests` container preparation * https://pagure.io/freeipa/issue/8335[#8335] [WebUI] manage IPA resources as a user from a trusted Active Directory domain * https://pagure.io/freeipa/issue/8336[#8336] [WebUI] "User attributes for SMB services" section always shown * https://pagure.io/freeipa/issue/8338[#8338] [WebUI] Host detail with no assigned ID view makes invalid RPC call * https://pagure.io/freeipa/issue/8339[#8339] [WebUI] User details tab headers don't show member count when on settings tab * https://pagure.io/freeipa/issue/8344[#8344] Nightly test failure in test_smb.py::TestSMB::test_smb_service_s4u2self * https://pagure.io/freeipa/issue/8348[#8348] Allow managed permissions with ldap:///self bind rule * https://pagure.io/freeipa/issue/8349[#8349] bind-9.16 and dnssec-enable * https://pagure.io/freeipa/issue/8350[#8350] bind-9.16 and DLV * https://pagure.io/freeipa/issue/8352[#8352] RPC API crashes when a user is disabled while a session exists * https://pagure.io/freeipa/issue/8357[#8357] Allow managing IPA resources as a user from a trusted Active Directory forest * https://pagure.io/freeipa/issue/8358[#8358] TTL of DNS record can be set to negative value * https://pagure.io/freeipa/issue/8359[#8359] [WebUI] dnsrecord_mod results in JS error * https://pagure.io/freeipa/issue/8360[#8360] lite-server: Werkzeug deprecation warnings * https://pagure.io/freeipa/issue/8362[#8362] (https://bugzilla.redhat.com/show_bug.cgi?id=1826659[rhbz#1826659]) IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp * https://pagure.io/freeipa/issue/8363[#8363] DNS config upgrade code fails * https://pagure.io/freeipa/issue/8364[#8364] Nightly test failure while establishing trust: Cannot find specified domain or server name * https://pagure.io/freeipa/issue/8366[#8366] CA-less replica deployment fails with --setup-ca * https://pagure.io/freeipa/issue/8367[#8367] IPA-EPN fails to build in ONLY_CLIENT mode * https://pagure.io/freeipa/issue/8368[#8368] (https://bugzilla.redhat.com/show_bug.cgi?id=1846349[rhbz#1846349]) cannot issue certs with multiple IP addresses corresponding to different hosts * https://pagure.io/freeipa/issue/8369[#8369] cert_find returns "CA not configured" in CA-less install * https://pagure.io/freeipa/issue/8370[#8370] ipa-join does not set nshardwareplatform and nsosversion * https://pagure.io/freeipa/issue/8371[#8371] Nightly test failure [testing_master_testing] in test_integration/test_idviews.py::TestCertsInIDOverrides * https://pagure.io/freeipa/issue/8372[#8372] (https://bugzilla.redhat.com/show_bug.cgi?id=1849914[rhbz#1849914]) FreeIPA - Utilize 256-bit AJP connector passwords * https://pagure.io/freeipa/issue/8374[#8374] (https://bugzilla.redhat.com/show_bug.cgi?id=1847999[rhbz#1847999]) EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in freeipa-client-epn * https://pagure.io/freeipa/issue/8377[#8377] Nightly test failure (timeout) in test_caless_TestReplicaInstall * https://pagure.io/freeipa/issue/8378[#8378] CA validity past year 2038 breaks cert.py plugin on 32-bit platform * https://pagure.io/freeipa/issue/8379[#8379] Nightly test failure [testing_master_pki] while installing CA replica * https://pagure.io/freeipa/issue/8381[#8381] Nightly test failure in test_webui/test_loginscreen.py::TestLoginScreen::test_login_view * https://pagure.io/freeipa/issue/8383[#8383] Test with dnspython 2.0 * https://pagure.io/freeipa/issue/8384[#8384] Provide reliable way to know if a server installation is complete * https://pagure.io/freeipa/issue/8388[#8388] Make help() on plugins more useful * https://pagure.io/freeipa/issue/8391[#8391] Remove dnf workaround from test_epn.y * https://pagure.io/freeipa/issue/8394[#8394] Nightly test failure in cert-related tests * https://pagure.io/freeipa/issue/8395[#8395] selinux don't audit rules deny fetching trust topology * https://pagure.io/freeipa/issue/8396[#8396] [WebUI] Font type of "Enabled" column in user search facet wrong * https://pagure.io/freeipa/issue/8399[#8399] certmonger attempts to add LWCA tracking requests on non-CA server. * https://pagure.io/freeipa/issue/8400[#8400] sshd template file is installed in a wrong (server) location while used by the client side * https://pagure.io/freeipa/issue/8401[#8401] Create platform definitions for freeipa-container * https://pagure.io/freeipa/issue/8403[#8403] Add option to add ipaapi user as an allowed uid for ifp in /etc/sssd/sssd.conf when running ipa-replica-install * https://pagure.io/freeipa/issue/8404[#8404] Detect and fail if not enough memory is available for installation * https://pagure.io/freeipa/issue/8405[#8405] Don't delegate full TGT in ipa-join * https://pagure.io/freeipa/issue/8407[#8407] Support changelog integrated into main database * https://pagure.io/freeipa/issue/8408[#8408] Nightly test failure in test_integration/test_replica_promotion.py::TestUnprivilegedUserPermissions::test_client_enrollment_by_unprivileged_user * https://pagure.io/freeipa/issue/8412[#8412] (https://bugzilla.redhat.com/show_bug.cgi?id=1857157[rhbz#1857157]) AVC: httpd cannot connect to ipa-custodia.sock * https://pagure.io/freeipa/issue/8413[#8413] Nightly test failure in test_integration/test_replica_promotion.py::TestUnprivilegedUserPermissions::test_sssd_config_allows_ipaapi_access_to_ifp * https://pagure.io/freeipa/issue/8414[#8414] Nightly test failure in test_integration/test_replica_promotion.py::TestReplicaPromotionLevel1::test_sssd_config_allows_ipaapi_access_to_ifp * https://pagure.io/freeipa/issue/8416[#8416] [WebUI] Error while adding user ID overrides to group * https://pagure.io/freeipa/issue/8419[#8419] Azure is reporting a slew of new no-member lint errors * https://pagure.io/freeipa/issue/8425[#8425] Nightly test failure in test_cert.test_cert.TestInstallMasterClient (certmonger timeout) * https://pagure.io/freeipa/issue/8428[#8428] [ipatests] fails due to new python-cryptography 3.0 * https://pagure.io/freeipa/issue/8429[#8429] Add fips-mode-setup to ipaplatform.paths * https://pagure.io/freeipa/issue/8432[#8432] test failure in test_commands.py::TestIPACommand::test_login_wrong_password: AssertionError * https://pagure.io/freeipa/issue/8435[#8435] [ipatests] failures due to new Pytest6.0 (pypi part) * https://pagure.io/freeipa/issue/8437[#8437] unit tests for ipa-extdom-extop are failing in Fedora 33 * https://pagure.io/freeipa/issue/8439[#8439] Nightly test failure in test_integration/test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring * https://pagure.io/freeipa/issue/8440[#8440] (https://bugzilla.redhat.com/show_bug.cgi?id=1863616[rhbz#1863616]) CA-less install does not set required permissions on KDC certificate * https://pagure.io/freeipa/issue/8441[#8441] (https://bugzilla.redhat.com/show_bug.cgi?id=1870202[rhbz#1870202]) File permissions of /etc/ipa/ca.crt differ between CA-ful and CA-less * https://pagure.io/freeipa/issue/8442[#8442] [pylint] warnings/errors against pylint 2.5.3 * https://pagure.io/freeipa/issue/8443[#8443] ipa delegation-add can add permissions and attributes several times * https://pagure.io/freeipa/issue/8444[#8444] (https://bugzilla.redhat.com/show_bug.cgi?id=1866291[rhbz#1866291]) EPN: enhance input validation * https://pagure.io/freeipa/issue/8445[#8445] (https://bugzilla.redhat.com/show_bug.cgi?id=1863079[rhbz#1863079]) EPN: '[Errno 111] Connection refused' when the SMTP is down * https://pagure.io/freeipa/issue/8446[#8446] ipa dnszone-add ignores --name-from-ip option if name is given * https://pagure.io/freeipa/issue/8447[#8447] Nightly test failure in test_integration/test_ipahealthcheck/TestIpaHealthCheckWithoutDNS * https://pagure.io/freeipa/issue/8449[#8449] (https://bugzilla.redhat.com/show_bug.cgi?id=1866291[rhbz#1866291]) EPN: enhance CLI option tests * https://pagure.io/freeipa/issue/8456[#8456] Need new aci's for the new replication changelog entries * https://pagure.io/freeipa/issue/8458[#8458] auto-upgrade will never happen for existing installations * https://pagure.io/freeipa/issue/8459[#8459] [upgrade] handle missing openssh-clients * https://pagure.io/freeipa/issue/8461[#8461] [ALTLinux] server uninstall error on missing /var/lib/samba * https://pagure.io/freeipa/issue/8463[#8463] Nightly test failure in test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring * https://pagure.io/freeipa/issue/8464[#8464] Increase replication changelog trimming interval * https://pagure.io/freeipa/issue/8468[#8468] [pylint] new warnings on dev branch * https://pagure.io/freeipa/issue/8472[#8472] [tracker] Nightly test failure in test_ipahealthcheck.py::TestIpaHealthCheckWithExternalCA * https://pagure.io/freeipa/issue/8473[#8473] Nightly test failure in all webui tests: Invalid or corrupt jarfile /opt/selenium.jar * https://pagure.io/freeipa/issue/8474[#8474] Mozilla's NSS without DBM * https://pagure.io/freeipa/issue/8475[#8475] Azure: tox task and virtualenv 20+ * https://pagure.io/freeipa/issue/8481[#8481] Nightly test failure in rawhide in tasks.configure_dns_for_trust * https://pagure.io/freeipa/issue/8482[#8482] Nightly test failure in test_ipahealthcheck.py::TestIpaHealthCheck::test_source_ipahealthcheck_meta_services_check * https://pagure.io/freeipa/issue/8488[#8488] (https://bugzilla.redhat.com/show_bug.cgi?id=1868432[rhbz#1868432]) SELinux blocks custodia key replication / retrieval for sub-CAs * https://pagure.io/freeipa/issue/8490[#8490] (https://bugzilla.redhat.com/show_bug.cgi?id=1875001[rhbz#1875001]) It is not possible to edit KDC database when the FreeIPA server is running * https://pagure.io/freeipa/issue/8491[#8491] Unindexed searches in FreeIPA git master * https://pagure.io/freeipa/issue/8493[#8493] Synchronize index LDIF and index update files * https://pagure.io/freeipa/issue/8494[#8494] Azure Pipelines are broken due to docker compose tool upgrade * https://pagure.io/freeipa/issue/8496[#8496] [Tracker] Multiple nightly test failures in test_dnssec * https://pagure.io/freeipa/issue/8498[#8498] Check 3rd-party IPA server HTTP cert for ipa-ca.$DOMAIN dnsName on CA replicas * https://pagure.io/freeipa/issue/8501[#8501] Unify how FreeIPA gets FQDN of current host * https://pagure.io/freeipa/issue/8502[#8502] Don't create DirSRV SSCA * https://pagure.io/freeipa/issue/8503[#8503] (https://bugzilla.redhat.com/show_bug.cgi?id=1879604[rhbz#1879604]) pkispawn logs files are empty * https://pagure.io/freeipa/issue/8505[#8505] Nightly failure (fedora31) in test_integration/test_smb.py::TestSMB::test_smb_service_s4u2self * https://pagure.io/freeipa/issue/8507[#8507] [WebUI] Backport jQuery patches from newer versions of the library (e.g. 3.5.0) * https://pagure.io/freeipa/issue/8510[#8510] (https://bugzilla.redhat.com/show_bug.cgi?id=1881630[rhbz#1881630]) create_active_user and kinit_as_user should collect kdcinfo.REALM on failure * https://pagure.io/freeipa/issue/8511[#8511] The selinux subpackage does not have a requirement to match the server install * https://pagure.io/freeipa/issue/8512[#8512] Import of psutil can trigger SELinux violation * https://pagure.io/freeipa/issue/8513[#8513] (https://bugzilla.redhat.com/show_bug.cgi?id=1868432[rhbz#1868432]) SELinux module fails to load: Re-declaration of type node_t * https://pagure.io/freeipa/issue/8515[#8515] (https://bugzilla.redhat.com/show_bug.cgi?id=1882340[rhbz#1882340]) nsslapd-db-locks patching no longer works * https://pagure.io/freeipa/issue/8516[#8516] Nightly test failure (master) in ipa trust-add * https://pagure.io/freeipa/issue/8518[#8518] Upgrade F32 to F33 fails in DNS upgrade code * https://pagure.io/freeipa/issue/8519[#8519] Fedora container platform is incomplete * https://pagure.io/freeipa/issue/8521[#8521] Speed up ipa-server-install * https://pagure.io/freeipa/issue/8522[#8522] Remove cainstance.migrate_profiles_to_ldap() * https://pagure.io/freeipa/issue/8523[#8523] Topology Graph returns Runtime Error * https://pagure.io/freeipa/issue/8524[#8524] (https://bugzilla.redhat.com/show_bug.cgi?id=1851835[rhbz#1851835]) Deploy & manage the ACME service topology wide from a single system * https://pagure.io/freeipa/issue/8528[#8528] Use separate logs for AD Trust and DNS installer * https://pagure.io/freeipa/issue/8529[#8529] ipa-ca record incomplete when hostname is not in DNS * https://pagure.io/freeipa/issue/8530[#8530] (https://bugzilla.redhat.com/show_bug.cgi?id=1859185[rhbz#1859185]) Running ipa-server-install fails on machine where libsss_sudo is not installed * https://pagure.io/freeipa/issue/8533[#8533] Nightly failure in ipa-replica-install configuring renewals: DBusException: org.freedesktop.DBus.Error.NoReply * https://pagure.io/freeipa/issue/8535[#8535] (https://bugzilla.redhat.com/show_bug.cgi?id=1887928[rhbz#1887928]) RPM spec moves ssh server config to a snippet but does not ensure sshd_config includes the snippet * https://pagure.io/freeipa/issue/8536[#8536] RFE: ipatests: run healthcheck on hidden replica * https://pagure.io/freeipa/issue/8541[#8541] Nightly failure (fed33) in test_installation.py::TestInstallMaster::test_selinux_avcs * https://pagure.io/freeipa/issue/8551[#8551] (https://bugzilla.redhat.com/show_bug.cgi?id=1784657[rhbz#1784657]) Unlock user accounts after a password reset and replicate that unlock to all IdM servers * https://pagure.io/freeipa/issue/8554[#8554] (https://bugzilla.redhat.com/show_bug.cgi?id=1891056[rhbz#1891056]) ipa-kdb: support subordinate/superior UPN suffixes * https://pagure.io/freeipa/issue/8555[#8555] (https://bugzilla.redhat.com/show_bug.cgi?id=1340463[rhbz#1340463]) Nightly test failure in test_pwpolicy.py::test_pwpolicy::test_misc * https://pagure.io/freeipa/issue/8558[#8558] Create backend entry before creating mapping tree entry for ipaca backend * https://pagure.io/freeipa/issue/8559[#8559] Nightly test failure in test_trust.py::TestTrust::test_password_login_as_aduser * https://pagure.io/freeipa/issue/8560[#8560] Nightly test failure in test_ipahealthcheck.py::TestIpaHealthCheck::test_ipahealthcheck_ds_encryption * https://pagure.io/freeipa/issue/8563[#8563] Nightly test failure in test_ipahealthcheck.py::TestIpaHealthCheck::test_ipahealthcheck_ds_riplugincheck * https://pagure.io/freeipa/issue/8566[#8566] Subordinate suffixes aren't treated as subordinate in trust to Active Directory (crash part) * https://pagure.io/freeipa/issue/8567[#8567] (https://bugzilla.redhat.com/show_bug.cgi?id=1894800[rhbz#1894800]) IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing * https://pagure.io/freeipa/issue/8572[#8572] Nightly failure in test_acme.py::TestACMECALess::test_enable_caless_to_cafull_replica * https://pagure.io/freeipa/issue/8573[#8573] Nightly failure in test_ipahealthcheck.py::TestIpaHealthCheckWithoutDNS::test_ipa_dns_systemrecords_check * https://pagure.io/freeipa/issue/8578[#8578] EPN: SMTP client downgrade smtp_security from `starttls` to `none` * https://pagure.io/freeipa/issue/8579[#8579] EPN: SMTP client doesn't validate server certificate * https://pagure.io/freeipa/issue/8580[#8580] EPN: SMTP client authentication by certificate * https://pagure.io/freeipa/issue/8584[#8584] ACME communication with dogtag REST endpoints should be using the cookie it creates * https://pagure.io/freeipa/issue/8585[#8585] Compile warnings on rawhide -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

FreeIPA using external CA
by Anestis Karampatziakis 17 Nov '20

17 Nov '20

Hi all, For a project we want to use FreeIPA with external CA. We are using v4.6.6 on centos7.8. The guides instruct to use command” ipa-server-install --external-ca”, get the CSR and run the install command again using the signed certificate. Issue 1: key length is 2048 Fix: Found that this can be changed in file /usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py * Add under: # CA key algorithm # config.set("CA", "pki_ca_signing_key_size", 4096) Issue 2: Subject DN The subject on the certificate request is “CN=Certificate Authority,O=[realm]” but the root-ca requires us to have in the format: CN=FREEIPA 2020,serialNumber=XxXx,O=xxx,C=XX Q: Is it possible to install the FreeIPA server using the external root-ca and signed certificate from the beginning? Q: Is it possible to alter the information on the certificate request to match the root-ca’s requirements? Thanks, Anestis

1 0

Re: subsystemCert appears out of date
by Florence Blanc-Renaud 17 Nov '20

17 Nov '20

On 11/16/20 10:03 AM, Marc Pearson | i-Neda Ltd via FreeIPA-users wrote: > Hi All, > > My subsystem cert appears to have gone out of date, and Iâ€™m unable to > get it to update. This has become an issue on my production environment, > and my current work around has been to take the system date back by a > month. Iâ€™ve tried the cert renew tool, but this doesnâ€™t seem to have > updated this cert. > > Is anyone able to point me in the right direction to be able to update > this specific certificate as Iâ€™ve been unable to find anything online. > > [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert > cert-pki-ca' > > Certificate: > > Â Â Â Data: > > Â Â Â Â Â Â Â Version: 3 (0x2) > > Â Â Â Â Â Â Â Serial Number: 42 (0x2a) > > Â Â Â Â Â Â Â Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption > > Â Â Â Â Â Â Â Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" > > Â Â Â Â Â Â Â Validity: > > Â Â Â Â Â Â Â Â Â Â Â Not Before: Sun Nov 04 08:04:35 2018 > > Not After : Sat Oct 24 07:04:35 2020 > > Â Â Â Â Â Â Â Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" > > Â Â Â Â Â Â Â Subject Public Key Info: > > Â Â Â Â Â Â Â Â Â Â Â Public Key Algorithm: PKCS #1 RSA Encryption > > Â Â Â Â Â Â Â Â Â Â Â RSA Public Key: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Modulus: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Exponent: 65537 (0x10001) > > Â Â Â Â Â Â Â Signed Extensions: > > Â Â Â Â Â Â Â Â Â Â Â Name: Certificate Authority Key Identifier > > Â Â Â Â Â Â Â Â Â Â Â Key ID: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â d5:08:c0:3a > > Â Â Â Â Â Â Â Â Â Â Â Name: Authority Information Access > > Â Â Â Â Â Â Â Â Â Â Â Method: PKIX Online Certificate Status Protocol > > Â Â Â Â Â Â Â Â Â Â Â Location: > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" > > Â Â Â Â Â Â Â Â Â Â Â Name: Certificate Key Usage > > Â Â Â Â Â Â Â Â Â Â Â Critical: True > > Â Â Â Â Â Â Â Â Â Â Â Usages: Digital Signature > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Non-Repudiation > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Key Encipherment > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Data Encipherment > > Â Â Â Â Â Â Â Â Â Â Â Name: Extended Key Usage > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â TLS Web Server Authentication Certificate > > Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â TLS Web Client Authentication Certificate > > Â Â Â Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption > > Â Â Â Signature: > > Â Â Â Â Â Â Â 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: > > Â Â Â Â Â Â Â 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: > > Â Â Â Â Â Â Â 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: > > Â Â Â Â Â Â Â 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: > > Â Â Â Â Â Â Â e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: > > Â Â Â Â Â Â Â 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: > > Â Â Â Â Â Â Â cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: > > Â Â Â Â Â Â Â 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: > > Â Â Â Â Â Â Â 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: > > Â Â Â Â Â Â Â 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: > > Â Â Â Â Â Â Â ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: > > Â Â Â Â Â Â Â 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: > > Â Â Â Â Â Â Â 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: > > Â Â Â Â Â Â Â 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: > > Â Â Â Â Â Â Â c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: > > Â Â Â Â Â Â Â eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 > > Â Â Â Fingerprint (SHA-256): > > > 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1:15:13:92:D3:7A:3D:F8:54:44 > > Â Â Â Fingerprint (SHA1): > > Â Â Â Â Â Â Â 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 > > Â Â Â Mozilla-CA-Policy: false (attribute missing) > > Â Â Â Certificate Trust Flags: > > Â Â Â Â Â Â Â SSL Flags: > > Â Â Â Â Â Â Â Â Â Â Â User > > Â Â Â Â Â Â Â Email Flags: > > Â Â Â Â Â Â Â Â Â Â Â User > > Â Â Â Â Â Â Â Object Signing Flags: > > Â Â Â Â Â Â Â Â Â Â Â User > > Thanks for the help, > > Marc. > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Hi Marc, we need more information in order to help you: - do you have multiple master/replicas with the CA role: # kinit admin; ipa server-role-find --role "CA server" - which server is the renewal master: # kinit admin ; ipa config-show | grep "renewal" - which version is installed: # rpm -qa | grep ipa-server - Is the subsystemCert cert-pki-ca the only expired certificate: # getcert list flo

2 1

Weub UI fails with "Login failed due to an unknown reason."
by Thomas Boroske 17 Nov '20

17 Nov '20

Dear FreeIPA experts, our FreeIPA installation has not allowed anyone to login using username/password into the web UI for some days. At first only the secondary ipa server failed in that way, now its both. I have found several similar threads in the mailing list but the underlying problem always seemed to be something else. I tried to debug the problem. Looking into /var/log/httpd/error_log I see that each login attempt generates the following error: CalledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_9920 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 Trying the kinit command on console fails because it asks me for a password for wellknown/anonymous that I do not know, I guess that is because the armor_9920 file does not exist. I do not know if that file exists when the webgui runs the kinit, but I guess it does and something else fails later. We are running FreeIPA 4.6.6.11-el7.centos on centos 7.8. kinit -k -t /var/lib/ipa/gssproxy/http.keytab HTTP/ipa1.ida.ing.tu-bs.de(a)NET.IDA does not give an error. We are running a CA-less FreeIPA install as far as I understand, the httpd on ipa1 shows a valid certificate signed by an external (to us) cert authority. Any help is much appreciated, Thomas Boroske

3 7

Getting status of CA_UNCONFIGURED trying to create certificates for services
by Scott Reed 16 Nov '20

16 Nov '20

Hi all, So, I have been working on creating certificates for services on a solid installation of FreeIPA on a machine we have. I did everything that this blog stated to do... https://blog.christophersmart.com/2014/08/24/creating-certs-and-keys-for-se… But now when I enter the command, sudo ipa-getcert list. The status is CA_UNCONFIGURED, ca-error is "Error setting up ccache for "host" service on client using default keytab: Preauthentication failed.", stuck is yes. I checked the krb5.keytab it's set to -rw------- and root:root. I'm not sure what else I can do to address the problem. Any help would be appreciated. Thanks!

2 5

How to get a private key for a service certificate to use with TLS?
by Scott Reed 16 Nov '20

16 Nov '20

I created some service certificates for some of my machines that are using FreeIPA. I followed the instructions that were in the web interface. Now, we need to establish the keys so that we can use them for TLS communications between nodes. I am trying to figure out how to create the keys that would be associated with the certificate and then export them in pkcs12 format. Does anyone know of any resources that would help me out? I've been having a hard time finding resources that apply to what I am trying to do. Thanks, The newbie

2 1

subsystemCert appears out of date
by Marc Pearson | i-Neda Ltd 16 Nov '20

16 Nov '20

Hi All, My subsystem cert appears to have gone out of date, and I'm unable to get it to update. This has become an issue on my production environment, and my current work around has been to take the system date back by a month. I've tried the cert renew tool, but this doesn't seem to have updated this cert. Is anyone able to point me in the right direction to be able to update this specific certificate as I've been unable to find anything online. [auth01 ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' Certificate: Data: Version: 3 (0x2) Serial Number: 42 (0x2a) Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption Issuer: "CN=Certificate Authority,O=INT.I-NEDA.COM" Validity: Not Before: Sun Nov 04 08:04:35 2018 Not After : Sat Oct 24 07:04:35 2020 Subject: "CN=CA Subsystem,O=INT.I-NEDA.COM" Subject Public Key Info: Public Key Algorithm: PKCS #1 RSA Encryption RSA Public Key: Modulus: c6:7e:e6:40:8f:6e:77:07:8f:2a:ca:ca:63:63:cf:c6: 5f:1c:09:63:4a:bb:17:68:17:cd:20:9b:f3:b0:5b:c0: f7:ff:72:07:1d:a2:29:93:61:62:5c:9f:04:d3:cb:7b: bf:53:de:bb:dd:d6:3f:a1:14:95:04:53:64:87:73:24: e3:61:66:96:ab:99:1f:2c:da:ec:22:e5:21:b1:5c:d5: 0a:dd:4e:3f:f8:e2:90:a1:55:31:ad:11:2f:3b:d3:90: 14:dc:b7:9d:fc:35:1a:ab:48:27:68:0a:9f:cb:95:14: 00:93:b8:d4:d4:30:de:4e:be:20:a3:01:24:e8:f2:4a: 1a:d2:b6:e0:09:77:3d:24:e3:5a:cf:51:d6:ca:d2:65: 53:62:72:64:fe:7d:53:09:0e:97:b8:61:c9:c8:6d:24: 52:15:f2:bf:40:04:38:24:22:73:fb:80:a0:ff:16:57: e1:0b:3c:71:02:d7:e6:2e:94:0a:e7:4e:aa:5e:6f:91: a5:68:65:21:cd:68:0c:2d:5d:53:fa:e0:10:75:47:43: 04:f2:8b:e1:1c:1c:ed:a6:c1:ee:5c:6c:72:51:b5:e6: cd:f9:06:45:17:00:2b:d7:34:75:8a:59:f2:21:97:c6: 63:d3:6f:54:d9:00:42:74:88:9e:94:d0:d4:d2:a1:b7 Exponent: 65537 (0x10001) Signed Extensions: Name: Certificate Authority Key Identifier Key ID: f2:bb:9c:4f:e3:d8:c3:f9:58:eb:cc:5f:f7:be:8c:d6: d5:08:c0:3a Name: Authority Information Access Method: PKIX Online Certificate Status Protocol Location: URI: "http://ipa-ca.int.i-neda.com/ca/ocsp" Name: Certificate Key Usage Critical: True Usages: Digital Signature Non-Repudiation Key Encipherment Data Encipherment Name: Extended Key Usage TLS Web Server Authentication Certificate TLS Web Client Authentication Certificate Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption Signature: 5f:b7:31:25:10:ef:e7:72:44:8e:94:1d:57:4e:bb:4e: 22:cf:9b:7e:f4:20:a2:fa:96:2a:cf:e9:70:cd:a6:82: 4a:bd:58:4b:a7:df:4d:77:47:ba:65:d0:68:c5:dc:59: 77:7e:bf:36:d3:55:c7:86:d3:16:77:51:46:c2:48:de: e8:0d:62:05:b9:8c:46:bd:22:7d:8d:d0:ad:5a:64:6b: 9b:7d:ec:4c:e6:05:e7:02:97:cd:01:f5:19:91:15:7e: cc:41:5b:f2:00:2d:c0:0b:91:9e:62:d5:7a:b2:1e:8f: 32:62:c2:ed:1a:e8:e1:56:32:e0:0e:79:55:a2:49:35: 0e:df:5d:a3:df:e2:dd:58:60:4a:dd:19:92:f7:4d:60: 59:0e:16:b1:ae:32:e6:c5:c5:fa:5b:2f:fe:1d:fe:e9: ec:67:2b:65:33:f2:57:64:8a:68:f3:91:9b:25:ff:02: 64:4c:a1:6d:fe:f0:73:95:f2:0f:49:fb:3f:85:21:a0: 68:37:dc:cd:73:02:73:20:22:a9:1d:c9:7e:88:4f:9b: 7c:92:f8:c1:50:0f:95:43:48:5b:8b:7f:0f:48:04:a8: c7:c0:0e:58:7c:86:2c:3a:b5:72:e3:34:3d:d8:0f:26: eb:44:fa:75:c1:c8:fc:b6:7d:f7:31:91:a4:71:a1:51 Fingerprint (SHA-256): 4F:2A:1B:54:65:B6:09:3E:AD:68:08:92:CB:8D:FE:13:EF:B8:4C:F1:1E:0F:E1:15:13:92:D3:7A:3D:F8:54:44 Fingerprint (SHA1): 03:34:DC:55:F5:00:AF:8C:EF:AC:AA:0D:E0:44:AD:5C:6F:CF:97:A6 Mozilla-CA-Policy: false (attribute missing) Certificate Trust Flags: SSL Flags: User Email Flags: User Object Signing Flags: User Thanks for the help, Marc.

1 0

freeipa DNS issues with resolving
by Damjan Kumin 13 Nov '20

13 Nov '20

Hello friends, I have FreeIPA version 4.8.10 on FC 33. Installation went trough and when I try NSLOOKUP, and selected server is 127.0.0.53, I can resolve freeipa host (actual hostname of the server) and internet, for instance google.com. Then in NSLOOKUP I set server to 10.0.0.2 (this is the private IP of the freeipa) and check if it can resolve freeipa server - and it can. But then I try the google.com after and it fails - it fails basically anything outside of what it hosts. I tried installation with forwarders but that failed every time I entered our country's DNS and even with using 1.1.1.1 So in short - freeipa can resolve anything if using 127.0.0.53 but nothing if using 10.0.0.2 - that means that no host on internal network can resolve anything if using freeipa as DNS server. Please help as I cannot use anything on the net as no global address is resolving right now. THX in advance!

2 5

putty gssapi trust
by Natxo Asenjo 12 Nov '20

12 Nov '20

hi, We have a working cross realm trust between AD (2016, domain.local) -> Idm (rhel 7.9, idm.domain.local). So we can log in using our AD credentials to the rhel servers, and get kerberos tickets and the rbac rules are enforced coupled to AD groups mapped to Idm external groups. If i run klist.exe on a cmd prompt, I see several DOMAIN.LOCAL tickets on the Windows client. One thing I cannot seem to get working is to use putty with gssapi delegation (user name(a)domain.local and selecting the gssapi credentials delegation) on a windows client joined to AD. So using name/password it works, but single sign on does not. The only thing I can think of is a firewall, but I cannot find any documentation about firewall requirements between a windows client and a idm host. The only port open that I know of is 22/tcp for sshd, so the windows host can get to putty. This is a pretty locked down setup, I have no access to the firewall logs or administrator rights on the windows client to run a packet capture. Do you need kerberos access from the windows clients to the Idm servers for the trust? -- regards, Natxo

2 1

Issue with 'unable to perform'
by Daniel Oakes 11 Nov '20

11 Nov '20

Apologies – I have searched google unfruitfully for a solution, but I have failed ☹ I have an issue with a FreeRadius / FreeIPA setup and I’m struggling to find how to debug / tune or fix the issue. It’s a pretty simple one, but google fu fail. Basically, FreeRadius is returning every now and again the following: Tue Nov 10 21:32:38 2020 : Error: rlm_ldap (ldap): Bind was not permitted: Server was unwilling to perform And the corresponding entry is in the dirsrv log: [10/Nov/2020:21:32:38.780133776 +0000] conn=777962 fd=205 slot=205 connection from ::1 to ::1 [10/Nov/2020:21:32:38.780524927 +0000] conn=777962 op=0 BIND dn="uid=admin,cn=users,cn=accounts,dc=freeipa,dc=z,dc=net" method=128 version=3 [10/Nov/2020:21:32:38.781269853 +0000] conn=777962 op=0 RESULT err=53 tag=97 nentries=0 etime=0.000982345 [10/Nov/2020:21:32:38.781549696 +0000] conn=777962 op=1 UNBIND [10/Nov/2020:21:32:38.781573368 +0000] conn=777962 op=1 fd=205 closed - U1 It eventually resolves, but for a period of time every now and again (it’s completely random as to the timing) FreeIPA will just stop talking to the Radius. Network issues are not the problem, the Radius and LDAP are on the same server. I’d love to know how to debug and fix this obviously – but a quick fix would also be nice 😊 FreeIPA is pretty much stock, we just upgrade it every once and a while. Many thanks for any help. Cheers, Daniel

1 0

Another Expired Certs Issue
by Sean McLennan 11 Nov '20

11 Nov '20

I swear I have been reading and trying everything I can find on here and elsewhere today and I'm still having problems fixing my certs. As appears to be a common problem, certmonger didn't auto-renew any of them. IPA v4.6.9 running on Ubuntu 18.04; only the one server IPA RA is fine ldap and krbtgt are "CA UNREACHABLE": Server at https://ipa01.simplyws.com/ipa/xml failed request, will retry: 903 (RPC failed at server. an internal error has occurred). Everything else is NEED_CSR_GEN_PIN including HTTP Possibly ipa-cert-fix or pki-server cert-fix would take care of it, but they aren't in this version and I'm reluctant to upgrade the distro without proper preparation. Everything starts without any problems. With the date set, everything is functioning like normal as far as I can tell. I have rolled back the date successfully making sure to respect the 'notbefore' on ra-agent.pem I've tried both manually: getcert resubmit -i xxx and restarting certmonger to no avail... cn=ipa,cn=cas,cn=ca,$BASEDN and ou=authorities,ou=ca,o=ipaca appear to be fine. Everything in /var/log/pki/pki-tomcat/ca/debug is FINE There are some errors about missing .jar files in /var/log/pki/pki-tomcat/pki/debug /var/log/ipa and /var/log/dirsrv don't seem to have anything of note. Any thoughts would be greatly appreciated!

4 33

centos8 freeipa installation fails
by Rob Verduijn 07 Nov '20

07 Nov '20

Hello, I'm trying to install freeipa on centos8, However it fails with an error related to java. (see error below) I found this bugzilla that describes the problem : https://bugzilla.redhat.com/show_bug.cgi?id=1892216 The downgrade suggestion in that bugzilla does not work for centos8 since those packages are no longer available in the repos. Does anybody have a workaround for centos ? Rob Failed to configure CA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'CA', '-f', '/tmp/tmpi69b51qe'] returned non-zero e xit status 1: 'Notice: Trust flag u is set automatically if the private key is present.\nERROR: Exception: Server unreachable due to SSL err or: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:897)\n File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 56 2, in main\n scriptlet.spawn(deployer)\n File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 836, in spawn\n request_timeout=status_request_timeout,\n File "/usr/lib/python3.6/site-packages/pki/server/deployment/pkihelper.py", l ine 911, in wait_for_startup\n raise Exception(\'Server unreachable due to SSL error: %s\' % reason) from exc\n\n')

4 4

Kerberos behaviour when OTP is used
by Radoslaw Kujawa 07 Nov '20

07 Nov '20

Hi list. I have 2FA enabled for many users in my organization, however some of these users work on their own private devices and manually run kinit to obtain the TGT. I was wondering why does kinit ask to: "Enter OTP Token Value: " This message is slightly confusing. In fact, the user is supposed to enter password+OTP here. I've attempted reading RFC 6560. If I understand correctly, OTP is not really supposed to be used as a 2nd factor with Kerberos? Another minor trouble with BYOD setups is that the OTP user has to manually obtain anonymous ticket for FAST, before being able to run kinit. Interestingly, FAST is not required for Smart Card PKINIT to work. None of this is really a big problem, it's just troublesome to explain in one sentence "how does Kerberos authentication work in our organization". Of course with Linux clients joined to the IPA domain, all of these details are abstracted by sssd and therefore a non-issue from the user's perspective. Best regards, Radoslaw

2 2

question about the scope of FreeIPA LDAPS service - can it authenticate AD trust users or just local IPA users?
by Chris Dagdigian 05 Nov '20

05 Nov '20

Dumb question ... For use cases (temporary/ephemeral/auto-scaling servers) where we can't do a full ipa-client-install on a managed node is it possible to use the LDAP service on FreeIPA to check a username and password for an AD-trust user? I've been fooling around with making AWS Parallelcluster nodes LDAP clients of a FreeIPA environment and it actually works really well with users and groups that are local to FreeIPA; it's quite a nice solution actually and solves a consistency problem for some users and groups we need to persist as HPC grids are launched and destroyed. Was wondering idly if the LDAP service extended to being able to authenticate a user that exists within an AD-trust. It does not seem to work out of the box but I was wondering if a change of the LDAP bind DN or other settings would allow this to work? Wanted to ask if this was even possible before I spent more time working on my ldap configs! Regards Chris

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2020