FreeIPA-users March 2021

freeipa-users@lists.fedorahosted.org

59 participants
93 discussions

SSSD restart is required for AD users to work
by Anestis Karampatziakis 03 Mar '21

03 Mar '21

Hi, Recently we established a one-way trust between our FreeIPA server and a client’s AD domain. Users and groups have been created and mapped; we are now testing user access, hbac and sudo rules. An issue we came across is that on all clients we need to restart SSSD for the correct usergroups and group membership to appear on id and getent command. Check test_user user and group membership: [root@server1 root]# id test_user(a)ad.domain.com uid=370001170(test_user(a)ad.domain.com) gid=370001170(test_user(a)ad.domain.com<mailto:test_user@ad.domain.com>) groups=370001170(test_user(a)ad.domain.com) [root@server1 root]# service sssd restart Redirecting to /bin/systemctl restart sssd.service Recheck user, new groups appear. [root@server1 root]# id test_user(a)ad.domain.com uid=370001170(test_user(a)ad.domain.com) gid=370001170(test_user(a)ad.domain.com<mailto:test_user@ad.domain.com>) groups=370001170(test_user@ad.domain.com),370001628(ad_group@ad.domain.com),1262600020(posix_group),370000513(domain users(a)ad.domain.com) 370001628(ad_group(a)ad.domain.com<mailto:ad_group@ad.domain.com>) and 1262600020(posix_group) are the FreeIPA posix group and the mapped AD group. Another thing is that although sssd restart appears to resolve the issue, when checking the next usergroup we need to do the same exercise. Check test_user2 user and group membership: root@server1 root# id test_user2@ad_domain uid=370001175(test_user2@ad_domain) gid=370001175(test_user2@ad_domain) groups=370001175(test_user2@ad_domain),370000513(domain users@ad_domain) root@server1 root# getent group posix_group2 [empty response] Responses are not correct. Restart SSSD. root@server1 root# service sssd restart Check again: root@server1 root# id test_user2@ad_domain uid=370001175(test_user2@ad_domain) gid=370001175(test_user2@ad_domain) groups=370001175(test_user2@ad_domain),370000513(domain users@ad_domain),370001634(ad_group2@ad_domain),1262600032(posix_group2) root@server1 root# getent group posix_group2 ad_pis_users:*:1262600032:test_user2@ad_domain Response is correct and users can login according to hbac and sudo rules. Our FreeIPA server version is: 4.6.6-11.el7.centos Is there something we have missing in our configuration? Thanks, Anestis

1 0

FreeIPA Multi-master dse.ldif updates
by Yuri Krysko 02 Mar '21

02 Mar '21

Hello, We run two IPA servers in a multi-master replication topology. Could anyone please advise if it is normal to have dse.ldif files on both IPA servers be updated every minute roughly with nsState attribute being modified by cn=Multimaster Replication Plugin,cn=plugins,cn=config ? Thanks much!

2 2

ipa-replica-install failure.
by Arjen Heidinga 02 Mar '21

02 Mar '21

Hi! My primary IPA-server is severely damaged. It is an old server, updated and updated and updated through time (anaconda-ks.cfg is 4 Dec 2014). I run Fedora-33 (now). Because the installation is broken on several parts (missing certs, odd tomcat issues), I thought, lets replicate and reinstall and start over fresh-ish. New machine, ipa-replica install goes smooth for about an hour (or so) and burns down: The ipa-replica-install command failed, exception: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service" and "journalctl -xe" for details.\n') CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service failed because a timeout was exceeded.\nSee "systemctl status pki-tomcatd(a)pki-tomcat.service" and "journalctl -xe" for details.\n') The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information (install log attached). Inspecting the tomcat-ca log i see: 2021-02-25 13:07:18 [main] INFO: PluginRegistry: Loading plugin registry from /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2021-02-25 13:07:18 [main] SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed netscape.ldap.LDAPException: Authentication failed (49) Yes, this is one of the issues I had with the main server. Somehow not trusting the tomcat client-cert anymore. Ended up with doing password auth without ssl. Is there a way to repair this, or trick the server into doing this. Or should I do a fresh start? Kind regards, Arjen Heidinga

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2021