FreeIPA-users May 2021

freeipa-users@lists.fedorahosted.org

46 participants
88 discussions

Error issuing cert with IP address in SAN
by Ian Pilcher 12 May '21

12 May '21

I am getting an odd error when trying to issue a certificate with an IP address in its SAN. I am using IPA 4.6.8 on RHEL 7.9, so it's a bit old, but it should work, AFAIK. Here is the host for which I want to issue the certificate: $ ipa host-show node01-idrac.pemlab.rdu2.redhat.com Host name: node01-idrac.pemlab.rdu2.redhat.com Principal name: host/node01-idrac.pemlab.rdu2.redhat.com(a)PEMLAB.RDU2.REDHAT.COM Principal alias: host/node01-idrac.pemlab.rdu2.redhat.com(a)PEMLAB.RDU2.REDHAT.COM Password: False Keytab: False Managed by: node01-idrac.pemlab.rdu2.redhat.com Here is the CSR: $ openssl req -noout -text -in node01-idrac.csr Certificate Request: Data: Version: 0 (0x0) Subject: CN=node01-idrac.pemlab.rdu2.redhat.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: ⋮ Exponent: 65537 (0x10001) Attributes: Requested Extensions: X509v3 Subject Alternative Name: DNS:node01-idrac.pemlab.rdu2.redhat.com, DNS:node01-idrac, DNS:10.11.173.11 Signature Algorithm: sha256WithRSAEncryption ⋮ The DNS records: $ ipa dnsrecord-show pemlab.rdu2.redhat.com node01-idrac Record name: node01-idrac A record: 10.11.173.11 $ ipa dnsrecord-show 173.11.10.in-addr.arpa 11 Record name: 11 PTR record: node01-idrac.pemlab.rdu2.redhat.com. $ ipa cert-request node01-idrac.csr --certificate-out node01-idrac.crt \ --principal host/node01-idrac.pemlab.rdu2.redhat.com(a)PEMLAB.RDU2.REDHAT.COM ipa: ERROR: The service principal for subject alt name 10.11.173.11 in certificate request does not exist From my examination of ipaserver/plugins/cert.py, I don't think that this has anything to do with validation of the IP address, as the exception seem to be raised before _validate_san_ips ever gets called. Beyond that, however, I really don't know what's going on. I've filed this as https://bugzilla.redhat.com/show_bug.cgi?id=1960041, but I was wondering if anyone on this list has seen this behavior or can spot an error that I'm making. Thanks! -- ======================================================================== In Soviet Russia, Google searches you! ========================================================================

1 1

kinit: Cannot find KDC for realm "mgmt-062-ad.internal2.example.com@NTERNAL2.EXAMPLE.COM" while getting initial credentials
by pxg51214 r 12 May '21

12 May '21

Hello, I apologize if this has been previously resolved. I am new to FreeIPA product. Our ops team has created a keytab (please kindly see below for the command used) on a Windows AD server. I copied the keytab file, along with the KDC and root-CA certificates to a RedHat Linux added a second REALM entry in the /etc/krb5.conf (per Google blogs recommendations) and and tried 'kinit' (please see the command used below). The cli response (error) is listed below and I appreciate guidance on the possible root causes and remedies. Thank you very much. -Chris #----- Linux system configuration (the server where the keytab is placed for automation) -------------------------------------------------------- $ cat /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="8.3 (Ootpa)" ID="rhel" ID_LIKE="fedora" VERSION_ID="8.3" PLATFORM_ID="platform:el8" PRETTY_NAME="Red Hat Enterprise Linux 8.3 (Ootpa)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:redhat:enterprise_linux:8.3:GA" HOME_URL="https://www.redhat.com/" BUG_REPORT_URL="https://bugzilla.redhat.com/" REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8" REDHAT_BUGZILLA_PRODUCT_VERSION=8.3 REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux" REDHAT_SUPPORT_PRODUCT_VERSION="8.3" #---- Windows AD server configuration (the server where the keytab is created) --------------------------------------------------------------- PS C:\temp> systeminfo Host Name: MGMT-062-AD OS Name: Microsoft Windows Server 2019 Standard OS Version: 10.0.17763 N/A Build 17763 OS Manufacturer: Microsoft Corporation OS Configuration: Primary Domain Controller OS Build Type: Multiprocessor Free Registered Owner: EXAMPLE, Inc Registered Organization: EXAMPLE.COM Product ID: 00429-70000-00000-AA235 Original Install Date: 3/25/2020, 8:52:14 PM System Boot Time: 4/14/2021, 5:18:21 PM System Manufacturer: Xen System Model: HVM domU System Type: x64-based PC Processor(s): 1 Processor(s) Installed. [01]: Intel64 Family 6 Model 79 Stepping 1 GenuineIntel ~2600 Mhz BIOS Version: Xen 4.7<denied>, 12/14/2020 Windows Directory: C:\Windows System Directory: C:\Windows\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: en-us;English (United States) Time Zone: (UTC-06:00) Central Time (US & Canada) Total Physical Memory: 16,380 MB Available Physical Memory: 12,006 MB Virtual Memory: Max Size: 18,812 MB Virtual Memory: Available: 14,772 MB Virtual Memory: In Use: 4,040 MB Page File Location(s): C:\pagefile.sys Domain: internal2.example.com Logon Server: \\MGMT-062-AD Hotfix(s): 16 Hotfix(s) Installed. [01]: KB4601558 [02]: KB4494174 [03]: KB4516115 [04]: KB4523204 [05]: KB4535680 [06]: KB4539571 [07]: KB4549947 [08]: KB4562562 [09]: KB4580325 [10]: KB4587735 [11]: KB4598480 [12]: KB4601393 [13]: KB5000859 [14]: KB5001404 [15]: KB5003243 [16]: KB5003171 Network Card(s): 1 NIC(s) Installed. [01]: XenServer PV Network Device Connection Name: Ethernet 2 DHCP Enabled: No IP address(es) [01]: 10.93.178.118 [02]: fe80::580:2a39:3c96:efa0 Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed. PS C:\temp> #----- Command used on Windows AD server (mgmt-062-ad) to create the keytab file --------------------------------------------------------------- C:/> ktpass -out ldap-ad-2.keytab -princ ldap@mgmt-062-ad.internal2.example.com@INTERNAL2.EXAMPLE.COM +rndPass -mapUser ldap(a)INTERNAL2.EXAMPLE.COM -crypto AES256-SHA1 -pType KRB5_NT_PRINCIPAL #------ Error message --------------------------------------------------------------- $ klist -kt ldap-ad-2.keytab Keytab name: FILE:ldap-ad-2.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 18 12/31/1969 18:00:00 ldap@mgmt-062-ad.internal2.example.com\@INTERNAL2.EXAMPLE.COM #------ KRB5 Configuration File --------------------------------------------------------------- $ cat /etc/krb5.conf #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = INTERNAL.EXAMPLE.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] INTERNAL.EXAMPLE.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } INTERNAL2.EXAMPLE.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/mgmt-062-ad.internal2..example.com.DomainController.Cert.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/mgmt-062-ad.internal2..example.com.RootCA.Cert.pem } [domain_realm] .internal..example.com = INTERNAL.EXAMPLE.COM internal..example.com = INTERNAL.EXAMPLE.COM mgmt-027-auto.mgmt.internal..example.com = INTERNAL.EXAMPLE.COM .mgmt.internal..example.com = INTERNAL.EXAMPLE.COM mgmt.internal..example.com = INTERNAL.EXAMPLE.COM

2 3

Is there an owner or manager of this list?
by Steve Reed 11 May '21

11 May '21

If so, who can I contact? Thanks. Steve

2 1

Encryption type errors with AD cross-forest trust
by Owen Vincent 11 May '21

11 May '21

Hi everyone, Up front, a tl;dr, we are having trouble getting our FreeIPA cross-forest trust to allow us to authenticate AD users on our Linux machines using ssh. It seems like the AD is only allowing RC4 encryption and won’t allow us to enable AES encryption. The “the other domain supports Kerberos AES encryption” checkbox in AD’s trust settings is grayed out and cannot be set. Trying to manually set msDS-SupportedEncryptionTypes to 24 or 28 (or 0x18, 0x1c) results in the following error: "Operation failed. Error code: 0x2077 Illegal modify operation. Some aspect of the modification is not permitted. 00002077: SvcErr: DSID-0319039A, problem 5003 (WILL_NOT_PERFORM), data 0." The main questions are: is there something that needs to be set on the FreeIPA side for AD to allow these settings to be enabled? Have you encountered similar issues in the past? Do you have any ideas what we could try to get authentication working? There are also some less pressing questions at the bottom of the post, in case you have any answers to those. Thanks in advance! Best, Owen The longer version: I’ve been trying to get this to work for a couple of weeks now and each time I solve one problem, another pops up. I think I have narrowed it down to one of the final issues, but given the way things have been going, I could well be wrong. I have tried to find more information online, but nothing really seems to fit my situation, so I decided to ask you guys for help. First off a little background information, this is setup is at a relatively large organization with a well established AD. I have don’t have admin access on the AD controllers, but do have read access, it doesn’t allow me to see some things (e.g. all of the AES encryption check boxes are grayed out when I look on my user). The AD admin has been very agreeable overall and has done the things we have asked them to do, but hasn’t taken much initiative in helping solve the problem, so we need to be as precise and descriptive as possible when making suggestions. The AD setup seems to be a little weird (though I’m not sure as I don’t have much experience with windows servers and AD). The domain controllers are all running Windows Server 2016, the domain functional level is 2012 R2, and the forest functional level is 2008 R2. I have the feeling that this might be part of the problem, but again, I don’t have much experience with windows. Where we stand now: we have successfully established a one-way cross-forest trust between the AD root domain and our FreeIPA installation. Both on the AD side and on our side DNS is run separate from AD/FreeIPA, in case that matters, but the necessary entries are configured and were working well enough to establish the trust. On the FreeIPA machines we can run getent passwd user1@AD and get a valid response, ID View overrides are also in effect when using getent (ID Views are the primary reason for trying to setup FreeIPA), however those users are unable to login via ssh. At this point when we try to login via ssh we get this error the journal on the FreeIPA server we are trying to login to: krb5_child[3343]: KDC has no support for encryption type and this in /var/log/sssd/krb5_child.log: (2021-05-10 10:49:12): [krb5_child[3343]] [validate_tgt] (0x0020): TGT failed verification using key for [host/ipac1.domain.com(a)IPA.DOMAIN.COM] (2021-05-10 10:49:12): [krb5_child[3343]] [get_and_save_tgt] (0x0020): 1762: [-1765328370][KDC has no support for encryption type] (2021-05-10 10:49:12): [krb5_child[3343]] [map_krb5_error] (0x0020): 1854: [-1765328370][KDC has no support for encryption type] (I can provide more detailed logs in needed, though I would prefer not to do that on a public channel) When doing a packet capture (tcpdump/wireshark) of this login attempt we can see: 1) a successful AS-REQ and AS-REP for CNameString IPA$ in realm AD.DOMAIN.COM for SnameString krbtgt/AD.DOMAIN.COM 2) a successful TGS-REQ and TGS-REP in realm AD.DOMAIN.COM for SnameString ldap/adc01.ad.domain.com 3) a successful encrypted LDAP session between the freeipa machine and adc01.ad.domain.com 4) the same process in 1-3 for adc02.ad.domain.com as well 5) a successful AS-REQ and AS-REP for CNameString user1(a)DOMAIN.COM in realm AD.DOMAIN.COM for SnameString krbtgt/AD.DOMAIN.COM 6) a failed TGS-REQ and TGS-REP in realm AD.DOMAIN.COM for SnameString krbtgt/IPA.DOMAIN.COM with the error: KRB5KDC_ERR_ETYPE_NOSUPP This lead us to some googling and then testing with the following added to our /etc/krb5.conf.d/freeipa file: default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac (Note: I know we RC4 is not advisable, this was a test to figure out what was going on.) Which got us a step further, now when trying to authenticate we would get this error in our journal: krb5_child[2159]: KDC returned error string: PROCESS_TGS and this in /var/log/sssd/krb5_child.log: (2021-05-10 10:45:25): [krb5_child[2159]] [validate_tgt] (0x0020): TGT failed verification using key for [host/ipac1.domain.com(a)IPA.DOMAIN.COM] (2021-05-10 10:45:25): [krb5_child[2159]] [get_and_save_tgt] (0x0020): 1762: [-1765328324][KDC returned error string: PROCESS_TGS] (2021-05-10 10:45:25): [krb5_child[2159]] [map_krb5_error] (0x0020): 1854: [-1765328324][KDC returned error string: PROCESS_TGS] Again, this let to some googling, after which we added the following line to our /etc/sssd/sssd.conf [global] section: krb5_validate = False (Note: I know turning off krb5 validation is not a good idea, this was a test to figure out what was going on.) At this point AD users could successfully login via ssh on the FreeIPA servers. When they were logging in the packet capture looked very similar to the previous packet capture from above, with the exception that step 6 resulted in a successful TGS-REQ and TGS-REP, however using eTYPE-ARCFOUR-HMAC-MD5, while the rest of the exchange was done entirely in eTYPE-AES256-CTS-HMAC-SHA1-96. The whole point of going through all that was to try to narrow down where the configuration issue is. It definitely appears to be that that AD is not allowing AES encryption to be used for a necessary part of the trust relationship, which is causing problems. In the AD Trust settings the “the other domain supports Kerberos AES encryption” checkbox is grayed out and cannot be set. When you open the trust in AD’s ADSI Editor you can see that msDS-SupportedEncryptionTypes is <not set>, which means it defaults to 0 or only RC4 (which is also how it’s behaving). When trying to manually set msDS-SupportedEncryptionTypes to 24 or 28 (or 0x18, 0x1c) results in the following error: "Operation failed. Error code: 0x2077 Illegal modify operation. Some aspect of the modification is not permitted. 00002077: SvcErr: DSID-0319039A, problem 5003 (WILL_NOT_PERFORM), data 0." I wasn’t able to find any really helpful information about the check box being grayed out. The most extensive discussion I could find was this link: https://social.technet.microsoft.com/Forums/en-US/7f43b815-46a8-483c-a8d7-4… But that only vaguely suggests recreating the trust might help. We have already recreated the trust on both ends and it hasn’t enabled the check box. I also looked up the “Operation failed. Error code: 0x2077 Illegal modify operation.” error and found this: https://community.spiceworks.com/topic/1824257-cannot-change-domain-attribu… But this one discusses password related GPO information. I don’t know if that would affect the msDS-SupportedEncryptionTypes attribute in the same way, or if that attribute has a GPO related setting. It also discusses the default domain policy being corrupted, which I’m a little worried about implying, as I’m not sure if the agreeableness of the AD Admin would continue into rebuilding the default domain policy. If you have read this far, thank you for your dedication. I know it was a lot, but I wanted to be thorough. Now for the questions: Is there something that needs to be set on the FreeIPA side for AD to allow the Kerberos AES encryption checkbox to be enabled? Have you encountered similar issues in the past? Do you have any ideas what we could try to get authentication working with proper encryption? Is there anything else we aren’t not thinking about that you think would be relevant to this situation? Of lesser importance: Why is there a validation error after enabling RC4 but before disabling krb5 validation? Is it because RC4 is deprecated? Or is there another reason? (we DON’T want to use RC4, we’re just curious) Again, Thanks in advance! Best, Owen

2 8

posix and non-posix AD users
by iulian roman 11 May '21

11 May '21

I have configured a trust between IdM and Active Directory with posix range type. The users which do have an uidNumber in AD are correctly listed, but those without uidNumber are not (similar for the groups). Is there any setting or possibility to have the AD users without uidNumber get an uid generated automatically (if they do not have one in AD) by IPA and listed as AD users in Linux ?

5 6

Problem with Client Installs on Centos 7
by Steve Reed 11 May '21

11 May '21

Hi all, I am running Versions 4.8 of the client installations. I have one machine that installed except it failed to configure the krb5.conf file properly and it fails saying that it can't find the KDC for the realm xyz.com. I can fix Kerberos by manually editing the kfb5.conf file. Except for the rest of the machines which won't work for ldap logins, but Kerberos works fine. Prior to the installation, I make sure the resolv.conf file is configured properly. I make sure that the /etc/hosts file has the proper entries for the machine I am installing on and the server. No extraneous domain names. Also, I make sure the hostname is fully qualified with the domain name. I turn off any potential firewalld, iptables or ip6tables services as well. This is the installation command: ipa-client-install --mkhomedir -p admin -w PassWord@12345! --ntp-server=idm.xyz.com --unattended --force-join --realm XYZ.COM 2021-05-07T20:36:19Z DEBUG Logging to /var/log/ipaclient-install.log 2021-05-07T20:36:19Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': 'XYZ.COM', 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': 'admin', 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': ['idm.xyz.com'], 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': True, 'firefox_dir': None, 'unattended': True, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False} 2021-05-07T20:36:19Z DEBUG IPA version 4.6.8-5.el7.centos 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/selinuxenabled 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=enabled 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG [IPA Discovery] 2021-05-07T20:36:19Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=client1.xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (domain of the hostname) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [Kerberos realm search] 2021-05-07T20:36:19Z DEBUG Kerberos realm forced 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _kerberos._udp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 88 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG [LDAP server check] 2021-05-07T20:36:19Z DEBUG Verifying that idm.xyz.com (realm XYZ.COM) is an IPA server 2021-05-07T20:36:19Z DEBUG Init LDAP connection to: ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Search LDAP server for IPA base DN 2021-05-07T20:36:19Z DEBUG Check if naming context 'dc=xyz,dc=com' is for IPA 2021-05-07T20:36:19Z DEBUG Naming context 'dc=xyz,dc=com' is a valid IPA context 2021-05-07T20:36:19Z DEBUG Search for (objectClass=krbRealmContainer) in dc=xyz,dc=com (sub) 2021-05-07T20:36:19Z DEBUG Found: cn=XYZ.COM,cn=kerberos,dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Discovery result: Success; server=idm.xyz.com, domain=xyz.com, kdc=idm.xyz.com, basedn=dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG Validated servers: idm.xyz.com 2021-05-07T20:36:19Z DEBUG will use discovered domain: xyz.com 2021-05-07T20:36:19Z DEBUG Start searching for LDAP SRV record in "xyz.com" (Validating DNS Discovery) and its sub-domains 2021-05-07T20:36:19Z DEBUG Search DNS for SRV record of _ldap._tcp.xyz.com 2021-05-07T20:36:19Z DEBUG DNS record found: 0 100 389 idm.xyz.com. 2021-05-07T20:36:19Z DEBUG DNS validated, enabling discovery 2021-05-07T20:36:19Z DEBUG will use discovered server: idm.xyz.com 2021-05-07T20:36:19Z INFO Discovery was successful! 2021-05-07T20:36:19Z DEBUG will use discovered realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG will use discovered basedn: dc=xyz,dc=com 2021-05-07T20:36:19Z INFO Client hostname: client1.xyz.com 2021-05-07T20:36:19Z DEBUG Hostname source: Machine's FQDN 2021-05-07T20:36:19Z INFO Realm: XYZ.COM 2021-05-07T20:36:19Z DEBUG Realm source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO DNS Domain: xyz.com 2021-05-07T20:36:19Z DEBUG DNS Domain source: Discovered LDAP SRV records from xyz.com (domain of the hostname) 2021-05-07T20:36:19Z INFO IPA Server: idm.xyz.com 2021-05-07T20:36:19Z DEBUG IPA Server source: Discovered from LDAP DNS records in idm.xyz.com 2021-05-07T20:36:19Z INFO BaseDN: dc=xyz,dc=com 2021-05-07T20:36:19Z DEBUG BaseDN source: From IPA server ldap://idm.xyz.com:389 2021-05-07T20:36:19Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:19Z DEBUG Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r XYZ.COM 2021-05-07T20:36:19Z DEBUG Process finished, return code=5 2021-05-07T20:36:19Z DEBUG stdout= 2021-05-07T20:36:19Z DEBUG stderr=realm not found 2021-05-07T20:36:19Z INFO Skipping synchronizing time with NTP server. 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=599779671 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:19Z DEBUG Writing Kerberos configuration to /tmp/tmpfFCY1T: 2021-05-07T20:36:19Z DEBUG #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = XYZ.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] XYZ.COM = { kdc = idm.xyz.com:88 master_kdc = idm.xyz.com:88 admin_server = idm.xyz.com:749 kpasswd_server = idm.xyz.com:464 default_domain = xyz.com pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM 2021-05-07T20:36:19Z DEBUG Initializing principal admin(a)XYZ.COM using password 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/bin/kinit admin(a)XYZ.COM -c /tmp/krbccnj9ncO/ccache 2021-05-07T20:36:19Z DEBUG Process finished, return code=0 2021-05-07T20:36:19Z DEBUG stdout=Password for admin(a)XYZ.COM: 2021-05-07T20:36:19Z DEBUG stderr= 2021-05-07T20:36:19Z DEBUG trying to retrieve CA cert via LDAP from idm.xyz.com 2021-05-07T20:36:19Z DEBUG retrieving schema for SchemaCache url=ldap://idm.xyz.com:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7fc3c40d7248> 2021-05-07T20:36:19Z INFO Successfully retrieved CA cert Subject: CN=Certificate Authority,O=XYZ.COM Issuer: CN=Certificate Authority,O=XYZ.COM Valid From: 2021-05-06 19:54:28 Valid Until: 2041-05-06 19:54:28 2021-05-07T20:36:19Z DEBUG Starting external process 2021-05-07T20:36:19Z DEBUG args=/usr/sbin/ipa-join -s idm.xyz.com -b dc=xyz,dc=com -h client1.xyz.com -f 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr=Keytab successfully retrieved and stored in: /etc/krb5.keytab Certificate subject base is: O=XYZ.COM 2021-05-07T20:36:20Z INFO Enrolled in IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/kdestroy 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Initializing principal host/client1.xyz.com(a)XYZ.COM using keytab /etc/krb5.keytab 2021-05-07T20:36:20Z DEBUG using ccache /etc/ipa/.dns_ccache 2021-05-07T20:36:20Z DEBUG Attempt 1/5: success 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/ipa/default.conf' 2021-05-07T20:36:20Z DEBUG -> Not backing up - '/etc/ipa/default.conf' doesn't exist 2021-05-07T20:36:20Z INFO Created /etc/ipa/default.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/sssd/sssd.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/nsswitch.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z INFO Configured sudoers in /etc/nsswitch.conf 2021-05-07T20:36:20Z INFO Configured /etc/sssd/sssd.conf 2021-05-07T20:36:20Z DEBUG Backing up system configuration file '/etc/krb5.conf' 2021-05-07T20:36:20Z DEBUG Saving Index File to '/var/lib/ipa-client/sysrestore/sysrestore.index' 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/keyctl get_persistent @s 0 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout=599779671 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Enabling persistent keyring CCACHE 2021-05-07T20:36:20Z DEBUG Writing Kerberos configuration to /etc/krb5.conf: 2021-05-07T20:36:20Z DEBUG #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = XYZ.COM dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] XYZ.COM = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .xyz.com = XYZ.COM xyz.com = XYZ.COM client1.xyz.com = XYZ.COM 2021-05-07T20:36:20Z INFO Configured /etc/krb5.conf for IPA realm XYZ.COM 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -N -f /tmp/tmpxItqiM/pwdfile.txt -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG Starting external process 2021-05-07T20:36:20Z DEBUG args=/usr/bin/certutil -d dbm:/tmp/tmpxItqiM -A -n CA certificate 1 -t C,, -a -f /tmp/tmpxItqiM/pwdfile.txt 2021-05-07T20:36:20Z DEBUG Process finished, return code=0 2021-05-07T20:36:20Z DEBUG stdout= 2021-05-07T20:36:20Z DEBUG stderr= 2021-05-07T20:36:20Z DEBUG failed to find session_cookie in persistent storage for principal 'host/client1.xyz.com(a)XYZ.COM' 2021-05-07T20:36:20Z INFO trying https://idm.xyz.com/ipa/json 2021-05-07T20:36:20Z DEBUG Created connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z INFO [try 1]: Forwarding 'schema' to json server 'https://idm.xyz.com/ipa/json' 2021-05-07T20:36:20Z DEBUG New HTTP connection (idm.xyz.com) 2021-05-07T20:36:20Z DEBUG HTTP connection destroyed (idm.xyz.com) Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e)) KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z DEBUG Destroyed connection context.rpcclient_140479019423504 2021-05-07T20:36:20Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 655, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 515, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 450, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 418, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3670, in main install(self) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2391, in install _install(options) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2733, in _install api.finalize() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 740, in finalize self.__do_if_not_done('load_plugins') File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 431, in __do_if_not_done getattr(self, name)() File "/usr/lib/python2.7/site-packages/ipalib/plugable.py", line 619, in load_plugins for package in self.packages: File "/usr/lib/python2.7/site-packages/ipalib/__init__.py", line 954, in packages ipaclient.remote_plugins.get_package(self), File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package plugins = schema.get_package(server_info, client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package schema = Schema(client) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 401, in __init__ fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) File "/usr/lib/python2.7/site-packages/ipaclient/remote_plugins/schema.py", line 426, in _fetch schema = client.forward(u'schema', **kwargs)['result'] File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1151, in forward return self._call_command(command, params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1127, in _call_command return command(*params) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1281, in _call return self.__request(name, args) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 1248, in __request verbose=self.__verbose >= 3, File "/usr/lib64/python2.7/xmlrpclib.py", line 1273, in request return self.single_request(host, handler, request_body, verbose) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 699, in single_request self.get_auth_info() File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 651, in get_auth_info self._handle_exception(e, service=service) File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 610, in _handle_exception raise errors.KerberosError(message=unicode(e)) 2021-05-07T20:36:20Z DEBUG The ipa-client-install command failed, exception: KerberosError: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529639068): Cannot contact any KDC for realm 'XYZ.COM' 2021-05-07T20:36:20Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information So, what I found is that the krb5.conf file is partially configured. I'm not sure what to look for in the sssd.conf file. I am assuming that since I can't login with an ldap account and it finds the domain that something is not cofigured properly for that either. Any thoughts on what is going wrong? And how I can fix it or work around it? I'm more worried about not being able to do ldap logins than the Kerberos problem since I have a work around for that. Thanks, Steve

3 15

Re: [SSSD-users] Re: Announcing SSSD 2.5.0
by Pavel Březina 11 May '21

11 May '21

On 5/10/21 8:10 PM, Joakim Tjernlund wrote: > On Mon, 2021-05-10 at 16:01 +0000, Joakim Tjernlund wrote: >> On Mon, 2021-05-10 at 17:48 +0200, Pavel Březina wrote: >>> On 5/10/21 5:12 PM, Joakim Tjernlund wrote: >>>> On Mon, 2021-05-10 at 14:53 +0000, Joakim Tjernlund wrote: >>>>> I decided to test new sssd/KCM and this is what I get: >>>>> >>>>> - ssh from non sssd/krb machine to new sssd machine, entered password >>>>> ~ $ klist >>>>> Ticket cache: KCM:1001 >>>>> Default principal: jocke(a)INFINERA.COM >>>>> >>>>> Valid starting Expires Service principal >>>>> 10/05/21 16:47:32 11/05/21 02:47:32 krbtgt/INFINERA.COM(a)INFINERA.COM >>>>> renew until 17/05/21 16:47:32 >>>>> ~ $ ksu >>>>> ksu: Ccache function not supported: not implemented while selecting the best principal >>>>> >>>>> I also have mit-kr5b master installed. >>>>> >>>>> Did I miss something? >>> >>> >>> krb5 master contains: >>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.co… >>> >>> but RETRIEVE is not implemented in sssd-kcm. Kerberos should fallback to >>> its own function that was used before this commit. > > FYI, reverting that commit makes it work. Thanks for the information. Please, open a ticket against krb5. > > Jocke >

1 0

Problem upgrading centos7 to centos8
by Kees Bakker 10 May '21

10 May '21

Hi, Trying to upgrade CentOS 7 tot CentOS 8, following the various hints on the internet. Executing this command fails # dnf --releasever=8 --allowerasing --setopt=deltarpm=false distro-sync ... Running transaction check Error: transaction check vs depsolve: (ipa-selinux = 4.8.7-12.module_el8.3.0+514+e7703106 if selinux-policy-targeted) is needed by ipa-common-4.8.7-12.module_el8.3.0+514+e7703106.noarch rpmlib(RichDependencies) <= 4.12.0-1 is needed by ipa-common-4.8.7-12.module_el8.3.0+514+e7703106.noarch To diagnose the problem, try running: 'rpm -Va --nofiles --nodigest'. You probably have corrupted RPMDB, running 'rpm --rebuilddb' might fix the issue. The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. How can I solve this? -- Kees

4 15

Re: [SSSD-users] Re: Announcing SSSD 2.5.0
by Pavel Březina 10 May '21

10 May '21

On 5/10/21 5:12 PM, Joakim Tjernlund wrote: > On Mon, 2021-05-10 at 14:53 +0000, Joakim Tjernlund wrote: >> I decided to test new sssd/KCM and this is what I get: >> >> - ssh from non sssd/krb machine to new sssd machine, entered password >> ~ $ klist >> Ticket cache: KCM:1001 >> Default principal: jocke(a)INFINERA.COM >> >> Valid starting Expires Service principal >> 10/05/21 16:47:32 11/05/21 02:47:32 krbtgt/INFINERA.COM(a)INFINERA.COM >> renew until 17/05/21 16:47:32 >> ~ $ ksu >> ksu: Ccache function not supported: not implemented while selecting the best principal >> >> I also have mit-kr5b master installed. >> >> Did I miss something? krb5 master contains: https://github.com/krb5/krb5/commit/795ebba8c039be172ab93cd41105c73ffdba0fdb but RETRIEVE is not implemented in sssd-kcm. Kerberos should fallback to its own function that was used before this commit. > > Get a KCM trace for ksu: > > (2021-05-10 17:09:47): [kcm] [get_client_cred] (0x4000): Client [0x56377e20ead0][14] creds: euid[1001] egid[100] pid[5871] cmd_line['ksu']. > (2021-05-10 17:09:47): [kcm] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled: > SELINUX_getpeercon failed [95][Operation not supported]. > Please, consider enabling SELinux in your system. > (2021-05-10 17:09:47): [kcm] [setup_client_idle_timer] (0x4000): Idle timer re-set for client [0x56377e20ead0][14] > (2021-05-10 17:09:47): [kcm] [accept_fd_handler] (0x0400): Client [0x56377e20ead0][14] connected! > (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 4 > (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 20 > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_DEFAULT_CACHE > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 0 bytes on KCM input > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately > (2021-05-10 17:09:47): [kcm] [kcm_op_get_default_ccache_send] (0x1000): Getting client's default ccache > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_get_default_send] (0x2000): Getting the default ccache > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/default] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/default] is [cn=default,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/default > (2021-05-10 17:09:47): [kcm] [secdb_dfl_url_req] (0x2000): Created request for URL /kcm/persistent/1001/default > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/default] > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=default,cn=1001,cn=persistent,cn=kcm] with scope=base > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x1000): No secret found > (2021-05-10 17:09:47): [kcm] [sec_get] (0x0040): Cannot retrieve the secret [2]: No such file or directory > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_list_send] (0x2000): Listing all ccaches > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree > (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896- > bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_list_send] (0x2000): Found 1 ccaches > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_list_send] (0x2000): Listing all caches done > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_name_by_uuid_send] (0x2000): Translating UUID to name > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree > (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896- > bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets > (2021-05-10 17:09:47): [kcm] [key_by_uuid] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_name_by_uuid_send] (0x2000): Got ccache by UUID > (2021-05-10 17:09:47): [kcm] [kcm_op_get_default_ccache_reply_step] (0x2000): The default ccache is 1001 > (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_DEFAULT_CACHE returned [0]: Success > (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply > (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 9 bytes of payload > (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001 > (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent! > (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 9 > (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 8 > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_PRINCIPAL > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 5 bytes on KCM input > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately > (2021-05-10 17:09:47): [kcm] [kcm_op_get_principal_send] (0x1000): Requested principal 1001 > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Getting ccache by name > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree > (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896- > bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets > (2021-05-10 17:09:47): [kcm] [key_by_name] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] is [cn=5005e896-bdfb-4116-8a11- > eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [secdb_cc_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [secdb_cc_key_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b- > 1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=base > (2021-05-10 17:09:47): [kcm] [secdb_get_cc] (0x2000): Fetched the ccache > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Got ccache by name > (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_PRINCIPAL returned [0]: Success > (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply > (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 37 bytes of payload > (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001 > (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent! > (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 9 > (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 8 > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_PRINCIPAL > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 5 bytes on KCM input > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately > (2021-05-10 17:09:47): [kcm] [kcm_op_get_principal_send] (0x1000): Requested principal 1001 > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Getting ccache by name > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree > (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896- > bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets > (2021-05-10 17:09:47): [kcm] [key_by_name] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] is [cn=5005e896-bdfb-4116-8a11- > eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [secdb_cc_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [secdb_cc_key_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b- > 1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=base > (2021-05-10 17:09:47): [kcm] [secdb_get_cc] (0x2000): Fetched the ccache > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Got ccache by name > (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_PRINCIPAL returned [0]: Success > (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply > (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 37 bytes of payload > (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001 > (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent! > (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 9 > (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 8 > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation GET_PRINCIPAL > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 5 bytes on KCM input > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x0200): Adding request by 1001 to the wait queue > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_get] (0x1000): No existing queue for this ID > (2021-05-10 17:09:47): [kcm] [kcm_op_queue_send] (0x1000): Queue was empty, running the request immediately > (2021-05-10 17:09:47): [kcm] [kcm_op_get_principal_send] (0x1000): Requested principal 1001 > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Getting ccache by name > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/] is [cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [secdb_container_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/ > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x0400): Listing keys at [persistent/1001/ccache/] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=subtree > (2021-05-10 17:09:47): [kcm] [local_dn_to_path] (0x2000): Secrets path for [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] is [5005e896- > bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_list] (0x1000): Returning 1 secrets > (2021-05-10 17:09:47): [kcm] [key_by_name] (0x2000): Found key 5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [sss_sec_map_path] (0x1000): Mapping prefix /kcm/ > (2021-05-10 17:09:47): [kcm] [kcm_map_url_to_path] (0x1000): User-specific KCM path is [/kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [local_db_dn] (0x2000): Local path for [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] is [cn=5005e896-bdfb-4116-8a11- > eedacad1fa5b-1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] > (2021-05-10 17:09:47): [kcm] [sss_sec_new_req] (0x1000): Local DB path is persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [secdb_cc_url_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [secdb_cc_key_req] (0x2000): Created request for URL /kcm/persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001 > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x0400): Retrieving a secret from [persistent/1001/ccache/5005e896-bdfb-4116-8a11-eedacad1fa5b-1001] > (2021-05-10 17:09:47): [kcm] [sss_sec_get] (0x2000): Searching for [(|(type=simple)(type=binary))] at [cn=5005e896-bdfb-4116-8a11-eedacad1fa5b- > 1001,cn=ccache,cn=1001,cn=persistent,cn=kcm] with scope=base > (2021-05-10 17:09:47): [kcm] [secdb_get_cc] (0x2000): Fetched the ccache > (2021-05-10 17:09:47): [kcm] [ccdb_secdb_getbyname_send] (0x2000): Got ccache by name > (2021-05-10 17:09:47): [kcm] [kcm_cmd_done] (0x0400): KCM operation GET_PRINCIPAL returned [0]: Success > (2021-05-10 17:09:47): [kcm] [kcm_send_reply] (0x2000): Sending a reply > (2021-05-10 17:09:47): [kcm] [kcm_output_construct] (0x1000): Sending a reply with 37 bytes of payload > (2021-05-10 17:09:47): [kcm] [queue_removal_cb] (0x0200): Removed queue for 1001 > (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent! > (2021-05-10 17:09:47): [kcm] [kcm_input_parse] (0x1000): Received message with length 132 > (2021-05-10 17:09:47): [kcm] [kcm_get_opt] (0x2000): The client requested operation 7 > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0400): KCM operation RETRIEVE > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x1000): 128 bytes on KCM input > (2021-05-10 17:09:47): [kcm] [kcm_cmd_send] (0x0020): KCM op RETRIEVE has no handler > (2021-05-10 17:09:47): [kcm] [kcm_cmd_request_done] (0x0040): KCM operation failed [1432158292]: KCM operation not implemented > (2021-05-10 17:09:47): [kcm] [kcm_reply_error] (0x0040): KCM operation returns failure [1432158292]: KCM operation not implemented > (2021-05-10 17:09:47): [kcm] [kcm_failbuf_construct] (0x1000): Sent reply with error -1765328137 > (2021-05-10 17:09:47): [kcm] [kcm_send] (0x2000): All data sent! > (2021-05-10 17:09:47): [kcm] [kcm_recv] (0x4000): Client closed connection. > (2021-05-10 17:09:47): [kcm] [client_close_fn] (0x2000): Terminated client [0x56377e20ead0][14] > > > _______________________________________________ > sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org > To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.… > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure >

1 0

AD user attribute refresh interval
by Ronald Wimmer 10 May '21

10 May '21

Today I had a web session with some collegues trying to log in with an AD user on an IPA client system. We found out that the user account was expired. After having reactivated that particular user we still saw "AD user account expired" in the SSSD logs of that system. Which settings can I use on the SSSD side (when a user is expired, locked, changes its password, etc.) in order to get AD user attribute changes reflected immediately on the FreeIPA side. Cheers, Ronald

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2021