July 2021 - FreeIPA-users - Fedora mailing-lists

Limit the number of concurrent logins?
by Galvanick Lucipher 20 Jul '21

20 Jul '21

Hi all, I would like to use FreeIPA to restrict the number of simultaneous logins to a given account, e.g. to prevent two active sessions simultaneously (or at least capture the number of concurrent logins, so I can e.g. send an alarm if Nlogins > 1). I've searched through the docs, but haven't found how to do it, neither at the FreeIPA level nor at the LDAP or Kerberos levels. Is it possible to limit the number of simultaneous logins to a FreeIPA account? Thanks for your help, GK

2 1

FreeIPA server packages upgrade best practice
by Suchismita Panda 16 Jul '21

16 Jul '21

Hi, I would like to know the best practice for patching FreeIPA-Server packages. We generally have daily patching enabled in our servers. Will it be a good idea to do automatic patching of FreeIPA-Server packages? If we want to restrict the FreeIPA-Server packages from automatomatic upgrade and rather keep it for manual upgrade, what are the packages we should hold back with a version restriction? And how frequently should we do the manual upgrade? If the FreeIPA-client packages are upgraded regularly by daily patching(yum-cron or unattended upgrade) will there be any problem with authentication, if the FreeIPA-Servers are behind version upgrade? We have two FreeIPA environments, one with CentOS7 and another with CentOS8. And we have FreeIPA clients mostly with Ubuntu(18 and 20) and CentOS (7 and 8). Any help and guidance is appreciated. Thanks Suchi

4 7

group name not resolved in IPA server for override
by iulian roman 15 Jul '21

15 Jul '21

Hello, I have an issue with the group override on the IPA server. When I run the id command it does display all the group members , but for the primary GID which is overwritten it does not display the name, only the ID. - groups userid groups: cannot find name for group ID 20309 ( but it does correctly resolve the others ) - getent group <GID> does not display anything either - if I manually run getent group <username> all the above commands will run and display all the information successfully Any advice what might be wrong and how to enforce it to be resolved directly, without the getent group workaround ?

1 1

No more automatic web UI login with Kerberos
by Kees Bakker 14 Jul '21

14 Jul '21

Hi, Before I recently upgraded my CentOS 8 Stream masters I was able to automatically login using the Kerberos ticket. On the older (CentOS 7) that still works. But not on the two newer systems. Everytime I refresh the login page a new file is created in /run/ipa/ccaches And the following shows up in the log. jul 13 14:49:36 iparep4.example.com [577]: GSSAPI client step 1 jul 13 14:49:36 iparep4.example.com [577]: GSSAPI client step 1 jul 13 14:49:36 iparep4.example.com [577]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) jul 13 14:49:37 iparep4.example.com [576]: GSSAPI client step 1 jul 13 14:49:37 iparep4.example.com [576]: GSSAPI client step 1 jul 13 14:49:37 iparep4.example.com [576]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) Logging with a username and password still works, but not the automatic Kerberos login. How can I debug this further? -- Kees

1 0

Changing IPA AD Account sync to new AD domain
by Jim Kilborn 14 Jul '21

14 Jul '21

We have migrated our AD users to a new domain (ie example.com -> examplenew.com) and I now need to change our IPA AD sync replication to use the new domain. I can remove the old replication agreement and create the new one, but my question is what happens to the users accounts. The AD usernames didnt change during the migration, but the SID will be different due to it being a new account in a new domain. Will IPA just associated that username with the one already in IPA, or will it try to create another account with a different UID/GID in ipa?

3 3

healthcheck complains about a removed replica
by Kees Bakker 13 Jul '21

13 Jul '21

Hi, After installing a new replica and running /usr/bin/ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data I'm getting this error keyctl_search: Required key not available Enter password for Internal Key Storage Token: Internal server error HTTPSConnectionPool(host='iparep3.ghs.nl', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fc473262a90>: Failed to establish a new connection: [Errno 113] No route to host',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "c2f3ec1d-494b-4f6a-b6e3-0e38108f2005", "when": "20210528150818Z", "duration": "30.348789", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: iparep3.ghs.nl Port: 443" } } ] First, it is asking for a password, and I have no clue for what. I've tried the admin password and the Directory Manager password. It makes no difference. Second, it tries to connect to a replica that was removed several months ago. Both ipa-replica-manage list and ipa-csreplica-manage show the correct list of masters that we currently have. Where does ipa-healthcheck get the information from to query the removed replica? BTW. Two replica run CentOS 8 Stream, and one runs CentOS 7. The first two give this healthcheck error, the centos7 master does not. -- Kees

5 19

ldap_extended_operation fails on the client
by iulian roman 13 Jul '21

13 Jul '21

Hello everybody, In the client logs I get the error bellow when querying AD users: [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: Time limit exceeded(3), (null). (Tue Jul 13 10:47:46 2021) [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed, server logs might contain more details. (Tue Jul 13 10:47:46 2021) [sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed. (Tue Jul 13 10:47:46 2021) [sssd[be[ipa.example.com]]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: [1432158229]: Network I/O Error. I've enabled nss debug on the server, and for that timestamp, the error is: (2021-07-13 10:47:46): [nss] [cache_req_search_cache] (0x0020): CR #415: Multiple objects were found when only one was expected! (2021-07-13 10:47:46): [nss] [cache_req_process_result] (0x0400): CR #415: Finished: Error 1432158305: Multiple objects were found when only one was expected (2021-07-13 10:47:46): [nss] [nss_protocol_done] (0x4000): Sending reply: error [1432158305]: Multiple objects were found when only one was expected (2021-07-13 10:47:46): [nss] [client_recv] (0x0200): Client disconnected! (2021-07-13 10:47:46): [nss] [client_close_fn] (0x2000): Terminated client [0x55930a1916f0][12] The GID it is trying to search corresponds to "Domain Users" group from AD (GID:1768200513), which is the default primary group for all users. ldbsearch against the cache shows only one dn: entry for the "Domain Users". Nevertheless , when running groups command for any user, it displays: "cannot find name for group ID 1768200513 " getent group 1768200513 does not resolve the group name to "Domain Users" either. Any hint or help would be really appreciated.

2 2

Using Subject Alternative Name in smart card certificate for authentication
by Angelo Alvarez 13 Jul '21

13 Jul '21

Aloha. I've configured our IdM server as an OpenLDAP identity provider for our VMware vCenter 6.7 server. I'm able to login to our vCenter as the IdM user with username and password, but I'm unable to authenticate using smart card authentication. My IdM domain is "xxxx.xxxx.mil", but my smart card is issued by the DoD, and the Subject Alternative Name (SAN) on my identity certificate shows ex."Principal Name=1234567897000@mil". When we used Active Directory authentication with vCenter, the user account properties for UPN needed to match the SAN value (ex.1234567897000@mil) from the users identiy certificate. That said, if our domain name is ""xxxx.xxxx.mil", is it possible to have an IdM user account with username "first.last.usr" and a SSL certificate mapping that uses all or a portion of the SAN value (ex. "Principal Name=123456789700@mil") for smart card authentication?

3 2

smart card authentication
by Angelo Alvarez 13 Jul '21

13 Jul '21

Aloha. If I configure users to authenticate using smart card, is it possible to disable the user's password, so it can no longer be used for authentication and does not require updating every 60 days, etc.?

2 2

[SSSD] Announcing SSSD 2.5.2
by Pavel Březina 12 Jul '21

12 Jul '21

# SSSD 2.5.2 The SSSD team is proud to announce the release of version 2.5.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.5.2 See the full release notes at: https://sssd.io/release-notes/sssd-2.5.2.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * `originalADgidNumber` attribute in the SSSD cache is now indexed ### New features * Debug messages in data provider include a unique request ID that can be used to track the request from its start to its end (requires `libtevent` >= 0.11.0) ### Important fixes * Update large files in the files provider in batches to avoid timeouts ### Configuration changes * Add new config option `fallback_to_nss`

1 0

ipahealthcheck: ldapsearch finds no replconflict but nsconf does
by Kees Bakker 12 Jul '21

12 Jul '21

Hi, ipahealthcheck gives me this warning [ { "source": "ipahealthcheck.ds.replication", "check": "ReplicationCheck", "result": "WARNING", "uuid": "237f4271-6e93-4d42-a15d-accdb936e51b", "when": "20210709182051Z", "duration": "45.967890", "kw": { "key": "DSREPLLE0002", "items": [ "Replication", "Conflict Entries" ], "msg": "There were 1 conflict entries found under the replication suffix \"o=ipaca\"." } } ] ldapsearch does not reveal any hit, however nsconf does. [root@linge ~]# ldapsearch -H ldaps://linge.example.com -W -D 'cn=Directory Manager' -b 'o=ipaca' '(nsds5ReplConflict=*)' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <o=ipaca> with scope subtree # filter: (nsds5ReplConflict=*) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@linge ~]# dsconf slapd-EXAMPLE-COM repl-conflict list o=ipaca dn: cn=iparep4.example.com:443+nsuniqueid=ee993401-84ef11eb-93f498e2-54354ddc,cn=CAList,ou=Security Domain,o=ipaca Clone: TRUE DomainManager: TRUE SecureAdminPort: 443 SecureAgentPort: 443 SecureEEClientAuthPort: 443 SecurePort: 443 SubsystemName: CA iparep4.example.com 8443 UnSecurePort: 80 cn: iparep4.example.com:443 host: iparep4.example.com nsds5replconflict: namingConflict (ADD) cn=iparep4.example.com:443,cn=calist,ou=security domain,o=ipaca objectClass: top objectClass: pkiSubsystem objectClass: ldapsubentry How is that possible? -- Kees

3 5

Certificate profile to ignore (drop) email in SAN - possible?
by Ian Pilcher 12 Jul '21

12 Jul '21

I've hit a roadblock while trying to generate a certificate for a VMware vSphere appliance. The VMware "Certificate Management" tool doesn't allow one to upload a certificate and key. Instead, one has to generate a CSR in the VMware GUI which then gets submitted to the CA (IPA in this case). Unfortunately, the VMware tool refuses to generate a CSR that does not include an email address in its subject alternative names extension, and IPA refuses to issue a host or service certificate that includes an email address. Is it possible to create a certificate profile that will simply ignore the email address (i.e. not include it in the SAN of the issued certificate)? -- ======================================================================== In Soviet Russia, Google searches you! ========================================================================

3 3

Multiple ID views question
by iulian roman 09 Jul '21

09 Jul '21

Hello, Due to the fact that I have some issues with ID views and different sssd versions, I tried a different approach. I created a second ID view , where I do override some users only for a group of systems. The override in the second id view (both for users and groups) is different that the one in the main Default Trust View. Is that supported , because as far as I can see on the IPA server, it still uses the main ID view when it does the query instead of the second ID view I created , although on the client I can see that the query is on the second ID view ? How will the cache on the ipa client and ipa server get in sync ?

3 4

left-right VS both
by lejeczek 09 Jul '21

09 Jul '21

Hi guys. Would you know why addition of new replica/master via 'ipa-replica-install --setup-ca ..' in 'domain' topology creates 'both' type of segment but in 'ca' it is 'left-right' x 2 ? If that is by design then what is the rationale? many thanks, L

2 1

ipa-ca dns record misformed during ipa upgrade
by Kees Bakker 09 Jul '21

09 Jul '21

Hi, Yesterday I upgraded one of the masters (CentOS 8 Stream, from 4.9.2 => 4.9.3) and in the process it modified ipa-ca to only have its own IP address. Here is an extract from ipaupgrade.log 2021-07-08T18:37:29Z DEBUG raw: server_role_find(None, server_server='rotte.example.com', status='enabled', include_master=True, version='2.240') 2021-07-08T18:37:29Z DEBUG server_role_find(None, server_server='rotte.example.com', status='enabled', include_master=True, all=False, raw=False, version='2.240') 2021-07-08T18:37:29Z DEBUG raw: server_role_find(None, server_server='iparep4.example.com', status='enabled', include_master=True, version='2.240') 2021-07-08T18:37:29Z DEBUG server_role_find(None, server_server='iparep4.example.com', status='enabled', include_master=True, all=False, raw=False, version='2.240') 2021-07-08T18:37:29Z DEBUG raw: server_role_find(None, server_server='linge.example.com', status='enabled', include_master=True, version='2.240') 2021-07-08T18:37:29Z DEBUG server_role_find(None, server_server='linge.example.com', status='enabled', include_master=True, all=False, raw=False, version='2.240') 2021-07-08T18:37:29Z DEBUG raw: dnszone_show(<DNS name example.com.>, version='2.240') 2021-07-08T18:37:29Z DEBUG dnszone_show(<DNS name example.com.>, rights=False, all=False, raw=False, version='2.240') 2021-07-08T18:37:29Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:32Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:35Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:38Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:41Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:44Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:44Z ERROR unable to resolve host name iparep4.example.com. to IP address, ipa-ca DNS record will be incomplete 2021-07-08T18:37:44Z DEBUG Name linge.example.com. resolved to {UnsafeIPAddress('172.16.16.10'), UnsafeIPAddress('fe80::529a:4cff:fe9d:3b10')} 2021-07-08T18:37:44Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:47Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:50Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:37:53Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known 2021-07-08T18:38:01Z ERROR unable to resolve host name rotte.example.com. to IP address, ipa-ca DNS record will be incomplete ... 2021-07-08T18:38:02Z DEBUG raw: dnsrecord_mod(<DNS name example.com.>, <DNS name ipa-ca.example.com.>, arecord=['172.16.16.10'], aaaarecord=['fe80::529a:4cff:fe9d:3b10'], version='2.240') 2021-07-08T18:38:02Z DEBUG dnsrecord_mod(<DNS name example.com.>, <DNS name ipa-ca.example.com.>, arecord=('172.16.16.10',), aaaarecord=('fe80::529a:4cff:fe9d:3b10',), rights=False, structured=False, all=False, raw=False, version='2.240') That's a bit puzzling. Why couldn't it find these two hostnames during the upgrade? /etc/resolv.conf: nameserver 127.0.0.1 There does not seem to be anything wrong (before and after the upgrade). Both hostname names resolve perfectly well. The only thing I can think of (wild guess) is that the nameservers are configured with dnssec disabled. Could that be it? -- Kees

1 0

bug in ldap_entry_reconstruct()
by Kees Bakker 08 Jul '21

08 Jul '21

Hey, In two of my three masters I see these error messages. Jul 01 09:38:38 linge.ghs.nl named-pkcs11[6945]: bug in ldap_entry_reconstruct(): protocol violation: attempt to reconstruct non-existing entry Jul 01 09:38:38 linge.ghs.nl named-pkcs11[6945]: ldap_sync_search_entry failed: not found It also so happens that DNS is not updated on these two systems. We only use one master to update DNS, either via the web interface or via DHCP-update. These changes are correctly found in LDAP, on all three systems. However, the two other nameservers don't pick up the changes. There are no "syncrepl_update" messages in the log (after increasing trace level with rndc trace 10). To be honest, I don't know if the above errors are related to the missing updates. I'm grasping at straws here. Something is seriously wrong, but what? How can I debug this further? The two failing systems run CentOS 8 Stream. Some rpm info: 389-ds-base-1.4.3.16-8.module_el8.4.0+644+ed25d39e.x86_64 ipa-server-4.9.2-3.module_el8.5.0+750+c59b186b.x86_64 -- Kees

4 8

Unlocked AD user not usable immediately
by Ronald Wimmer 07 Jul '21

07 Jul '21

Some external users have an AD user account that is allowed (HBAC) to access IPA clients. These users are locked in AD when they are not needed and only unlocked on demand. Which tunables do we have on the IPA side to get the unlocked state reflected immediately in IPA? Cheers, Ronald

1 1

IPA client + AD Trust + ID Override inconsistent lookup results
by iulian roman 07 Jul '21

07 Jul '21

Hello everybody, I try to make the above combination to work in my environment , and already spent several weeks + open a few threads with different sort of issues. So far, I can say that it works only with workarounds , restarts, clear caches, etc , which is not the setup I can move in production with. I try to provide the latest update of the setup and the issues I am currently facing: RedHat Idm with AD trust configured (non-posix) Default Trust View configured which overrides the UID and GID of the AD users The UID and GID do exist in Active Directory (the user and group have the same name) , although the group name is in different OU - I do not know if this is an issue or not On the client, some of the users are resolved, some not. If I manually run getent group <username> before running the id command, it does resolve the group and user. Without running getent group command, sometimes it resolves, sometimes not. I checked the logs on the client and server and the errors I noticed when running id <username> are: on the client: [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null) on the server: [nss] [nss_protocol_fill_initgr] (0x0080): Unable to find primary gid [2]: No such file or directory It seems to be related to the magical primary GID which seems to be the source of all my issues, but I. have no idea how to fix it (the GID exist in AD and it is defined in the Default Trust View). I am considering even changing settings in AD, but I do not know what should I change. I tried to define as well all the AD groups (for which I do group override in Default Trust View) in IPA as posix groups with that specific GID . In that situation for some users the lookup failed first time but after the negative cache expired or sssd is restarted the lookup for the user and group works properly (situation was quite similar with the one in the thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… ). For AD users which do not have attributes overwritten everything works properly.

2 5

permission on ldap subtree
by iulian roman 07 Jul '21

07 Jul '21

Hello, I tried to grant read/search access to a specific subtree in IPA for anonymous bind. The ipa permission-add command completed successfully, but when I try ldapsearch it does not display any objects. ipa permission-show 'read oracle context' Permission name: read oracle context Granted rights: read, search, compare Bind rule type: anonymous Subtree: cn=OracleContext,dc=ipadev,dc=example,dc=com Target DN: cn=*,cn=OracleContext,dc=ipadev,dc=example,dc=com Permission flags: SYSTEM, V2 ldapsearch -h ipadevserver -p 389 -x -b "cn=OracleContext,dc=ipadev,dc=example,dc=com" # extended LDIF # # LDAPv3 # base <cn=OracleContext,dc=ipadev,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Any idea what is wrong or what do I need to change ?

3 8

pki-tomcatd fails to start with LDAP error authentication failed (48)
by Tiemen Ruiten 07 Jul '21

07 Jul '21

Hello, On a newly installed CentOS 8 IPA master (a few days ago), the pki-tomcatd@pki-tomcat service fails to start and logs LDAP authentication failed (48) in /var/log/pki/pki-tomcat/ca/debug.2021-07-01.log. See below. This happened after I dnf upgraded the master and replica at the same time, my mistake. I've gone through the troubleshooting steps described here: https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca… but all certificates appear to be correct. What else can I do? RPM versions: [root@ipa-01 ca]# rpm -qa | grep ipa ipa-healthcheck-0.7-3.module_el8.5.0+750+c59b186b.noarch python3-libipa_hbac-2.4.0-9.el8_4.1.x86_64 sssd-ipa-2.4.0-9.el8_4.1.x86_64 python3-ipalib-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-trust-ad-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 centos-logos-ipa-85.8-1.el8.noarch ipa-healthcheck-core-0.7-3.module_el8.5.0+750+c59b186b.noarch ipa-client-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-selinux-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 python3-ipaclient-4.9.2-4.module_el8.4.0+846+96522ed7.noarch python3-ipaserver-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch libipa_hbac-2.4.0-9.el8_4.1.x86_64 ipa-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-server-dns-4.9.2-4.module_el8.4.0+846+96522ed7.noarch ipa-client-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64 <...> 2021-07-01 17:28:20 [main] INFO: CMSEngine: initializing password store 2021-07-01 17:28:20 [main] INFO: CMSEngine: initializing password store for internaldb 2021-07-01 17:28:20 [main] INFO: CMSEngine: initializing password store for replicationdb 2021-07-01 17:28:20 [main] INFO: CMSEngine: Java version: 1.8.0_292 2021-07-01 17:28:20 [main] INFO: CMSEngine: security providers: 2021-07-01 17:28:20 [main] INFO: PluginRegistry: Loading plugin registry from /var/lib/pki/pki-tomcat/conf/ca/registry.cfg 2021-07-01 17:28:21 [main] SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed netscape.ldap.LDAPException: Authentication failed (48) at netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPSaslBind.bind(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.authenticate(Unknown Source) at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at netscape.ldap.LDAPConnection.connect(Unknown Source) at com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:105) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:284) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:260) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:223) at com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:192) at org.dogtagpki.server.ca.CAEngine.initDatabase(CAEngine.java:186) at com.netscape.cmscore.apps.CMSEngine.start(CMSEngine.java:1002) at com.netscape.cmscore.apps.CMSEngine.contextInitialized(CMSEngine.java:1643) at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4685) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5146) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:717) at org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150) at org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:688) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:705) at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:631) at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1831) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:112) at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:526) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:425) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1576) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:309) at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123) at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:423) at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:366) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:936) at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:841) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384) at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75) at java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134) at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909) at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:262) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardService.startInternal(StandardService.java:421) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:930) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) at org.apache.catalina.startup.Catalina.start(Catalina.java:633) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:343) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:474) <...> -- Tiemen Ruiten Infrastructure Engineer

5 5

Certificate profile to ignore (drop) email in SAN - possible?
by Ian Pilcher 06 Jul '21

06 Jul '21

I've hit a roadblock while trying to generate a certificate for a VMware vSphere appliance. The VMware "Certificate Management" tool doesn't allow one to upload a certificate and key. Instead, one has to generate a CSR in the VMware GUI which then gets submitted to the CA (IPA in this case). Unfortunately, the VMware tool refuses to generate a CSR that does not include an email address in its subject alternative names extension, and IPA refuses to issue a host or service certificate that includes an email address. Is it possible to create a certificate profile that will simply ignore the email address (i.e. not include it in the SAN of the issued certificate)? -- ======================================================================== Ian Pilcher Sr. Principal Product Manager +1 469 892-8704 Red Hat Cloud Platforms ========================================================================

1 0

failing to add additional replica (already 3 in place)
by Rolf Linder 06 Jul '21

06 Jul '21

Hey there Using freeipa on centos (ipa-server-4.6.8-5.el7.centos.6.x86_64) we fail to add an additional replica, but only when enabling CA services (option "--setup-ca"). We use the following command to stage a new replica (and have in the past): > ipa-replica-install --principal admin --admin-password ${adminpw} --setup-dns --no-dnssec-validation --no-forwarder --setup-ca --domain lxusp.local --server [master-idm-node] which we have used to stage the previous replicas too. Log (/var/log/ipareplica-install.log) shows that its stuck in state > DEBUG certmonger request is in state dbus.String(u'SUBMITTING', variant_level=1) Repeated until then aborted by a timeout message (and non-functional replica). Since there are only outdated reports (>2 years old) about slightly similar (but not matching!) behavior like https://bugzilla.redhat.com/show_bug.cgi?id=1623113 we kindly ask if anyone can help here. Best regards, Rolf

2 2

I have installed kerberos , How can I install FreeIPA
by ighack asdf 02 Jul '21

02 Jul '21

I have install kerberos , How can I installed FreeIPA

2 1

FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
by Anthony Joseph Messina 01 Jul '21

01 Jul '21

After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc. May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock The server seems to come up without issue, but can you point me in the right direction to resolve these errors? freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64 I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors. Thanks. -A -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

7 9

centos8 freeipa not starting anymore
by Jelle de Jong 01 Jul '21

01 Jul '21

Hello everybody, All my centos8 freeipa instances at different sites where down this morning. https://pastebin.com/vVfwrNqL I tried disabling firewalld, selinux, downgrade java version, can not get it to work. Did anyone encountered this issue and found a workaround? Kind regards, Jelle de Jong

1 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2021