January 2022 - FreeIPA-users - Fedora mailing-lists

IPA managed sub CA with no subject name constraint
by Omar Aloraini 21 Jan '22

21 Jan '22

I'm trying to create a sub CA that is managed by IPA and be able to sign certificates with arbitrary subjects. You can create a profile for a sub CA and sign the sub CA certificate. I have followed this guide previously with success: https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordina… Doing it this way, you have to manage the private key yourself. What I want to do now is to let IPA manage the private key and the sub CA just like the root CA. This will let me use the IPA API to request certificates with the issuesr set to the sub CA. I did roughly the following: # ipa ca-add kubernetes-ca --subject=CN=kubernetes-ca,O=$DOMAIN --desc='Kubernetes general CA' # ipa ca-add etcd-ca --subject=CN=etcd-ca,O=$DOMAIN --desc='For all etcd-related functions' # ipa ca-add kubernetes-front-proxy-ca --subject=CN=kubernetes-front-proxy-ca,O=$DOMAIN --desc='For the front-end proxy' # ipa certprofile-import ipaSubCA --desc "IPA Managed Sub CA certs" --file subCA.cfg --store=1 # ipa host-add --no-reverse --force k8s.$DOMAIN # ipa caacl-add ipaSubCA # ipa caacl-add-ca ipaSubCA --ca kubernetes-ca # ipa caacl-add-profile ipaSubCA --certprofile ipaSubCA # ipa caacl-add-host ipaSubCA --hosts k8s.$DOMAIN When creating the profile, I removed the common name constraint and the commonNameToSANDefaultImpl as per the guide. My ipaSubCA.cfg auth.instance_id=raCertAuth classId=caEnrollImpl desc=This certificate profile is for enrolling server certificates with IPA-RA agent authentication. enable=true enableBy=ipara input.i1.class_id=certReqInputImpl input.i2.class_id=submitterInfoInputImpl input.list=i1,i2 name=IPA-RA Agent-Authenticated Server Certificate Enrollment output.list=o1 output.o1.class_id=certOutputImpl policyset.list=serverCertSet policyset.serverCertSet.1.constraint.class_id=noConstraintImpl policyset.serverCertSet.1.constraint.name=No Constraint policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl policyset.serverCertSet.1.default.name=Subject Name Default policyset.serverCertSet.10.constraint.class_id=noConstraintImpl policyset.serverCertSet.10.constraint.name=No Constraint policyset.serverCertSet.10.default.class_id =subjectKeyIdentifierExtDefaultImpl policyset.serverCertSet.10.default.name=Subject Key Identifier Extension Default policyset.serverCertSet.10.default.params.critical=false policyset.serverCertSet.11.constraint.class_id=noConstraintImpl policyset.serverCertSet.11.constraint.name=No Constraint policyset.serverCertSet.11.default.class_id=userExtensionDefaultImpl policyset.serverCertSet.11.default.name=User Supplied Extension Default policyset.serverCertSet.11.default.params.userExtOID=2.5.29.17 policyset.serverCertSet.12.constraint.class_id=noConstraintImpl policyset.serverCertSet.12.constraint.name=No Constraint policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl policyset.serverCertSet.12.default.name=Copy Common Name to Subject Alternative Name policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl policyset.serverCertSet.2.constraint.name=Validity Constraint policyset.serverCertSet.2.constraint.params.notAfterCheck=false policyset.serverCertSet.2.constraint.params.notBeforeCheck=false policyset.serverCertSet.2.constraint.params.range=365 policyset.serverCertSet.2.default.class_id=validityDefaultImpl policyset.serverCertSet.2.default.name=Validity Default policyset.serverCertSet.2.default.params.range=365 policyset.serverCertSet.2.default.params.startTime=0 policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl policyset.serverCertSet.3.constraint.name=Key Constraint policyset.serverCertSet.3.constraint.params.keyParameters =1024,2048,3072,4096,8192 policyset.serverCertSet.3.constraint.params.keyType=RSA policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl policyset.serverCertSet.3.default.name=Key Default policyset.serverCertSet.4.constraint.class_id=noConstraintImpl policyset.serverCertSet.4.constraint.name=No Constraint policyset.serverCertSet.4.default.class_id =authorityKeyIdentifierExtDefaultImpl policyset.serverCertSet.4.default.name=Authority Key Identifier Default policyset.serverCertSet.5.constraint.class_id=noConstraintImpl policyset.serverCertSet.5.constraint.name=No Constraint policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl policyset.serverCertSet.5.default.name=AIA Extension Default policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0 =URIName policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0= http://ipa-ca.home.arpa/ca/ocsp policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0 =1.3.6.1.5.5.7.48.1 policyset.serverCertSet.5.default.params.authInfoAccessCritical=false policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1 policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint policyset.serverCertSet.6.constraint.params.keyUsageCritical=true policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl policyset.serverCertSet.6.default.name=Key Usage Default policyset.serverCertSet.6.default.params.keyUsageCritical=true policyset.serverCertSet.6.default.params.keyUsageCrlSign=false policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=false policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=true policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=true policyset.serverCertSet.7.constraint.class_id=noConstraintImpl policyset.serverCertSet.7.constraint.name=No Constraint policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default policyset.serverCertSet.7.default.params.exKeyUsageCritical=false policyset.serverCertSet.7.default.params.exKeyUsageOIDs =1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2 policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl policyset.serverCertSet.8.constraint.name=No Constraint policyset.serverCertSet.8.constraint.params.signingAlgsAllowed =SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withEC,SHA512withEC policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl policyset.serverCertSet.8.default.name=Signing Alg policyset.serverCertSet.8.default.params.signingAlg=- policyset.serverCertSet.9.constraint.class_id=noConstraintImpl policyset.serverCertSet.9.constraint.name=No Constraint policyset.serverCertSet.9.default.class_id =crlDistributionPointsExtDefaultImpl policyset.serverCertSet.9.default.name=CRL Distribution Points Extension Default policyset.serverCertSet.9.default.params.crlDistPointsCritical=false policyset.serverCertSet.9.default.params.crlDistPointsEnable_0=true policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0=CN=Certificate Authority,o=ipaca policyset.serverCertSet.9.default.params.crlDistPointsIssuerType_0 =DirectoryName policyset.serverCertSet.9.default.params.crlDistPointsNum=1 policyset.serverCertSet.9.default.params.crlDistPointsPointName_0= http://ipa-ca.home.arpa/ipa/crl/MasterCRL.bin policyset.serverCertSet.9.default.params.crlDistPointsPointType_0=URIName policyset.serverCertSet.9.default.params.crlDistPointsReasons_0= policyset.serverCertSet.list=1,2,3,4,5,6,7,8,9,10,11 profileId=ipaSubCA visible=false When I try to generate a certificate using ipa-getcert: sudo ipa-getcert request -f /etc/pki/tls/certs/app12.crt -k /etc/pki/tls/private/app12.key -K host/ipa.home.arpa -X kubernetes-ca -N kube-apiserver --profile ipaSubCA I get the following error: Server at https://ipa.home.arpa/ipa/json denied our request, giving up: 3009 (invalid 'csr': hostname in subject of request 'kube-apiserver' does not match name or aliases of principal 'host/ipa.home.arpa(a)HOME.ARPA') I'm not really fimilar with IPA design, but I'm guessing the there is validation happening at both IPA(caacl) and dogtag. Is it possible to get such configratuon working? Or should I just mange the private key myself? I haven't tried prinipal aliases. They might work, but they are global object which will cause problems for me. thanks,

2 1

freeipa-client 4.9.8 in Debian 11 backports
by Timo Aaltonen 20 Jan '22

20 Jan '22

Hi! freeipa-client is finally in bullseye-backports, feel free to report bugs (if any) on bugs.debian.org. t

3 2

Web service to receive callbacks via HTTP
by akshay p 19 Jan '22

19 Jan '22

I need to trap various FreeIPA events such as user addition or deletion. If I can trap these events (perhaps via callbacks), then I can do things like backing up home directories during user deletion or sending out a welcome mail on user addition. Similarly, when staging users are added, I can use a callback and send an email to the admin notifying them of the same. I can build a web service to receive callbacks via HTTP. Or if there is any other way to hook into the FreeIPA workflow, I will be glad to do that well.

2 1

Importing automount maps
by Simon Matthews 18 Jan '22

18 Jan '22

The Redhat documentation provides a script for importing automount maps. The script also uses ldapadd to add some data into the LDAP server. This part doesn't appear to work. It's not clear to me that this part needs to work. The part of the script is: basedn=$(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:) cat > /tmp/amap.ldif <<EOF dn: nis-domain=$2+nis-map=$4,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: $2 nis-map: $4 nis-base: automountmapname=$4,cn=$1,cn=automount,$basedn nis-filter: (objectclass=*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} EOF ldapadd -x -h $3 -D "cn=Directory Manager" -W -f /tmp/amap.ldif Apart from the fact that $3 is probably the wrong variable (it points to the hostname of the NIS server, which is likely different), when I try to run it, I get: ldapadd -x -D "cn=Directory Manager" -W -f /tmp/amap.ldif Enter LDAP Password: adding new entry "nis-domain=blue+nis-map=auto.home,cn=NIS Server,cn=plugins,cn=config" ldap_add: No such object (32) The file /tmp/amap.ldif contains: dn: nis-domain=blue+nis-map=auto.home,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject nis-domain: blue nis-map: auto.home nis-base: automountmapname=auto.home,cn=default,cn=automount,dc=ipa,dc=bluepearlsoftware,dc=com nis-filter: (objectclass=*) nis-key-format: %{automountKey} nis-value-format: %{automountInformation} ["blue" is my NIS domain].

2 3

KDC Self Signed Certificate Creation
by Mark Selby 18 Jan '22

18 Jan '22

My company has 6 FreeIPA servers across 3 different locations. Five of the six servers are ok, but one we could not login to. The error messages pointed to the expired certificate located at `/var/kerberos/krb5kdc/kdc.crt` My question is how do I "properly" renew or recreate this certificate. I have been able to renew it with the command listed below - but the renewed cert does not have the same characteristics as the other certs. The existing ones all see to be self signed with the specified profile while my new one does not have these features. It seems to be working Ok but it would great to understand how to generate this cert correctly. All is any help is greatly appreciated. The servers that work all display the following with using getcert list -f /var/kerberos/krb5kdc/kdc.crt Request ID '20191003181545': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=ipa01.sub1.acme.org,O=ACME.ORG subject: CN=ipa01.sub1.acme.org,O=ACME.ORG expires: 2022-08-09 22:06:33 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Using the local-getcert start-tracking command below gets me an updated cert but it is not self signed and does not have the specified profile. local-getcert start-tracking \ -k /var/kerberos/krb5kdc/kdc.key \ -f /var/kerberos/krb5kdc/kdc.crt \ -T KDCs_PKINIT_Certs \ -C /usr/libexec/ipa/certmonger/renew_kdc_cert Request ID '20220117193849': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: local issuer: CN=Certificate Authority,O=ACME.ORG subject: CN=vipa06.sub3.acme.org,O=ACME.ORG expires: 2024-01-18 17:32:20 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes

2 2

healthcheck - Invalid PKI instance: pki-tomcat
by lejeczek 18 Jan '22

18 Jan '22

Hi guys. adding second master failed a number of times so I did go without '--setup-ca', now on that master I get lots of: Invalid PKI instance: pki-tomcat: { "source": "pki.server.healthcheck.certs.expiration", "check": "CASystemCertExpiryCheck", "result": "CRITICAL", "uuid": "7b920e6a-4f47-4541-80fa-e9d87dadff20", "when": "20220118102040Z", "duration": "0.000175", "kw": { "msg": "Invalid PKI instance: pki-tomcat" } }, ... { "source": "ipahealthcheck.ipa.certs", "check": "IPACertfileExpirationCheck", "result": "ERROR", "uuid": "fb01a7bd-3457-4007-8c3d-66662e23b6df", "when": "20220118102040Z", "duration": "0.006617", "kw": { "key": "20210709164208", "dbdir": "/etc/pki/pki-tomcat/alias", "nickname": "auditSigningCert cert-pki-kra", "error": "NSSDB '/etc/pki/pki-tomcat/alias' not initialized.", "msg": "Request id {key}: Unable to retrieve cert '{nickname}' from '{dbdir}': {error}" } }, .. first master's healthcheck does not mention these problems. Is it that IPA - falsely - believe that this second master is CA/KRA? If so, then how to resolve this - this second master, according to '--uinstall' was removed successfully(each time '--setup-ca' failed) many thanks, L.

3 3

Automatic direcotry deletion on user removal
by akshay p 18 Jan '22

18 Jan '22

Hi, I was wondering if there is a way to automatically delete home directory on user deletion. If not i would like to learn and possibly do something that would enable me to do such a task. I ask you for pointers and thoughts on this matter. Thank you.

2 1

DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by
by lejeczek 18 Jan '22

18 Jan '22

Hi guys, That's new, well, I've never seen it. I got on a replica candidate so I thought I'd make a first new master and yet: -> $ ipa-server-install --setup-dns --setup-kra --no-forwarders --idstart=57400000 --admin-password=diradm --ds-password=dirsrv --enable-compat --setup-adtrust ... [6/9]: configure certificate renewals [error] DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information in log file: ... 2022-01-18T13:30:02Z DEBUG [6/9]: configure certificate renewals 2022-01-18T13:30:02Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2022-01-18T13:30:03Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation run_step(full_msg, method) File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step method() File "/usr/lib/python3.6/site-packages/ipaserver/install/dogtaginstance.py", line 486, in configur e_renewal profile=self.tracking_reqs[nickname], File "/usr/lib/python3.6/site-packages/ipalib/install/certmonger.py", line 576, in start_tracking result = cm.obj_if.add_request(params) File "/usr/lib64/python3.6/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python3.6/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) dbus.exceptions.DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location i s already used by request with nickname "20210709164208". 2022-01-18T13:30:03Z DEBUG [error] DBusException: org.fedorahosted.certmonger.duplicate: Certifica te at same location is already used by request with nickname "20210709164208". 2022-01-18T13:30:03Z DEBUG Removing /var/lib/ipa/tmp-brry92se 2022-01-18T13:30:03Z DEBUG Removing /root/.dogtag/pki-tomcat/kra 2022-01-18T13:30:03Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 18 0, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run return cfgr.run() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run return self.execute() File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute for rval in self._executor(): File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner exc_handler(exc_info) File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_ex ception How could this be, with first master?? many thanks, L.

2 2

Replica KRA install - Certificate at same location is already used
by lejeczek 18 Jan '22

18 Jan '22

Hi guys. Is this critical on its face and un/reinstall is necessary or some troubleshooting can still reveal it's all good? ... [4/10]: destroying installation admin user [5/10]: enabling ephemeral requests [6/10]: restarting KRA [7/10]: configure certmonger for renewals [8/10]: configure certificate renewals [error] DBusException: org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". Your system may be partly configured. If you run into issues, you may have to re-install IPA on this server. org.fedorahosted.certmonger.duplicate: Certificate at same location is already used by request with nickname "20210709164208". many thanks, L.

2 1

Re: IPA broken after dnf update on CentOS 8
by Abhinav Chittora 18 Jan '22

18 Jan '22

Attaching the output of journalctl -u pki-tomcatd@pki-tomcat *--With Regards, Abhinav Chittora*

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2022