FreeIPA-users December 2022

freeipa-users@lists.fedorahosted.org

37 participants
62 discussions

Announcement: FreeIPA/IdM Web UI moving to PatternFly 4
by Brian Dellascio 22 Dec '22

22 Dec '22

Hello everyone: We are currently working on a new web user interface (UI) using PatternFly 4, you can find the early source code | https://github.com/freeipa/freeipa-webui A more complete description of this effort was posted under the discussions tab in that repo | https://github.com/freeipa/freeipa-webui/discussions/34 Please feel free to use the discussion commenting feature to post any questions, reactions, or feedback you may have. Thanks so much!

3 2

Re: LDAP error after re-initializing replica server
by Hirata, Tyler 21 Dec '22

21 Dec '22

I was able to get it working by doing the following. I tore down the primary server and stood it up again with ipa-server installed and then I restored it from a backup taken today. On the replica server I created another user account because if my understanding of how the re-initialize command works is correct, that user account shouldn’t be on the replica anymore once it re-initializes with the master since it was created after the backup was taken. After I got the primary restored, I ran the re-initialize command on the replica and it worked! Because I was curious, I performed the same steps I mentioned above, but this time I used an older backup and I started running into the LDAP issues again. My question is, do the backups get a little wonky the older they are? Tyler From: Hirata, Tyler via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Date: Wednesday, December 21, 2022 at 8:18 AM To: Rob Crittenden <rcritten(a)redhat.com>, FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Hirata, Tyler <thirata(a)caltech.edu> Subject: [Freeipa-users] Re: LDAP error after re-initializing replica server Hi Rob, I took two backups from this month. The 1st one I tried was from December 5th, and the more recent one was from the 16th. The replica did exist at the time I took the backup. Are there implications deleting the replica VMs and starting from scratch? The only way I was able to get the restore to work was, I just restored the primary server and then I deleted the VM the replica was on and I rebuilt it and setup replication from scratch. Tyler From: Rob Crittenden <rcritten(a)redhat.com> Date: Wednesday, December 21, 2022 at 5:49 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Hirata, Tyler <thirata(a)caltech.edu> Subject: Re: [Freeipa-users] LDAP error after re-initializing replica server Hirata, Tyler via FreeIPA-users wrote: > I’m testing out IPA and wanted to see how restoring backups work. I > successfully restored an older backup to my master node, but when I hop > on my replica nodes and run the re-initialization command, I get an LDAP > error. I was wondering if anyone has experienced this? > > ipa-replica-manage re-initialize --from ipa1.domain.com > > Update in progress, 15 seconds elapsed > > [ldaps:// ipa1.domain.com:636] reports: Update failed! Status: [Error > (49) - LDAP error: Invalid credentials - no response received] > > > > I’ve cleared all my Kerberos cache by running kdestroy and I restarted > directory services and rebooted the primary and secondary servers. How old was this restore? Did the replica exist when the backup was taken? rob

1 0

Re: LDAP error after re-initializing replica server
by Rob Crittenden 21 Dec '22

21 Dec '22

Hirata, Tyler via FreeIPA-users wrote: > I’m testing out IPA and wanted to see how restoring backups work. I > successfully restored an older backup to my master node, but when I hop > on my replica nodes and run the re-initialization command, I get an LDAP > error. I was wondering if anyone has experienced this? > > ipa-replica-manage re-initialize --from ipa1.domain.com > > Update in progress, 15 seconds elapsed > > [ldaps:// ipa1.domain.com:636] reports: Update failed! Status: [Error > (49) - LDAP error: Invalid credentials - no response received] > > > > I’ve cleared all my Kerberos cache by running kdestroy and I restarted > directory services and rebooted the primary and secondary servers. How old was this restore? Did the replica exist when the backup was taken? rob

2 1

How FreeIPA is connected to 389 Directory Server
by Federico Ferrari 21 Dec '22

21 Dec '22

Hi i'm new to this channel and i'm studying the FreeIPA code in order to understand how things works, so i was wondering how FreeIPA works with 389 Directory Server in order to create the LDAP database and how dose it syncs with the OS users, if you can provide me a link to the code or a brief explanation on how it works it would be very appreciated. Also I was thinking if for FreeIPA it would be possible to support other Directory server such as OpenLDAP or it dose already support other servers, in this case does someone knows which other LDAP server does support, thanks a lot to everyone.

2 1

How FreeIPA is connected to 389 Directory Server
by Federico Ferrari 21 Dec '22

21 Dec '22

2 1

How FreeIPA is connected to 389 Directory Server
by Federico Ferrari 21 Dec '22

21 Dec '22

1 0

LDAP error after re-initializing replica server
by Hirata, Tyler 20 Dec '22

20 Dec '22

I’m testing out IPA and wanted to see how restoring backups work. I successfully restored an older backup to my master node, but when I hop on my replica nodes and run the re-initialization command, I get an LDAP error. I was wondering if anyone has experienced this? ipa-replica-manage re-initialize --from ipa1.domain.com Update in progress, 15 seconds elapsed [ldaps:// ipa1.domain.com:636] reports: Update failed! Status: [Error (49) - LDAP error: Invalid credentials - no response received] I’ve cleared all my Kerberos cache by running kdestroy and I restarted directory services and rebooted the primary and secondary servers. Tyler

1 0

Ubuntu clients and su
by Ranbir 19 Dec '22

19 Dec '22

Hi Everyone, When I try to run "sudo su - [user]" on an Ubuntu 20 or Ubuntu 22 client, I get the error "su: Permisison denied". Upon enabling debug_level = 6 for the domain, I saw in the log the message "Access denied by HBAC rules". Well, that's odd since my user is in a group that is allowed to login to any client using any service. In fact, when I try to run the same command from a CentOS or AlmaLinux client, the su succeeds. After adding the "su" and "su-l" HBAC Services to the group of the user I'm trying to su to, the command worked on the Ubuntu clients. I'm confused as to why the clients are behaving differently. I also don't know which client is responding correctly before adding the "su" and "su-l" HBAC Services to the user group the user is a member of. Has anyone else run into this? Am I doing something incorrectly? -- Ranbir

1 0

FreeIPA CA failing to login with new admin user
by Stasiek Michalski 19 Dec '22

19 Dec '22

Hello, I installed FreeIPA replica on 4.8.4 on CentOS 8 from 4.4.4 from Fedora 25 with `ipa-replica-install --setup-dns --auto-forwarders`, without `--setup-ca` due to errors, which went fine. I do want to install CA though, which failed when I did `--setup-ca` and then later `ipa-ca-install` with the following error: ``` [4/29]: creating installation admin user Unable to log in as uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca on ldap://freeipa.infra.opensuse.org:389 [hint] tune with replication_wait_timeout [error] NotFound: uid=admin-freeipa2.infra.opensuse.org,ou=people,o=ipaca did not replicate to ldap://freeipa.infra.opensuse.org:389 Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ``` Obviously I did try try extending the timeout based on that, but I don't think that was helpful in the end, considering the logs produced by the old server: httpd access_log ``` 192.168.47.90 - - [23/Jul/2020:00:25:36 +0000] "GET /ca/rest/account/login HTTP/1.1" 401 994 ``` server process in journal ``` SSLAuthenticatorWithFallback: Authenticating with BASIC authentication Invalid Credential. at com.netscape.cmscore.authentication.PasswdUserDBAuthentication.authenticate(PasswdUserDBAuthentication.java:167) at com.netscape.cms.realm.PKIRealm.authenticate(PKIRealm.java:63) at com.netscape.cms.tomcat.ProxyRealm.authenticate(ProxyRealm.java:78) at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:94) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.doSubAuthenticate(SSLAuthenticatorWithFallback.java:37) at com.netscape.cms.tomcat.AbstractPKIAuthenticator.doAuthenticate(AbstractPKIAuthenticator.java:98) at com.netscape.cms.tomcat.SSLAuthenticatorWithFallback.authenticate(SSLAuthenticatorWithFallback.java:47) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:579) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502) at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:877) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748) SSLAuthenticatorWithFallback: Fallback auth header: WWW-Authenticate=Basic realm="Certificate Authority" SSLAuthenticatorWithFallback: Fallback auth return code: 401 SSLAuthenticatorWithFallback: Result: false ``` and from pki logs ``` Failed to authenticate as admin UID=admin-freeipa2.infra.opensuse.org. Error: netscape.ldap.LDAPException: error result (49) ``` I don't particularly know how to proceed from here, since those errors don't mean much to me. I see however it's not just me having issues with `ipa-ca-install` at least similar to this one (although by the looks of it, the reason is already different ;) Thanks in advance for trying, LCP [Stasiek] https://lcp.world/

4 6

Error while reading kernel policy
by Ben Aveling 15 Dec '22

15 Dec '22

When a particular user tries to login on a particular host, we are seeing an error in the logs, something like this: (2022-12-15 13:24:51): [selinux_child[1096]] [sss_seuser_exists] (0x0400): seuser exists: no (2022-12-15 13:24:51): [selinux_child[1096]] [seuser_needs_update] (0x0400): The SELinux user does need an update (2022-12-15 13:24:51): [selinux_child[1096]] [libsemanage] (0x0020): Error while reading kernel policy from /etc/selinux/targeted/active/policy.linked. (2022-12-15 13:24:51): [selinux_child[1096]] [main] (0x0020): Cannot set SELinux login context. (2022-12-15 13:24:51): [selinux_child[1096]] [main] (0x0020): selinux_child failed! The file /etc/selinux/targeted/active/policy.linked existed, but was empty. Reproducing on a lab machine, deliberately emptying that file, the problem was reproducible - for new users, though not for old users. Presumably, caching at work, somewhere. Deleting the empty file and then trying again, policy.linked was rebuilt, and then logins started succeeding. (2022-12-15 15:07:03): [selinux_child[3412]] [main] (0x0400): selinux_child started. (2022-12-15 15:07:03): [selinux_child[3412]] [main] (0x0400): context initialized (2022-12-15 15:07:03): [selinux_child[3412]] [main] (0x0400): performing selinux operations (2022-12-15 15:07:03): [selinux_child[3412]] [sss_seuser_exists] (0x0400): seuser exists: no (2022-12-15 15:07:03): [selinux_child[3412]] [seuser_needs_update] (0x0400): The SELinux user does need an update (2022-12-15 15:07:14): [selinux_child[3412]] [pack_buffer] (0x0400): result [0] (2022-12-15 15:07:14): [selinux_child[3412]] [main] (0x0400): selinux_child completed successfully I'm hopeful that the same thing will work on the other box - will let you know if it doesn't. :-)

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2022