FreeIPA-users February 2022

freeipa-users@lists.fedorahosted.org

54 participants
93 discussions

Start a nNew thread

host certs - Organizational Unit - ?
by lejeczek 09 Feb '22

09 Feb '22

Hi guys Is it possible to insert/include Organizational Unit (OU) for host certificates? many thanks, L

2 3

certificate management - best practices - ?
by lejeczek 09 Feb '22

09 Feb '22

Hi guys. I ponder what I think must be trivial for at the same time, also an obvious idea - services & hosts. All the hosts, domain members and all possible or maybe just a handful services, one might run on those hosts - should you want a unique certificate for each host+service or perhaps a single cert for a host which then be used by all services on the host, is a better practice? All ideas & notions shared are greatly appreciated. many thanks, L.

3 5

Need help with confusing query results
by Edward Valley 09 Feb '22

09 Feb '22

Hi there. I'm using latest FreeIPA available on Rocky Linux 8.5 VERSION: 4.9.6, API_VERSION: 2.245 When I run the following LDAP query: ldapsearch -H "ldap://idm-host:389" -x -s sub \ -D "cn=Directory Manager" -w "dm-password" \ -b "cn=users,cn=accounts,dc=..." \ '(objectClass=inetOrgPerson)' \ uid entryUUID I get the following result: (entryUUID is present) # user1, users, accounts, ... dn: uid=user1,cn=users,cn=accounts,dc=... uid: user1 entryUUID: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee # user2, users, accounts, ... dn: uid=user2,cn=users,cn=accounts,dc=... uid: user2 entryUUID: aaaaaaaa-bbbb-cccc-dddd-ffffffffffff But, when I use this query: ldapsearch -H "ldap://idm-host:389" -x -s sub \ -D "cn=Directory Manager" -w "dm-password" \ -b "cn=users,cn=accounts,dc=..." \ '(&(objectClass=inetOrgPerson)(uid=user1))' \ uid entryUUID The result is this one: (No entryUUID attribute) # user1, users, accounts, ... dn: uid=user1,cn=users,cn=accounts,dc=... uid: user1 Can somebody please guide me on what's happening here? If you need more info just tell me. Thank you very much.

3 16

use ipa-user with xorg
by Sascha Hartl 09 Feb '22

09 Feb '22

Hello I'm looking for a solution to use IPA and AD Users via IPA-provider for xorg Sessions on OL8. I've found some methods with "access_provider = ad" or "access_provider = simple" but i use "access_provider = ipa" in the sssd.conf to enforce rules. The login an sudo-rulset works fine, i added the service xrdp to the rules on the server. sssd.conf [domain/mydomain.com] id_provider = ipa dns_discovery_domain = mydomain.com ipa_server = server.mydomain.com ipa_domain = mydomain.com ipa_hostname = host.mydomain.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True ldap_sudo_smart_refresh_interval = 900 ldap_sudo_full_refresh_interval = 300 [sssd] services = nss, pam, ssh, sudo domains = mydomain.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] but i don't know if i have to set some informations in the xrdp.ini [Xorg] name=Xorg lib=libxup.so username=ask password=ask ip=127.0.0.1 port=-1 code=20

2 8

Inconsistent LDAP data for one of my IPA replicas
by William Faulk 09 Feb '22

09 Feb '22

I've got a bunch of replication errors that I'm trying to resolve with a re-initialization, but the biggest one right now is that one of my IPA replicas has inconsistent LDAP attributes and I'm not sure of the best way to proceed. The inconsistent attributes are: * ipaUniqueID * krbPrincipalKey * krbExtraData * krbLastPwdChange Certainly at least the first two seem really significant. I'm hesitant to re-initialize and overwrite data about one of the IPA servers itself. Should I try to delete it as a replica? Try to manually update the data on the replicas with bad data? Just re-initialize from a replica with good data? For the latter two options, how can I determine which data is the correct data?

2 1

gssproxy kerberos cache with no tickets
by Brian J. Murrell 07 Feb '22

07 Feb '22

I am still trying to debug why the webUI on my new replica is not authenticating me. One difference I have noticed between my two replicas, one working and one not is: working replica: # KRB5RCACHEDIR=/var/lib/gssproxy/rcache klist Ticket cache: KCM:0 Default principal: admin(a)EXAMPLE.COM Valid starting Expires Service principal 2022-02-04 08:58:59 2022-02-05 08:58:56 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM 2022-02-04 08:59:03 2022-02-05 08:58:56 HTTP/server-staging.example.com(a)EXAMPLE.COM Non-working replica: # KRB5RCACHEDIR=/var/lib/gssproxy/rcache klist Ticket cache: KEYRING:persistent:0:krb_ccache_AunlIbq Default principal: host/server.example.com(a)EXAMPLE.COM Valid starting Expires Service principal 1969-12-31 19:00:00 1969-12-31 19:00:00 Encrypted/Credentials/v1@X-GSSPROXY: What could cause the latter to not be getting any tickets like the former is? FWIW, the difference in ticket cache type appears to be due to: # cat /etc/krb5.conf.d/kcm_default_ccache # This file should normally be installed by your distribution into a # directory that is included from the Kerberos configuration file (/etc/krb5.conf) # On Fedora/RHEL/CentOS, this is /etc/krb5.conf.d/ # # To enable the KCM credential cache enable the KCM socket and the service: # systemctl enable sssd-secrets.socket sssd-kcm.socket # systemctl start sssd-kcm.socket # # To disable the KCM credential cache, comment out the following lines. [libdefaults] default_ccache_name = KCM: which is due to sssd-kcm-2.4.0-9.el8_4.2.x86_64 being installed on the working replica and not on the non-working replica. Maybe this is a big red herring though? Ultimately gssproxy is reporting the following when I try to log on to the webUI: [2022/02/05 16:08:51]: Debug Enabled (level: 3) [2022/02/05 16:08:51]: Service: ipa-httpd, Keytab: /var/lib/ipa/gssproxy/http.keytab, Enctype: 18 [2022/02/05 16:08:51]: Service: ipa-api, Keytab: /var/lib/ipa/gssproxy/http.keytab, Enctype: 18 [2022/02/05 16:08:51]: Service: ipa-sweeper, Keytab: /var/lib/ipa/gssproxy/http.keytab, Enctype: 18 [2022/02/05 16:08:51]: Service: nfs-server, Keytab: /etc/krb5.keytab, Enctype: 18 [2022/02/05 16:08:51]: Service: nfs-client, Keytab: /etc/krb5.keytab, Enctype: 18 [2022/02/05 16:08:51]: Client [2022/02/05 16:08:51]: (/usr/sbin/gssproxy) [2022/02/05 16:08:51]: connected (fd = 14)[2022/02/05 16:08:51]: (pid = 8306) (uid = 0) (gid = 0)[2022/02/05 16:08:51]: (context = system_u:system_r:kernel_t:s0)[2022/02/05 16:08:51]: [2022/02/05 16:08:59]: Client [2022/02/05 16:08:59]: (/usr/sbin/httpd) [2022/02/05 16:08:59]: connected (fd = 15)[2022/02/05 16:08:59]: (pid = 4266) (uid = 977) (gid = 973)[2022/02/05 16:08:59]: (context = system_u:system_r:httpd_t:s0)[2022/02/05 16:08:59]: [CID 15][2022/02/05 16:08:59]: [status] Handling query input: 0x55f111269810 (176) [CID 15][2022/02/05 16:08:59]: Connection matched service ipa-api [CID 15][2022/02/05 16:08:59]: [status] Processing request [0x55f111269810 (176)] [CID 15][2022/02/05 16:08:59]: [status] Executing request 6 (GSSX_ACQUIRE_CRED) from [0x55f111269810 (176)] [CID 15][2022/02/05 16:08:59]: gp_rpc_execute: executing 6 (GSSX_ACQUIRE_CRED) for service "ipa-api", euid: 977,socket: (null) GSSX_ARG_ACQUIRE_CRED( call_ctx: { "" [ ] } input_cred_handle: <Null> add_cred: 0 desired_name: { "brian(a)EXAMPLE.COM" { 1 2 840 113554 1 2 2 1 } [ ] [ ] [ ] } time_req: 4294967295 desired_mechs: { { 1 2 840 113554 1 2 2 } } cred_usage: INITIATE initiator_time_req: 0 acceptor_time_req: 0 ) GSSX_RES_ACQUIRE_CRED( status: { 851968 { 1 2 840 113554 1 2 2 } 2529639107 "Unspecified GSS failure. Minor code may provide more information" "No credentials cache found" [ ] } output_cred_handle: <Null> ) [CID 15][2022/02/05 16:08:59]: [status] Returned buffer 6 (GSSX_ACQUIRE_CRED) from [0x55f111269810 (176)]: [0x7fdf7c08a880 (176)] [CID 15][2022/02/05 16:08:59]: [status] Handling query output: 0x7fdf7c08a880 (176) [2022/02/05 16:08:59]: [status] Handling query reply: 0x7fdf7c08a880 (176) [2022/02/05 16:08:59]: [status] Sending data: 0x7fdf7c08a880 (176) [2022/02/05 16:08:59]: [status] Sending data [0x7fdf7c08a880 (176)]: successful write of 176 [CID 15][2022/02/05 16:08:59]: [status] Handling query input: 0x7fdf7c08a880 (176) [CID 15][2022/02/05 16:08:59]: Connection matched service ipa-api [CID 15][2022/02/05 16:08:59]: [status] Processing request [0x7fdf7c08a880 (176)] [CID 15][2022/02/05 16:08:59]: [status] Executing request 6 (GSSX_ACQUIRE_CRED) from [0x7fdf7c08a880 (176)] [CID 15][2022/02/05 16:08:59]: gp_rpc_execute: executing 6 (GSSX_ACQUIRE_CRED) for service "ipa-api", euid: 977,socket: (null) GSSX_ARG_ACQUIRE_CRED( call_ctx: { "" [ ] } input_cred_handle: <Null> add_cred: 0 desired_name: { "brian(a)EXAMPLE.COM" { 1 2 840 113554 1 2 2 1 } [ ] [ ] [ ] } time_req: 4294967295 desired_mechs: { { 1 2 840 113554 1 2 2 } } cred_usage: INITIATE initiator_time_req: 0 acceptor_time_req: 0 ) GSSX_RES_ACQUIRE_CRED( status: { 851968 { 1 2 840 113554 1 2 2 } 2529639107 "Unspecified GSS failure. Minor code may provide more information" "No credentials cache found" [ ] } output_cred_handle: <Null> ) [CID 15][2022/02/05 16:08:59]: [status] Returned buffer 6 (GSSX_ACQUIRE_CRED) from [0x7fdf7c08a880 (176)]: [0x7fdf7c066260 (176)] [CID 15][2022/02/05 16:08:59]: [status] Handling query output: 0x7fdf7c066260 (176) [2022/02/05 16:08:59]: [status] Handling query reply: 0x7fdf7c066260 (176) [2022/02/05 16:08:59]: [status] Sending data: 0x7fdf7c066260 (176) [2022/02/05 16:08:59]: [status] Sending data [0x7fdf7c066260 (176)]: successful write of 176 [2022/02/05 16:08:59]: Client [2022/02/05 16:08:59]: (/usr/sbin/httpd) [2022/02/05 16:08:59]: connected (fd = 16)[2022/02/05 16:08:59]: (pid = 4268) (uid = 977) (gid = 973)[2022/02/05 16:08:59]: (context = system_u:system_r:httpd_t:s0)[2022/02/05 16:08:59]: [CID 16][2022/02/05 16:08:59]: [status] Handling query input: 0x7fdf7c066260 (176) [CID 16][2022/02/05 16:08:59]: Connection matched service ipa-api [CID 16][2022/02/05 16:08:59]: [status] Processing request [0x7fdf7c066260 (176)] [CID 16][2022/02/05 16:08:59]: [status] Executing request 6 (GSSX_ACQUIRE_CRED) from [0x7fdf7c066260 (176)] [CID 16][2022/02/05 16:08:59]: gp_rpc_execute: executing 6 (GSSX_ACQUIRE_CRED) for service "ipa-api", euid: 977,socket: (null) GSSX_ARG_ACQUIRE_CRED( call_ctx: { "" [ ] } input_cred_handle: <Null> add_cred: 0 desired_name: { "brian(a)EXAMPLE.COM" { 1 2 840 113554 1 2 2 1 } [ ] [ ] [ ] } time_req: 4294967295 desired_mechs: { { 1 2 840 113554 1 2 2 } } cred_usage: INITIATE initiator_time_req: 0 acceptor_time_req: 0 ) GSSX_RES_ACQUIRE_CRED( status: { 851968 { 1 2 840 113554 1 2 2 } 2529639107 "Unspecified GSS failure. Minor code may provide more information" "No credentials cache found" [ ] } output_cred_handle: <Null> ) [CID 16][2022/02/05 16:08:59]: [status] Returned buffer 6 (GSSX_ACQUIRE_CRED) from [0x7fdf7c066260 (176)]: [0x7fdf7c05c9e0 (176)] [CID 16][2022/02/05 16:08:59]: [status] Handling query output: 0x7fdf7c05c9e0 (176) [2022/02/05 16:08:59]: [status] Handling query reply: 0x7fdf7c05c9e0 (176) [2022/02/05 16:08:59]: [status] Sending data: 0x7fdf7c05c9e0 (176) [2022/02/05 16:08:59]: [status] Sending data [0x7fdf7c05c9e0 (176)]: successful write of 176 [CID 16][2022/02/05 16:08:59]: [status] Handling query input: 0x7fdf7c05c9e0 (176) [CID 16][2022/02/05 16:08:59]: Connection matched service ipa-api [CID 16][2022/02/05 16:08:59]: [status] Processing request [0x7fdf7c05c9e0 (176)] [CID 16][2022/02/05 16:08:59]: [status] Executing request 6 (GSSX_ACQUIRE_CRED) from [0x7fdf7c05c9e0 (176)] [CID 16][2022/02/05 16:08:59]: gp_rpc_execute: executing 6 (GSSX_ACQUIRE_CRED) for service "ipa-api", euid: 977,socket: (null) GSSX_ARG_ACQUIRE_CRED( call_ctx: { "" [ ] } input_cred_handle: <Null> add_cred: 0 desired_name: { "brian(a)EXAMPLE.COM" { 1 2 840 113554 1 2 2 1 } [ ] [ ] [ ] } time_req: 4294967295 desired_mechs: { { 1 2 840 113554 1 2 2 } } cred_usage: INITIATE initiator_time_req: 0 acceptor_time_req: 0 ) GSSX_RES_ACQUIRE_CRED( status: { 851968 { 1 2 840 113554 1 2 2 } 2529639107 "Unspecified GSS failure. Minor code may provide more information" "No credentials cache found" [ ] } output_cred_handle: <Null> ) [CID 16][2022/02/05 16:08:59]: [status] Returned buffer 6 (GSSX_ACQUIRE_CRED) from [0x7fdf7c05c9e0 (176)]: [0x7fdf7c03f690 (176)] [CID 16][2022/02/05 16:08:59]: [status] Handling query output: 0x7fdf7c03f690 (176) [2022/02/05 16:08:59]: [status] Handling query reply: 0x7fdf7c03f690 (176) [2022/02/05 16:08:59]: [status] Sending data: 0x7fdf7c03f690 (176) [2022/02/05 16:08:59]: [status] Sending data [0x7fdf7c03f690 (176)]: successful write of 176 Cheers, b.

2 8

"getent group -s sss" behaves differently on centos 7 vs centos 8. Why?
by Russell Jones 07 Feb '22

07 Feb '22

Hi all, I am very confused on why I am not able to enumerate the group members on a centos 8 machine with the above command, but I can on a centos 7 machine. [root@centos8-1 log]# getent group -s sss video video:x:39: [root@centos7-n11 log]# getent group -s sss video video:*:39:<lots of users> Both are configured with the same sssd.conf file, and both have "enumerate = True" in the domain section. In addition, if I just do "getent group" without the "-s sss" the group and all of its members show up properly on both machines. Super confused here. Thanks in advance for the help!

2 3

Odd hostgroup behavior
by Stephen Berg (Code 7309) 07 Feb '22

07 Feb '22

I can't get a "getent netgroup ipaservers" to return the list of servers. Looking on the web UI my replica servers all show up in the ipaservers group. Using ipa hostgroup-show command line works. I set duplicate the group as "ipa" and getent can see that hostgroup like expected. Other hostgroups are working normally. Near as I can tell nsswitch.conf is good. Is there something about the ipaservers group that make it different from other groups? -- Stephen Berg, IT Specialist, Ocean Sciences Division, Code 7309 Naval Research Laboratory stephen.berg(a)nrlssc.navy.mil <- (Preferred contact) W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162

2 1

Freeipa Client fails with "CERTIFICATE_VERIFY_FAILED" when FreeIPA is behind a reverse proxy.
by Scion 06 Feb '22

06 Feb '22

I have recently been looking to authenticate Linux hosts with our FreeIPA server. I use a containerized FreeIPA server behind a Nginx Proxy Manager reverse proxy. I disable anonymous binding and forward all the LDAP and kerberos ports freeipa uses over streams through NPM. This has worked well for general usage and LDAP binding so far, but when I try to install the client with ipa-client-install I get the following error: Configured sudoers in /etc/nsswitch.conf Configured /etc/sssd/sssd.conf Configured /etc/krb5.conf for IPA realm MYREALM.NET cannot connect to 'https://freeipa.myrealm.net/ipa/json': [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123) I do not get the same issue connecting directly to a fresh docker instance that is not behind Nginx Proxy Manager, but it occurs again when I try to put a reverse proxy in front of the server. The realm gets created, but the final configuration fails. What I assume is happening is that there is a mismatch between the SSL certificate used by LDAP/Kerberos and the one used over https, but I'm not totally sure. The debug information is sparse. The debug logs say the following: failed to find session_cookie in persistent storage for principal 'host/client.myrealm.net(a)MYREALM.NET' trying https://freeipa.myrealm.net/ipa/json Created connection context.rpcclient_140023518613568 [try 1]: Forwarding 'schema' to json server 'https://freeipa.myrealm.net/ipa/json' HTTP connection destroyed (freeipa.myrealm.net) I tried the --ca-cert-file flag, passing in the server's self-signed certificate, but that did not work either. Neither did installing it in the ca-certificates directory. Is there a way for me either pre-emptively install the certificate? Or am I going to need to definitely use the same non-self-signed certificate for the reverse proxy and the actual IPA server? Some additional things I've tried: - Updating & Upgrading - Using the server's self-signed certificate in NPM (gives a self-signed cert error) - Using no certificate in NPM (gives the sam self-signed error) - Using the name of the Freeipa host machine (connects, but a cert for the hostname isn't found)

1 1

Case sensitivity?
by Simon Matthews 04 Feb '22

04 Feb '22

Why does ipa-client install require that the hostname be lower case? Hostnames are case-insensitive. Shouldn't IPA follow this and be case-insensitive?

2 1

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2022