FreeIPA-users February 2022

freeipa-users@lists.fedorahosted.org

54 participants
93 discussions

IPA DNS listing
by Stephen Berg, Code 7309 04 Feb '22

04 Feb '22

Running ipa-4.9.6 on rocky linux 8.5. I'm currently setting up the DNS stuff and don't see a way to list DNS records in IP address order. The web UI doesn't feature a sorting option and from the command line I haven't found any option to sort the output. Is this not possible right now or am I missing a command or option somewhere? -- Stephen Berg, IT Specialist, Ocean Sciences Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162 Email: stephen.berg(a)nrlssc.navy.mil <- (Preferred contact) Flank Speed: stephen.p.berg.civ(a)us.navy.mil

2 1

SPNEGO cannot find mechanisms to negotiate
by Brian J. Murrell 04 Feb '22

04 Feb '22

On my fairly recently created replica, trying to sign on to the webUI fails both with a ticket and with username/password. The httpd error log reports: [Thu Feb 03 09:43:20.551081 2022] [wsgi:error] [pid 332932:tid 140681111185152] [remote 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] ipa: INFO: [jsonserver_i18n_messages] UNKNOWN: i18n_messages(version='2.237'): SUCCESS [Thu Feb 03 09:43:21.096431 2022] [auth_gssapi:error] [pid 332935:tid 140680940726016] [client 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] Failed to unseal session data!, referer: https://server.example.com/ipa/ui/ [Thu Feb 03 09:43:21.146884 2022] [auth_gssapi:error] [pid 332935:tid 140681090156288] [client 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] Failed to unseal session data!, referer: https://server.example.com/ipa/ui/ [Thu Feb 03 09:43:21.605055 2022] [auth_gssapi:error] [pid 332935:tid 140681090156288] [client 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure. Minor code may provide more information ( SPNEGO cannot find mechanisms to negotiate)], referer: https://server.example.com/ipa/ui/ [Thu Feb 03 09:43:21.621376 2022] [auth_gssapi:error] [pid 332935:tid 140680923940608] [client 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] Failed to unseal session data!, referer: https://server.example.com/ipa/ui/ [Thu Feb 03 09:43:21.672265 2022] [auth_gssapi:error] [pid 332935:tid 140680907155200] [client 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] Failed to unseal session data!, referer: https://server.example.com/ipa/ui/ [Thu Feb 03 09:43:22.019527 2022] [auth_gssapi:error] [pid 332935:tid 140680907155200] [client 2001:123:aa:123:0:90cc:a629:cf42:5877:50870] GSS ERROR gss_acquire_cred[_from]() failed to get server creds: [Unspecified GSS failure. Minor code may provide more information ( SPNEGO cannot find mechanisms to negotiate)], referer: https://server.example.com/ipa/ui/ I found some google hits on gssproxy being the culprit but I can't seem to find anything wrong with it. It's not logging any errors or such. Any ideas on what the problem could be here? Cheers, b.

1 1

IPA WebUI login fails
by iulian roman 04 Feb '22

04 Feb '22

Hello everybody, If I try to login via WebUI with an AD account , i get the following error: 'Your session has expired. Please log in again.' in the WebUI interface. I the http access logs i have the following entry: user(a)EXAMPLE.LOCAL [03/Feb/2022:14:54:13 +0100] "POST /ipa/session/json HTTP/1.1" 401 176 user(a)EXAMPLE.LOCAL [03/Feb/2022:14:54:13 +0100] "GET /ipa/session/login_kerberos?_=1643896292999 HTTP/1.1" 401 262 On the http error_log: [Thu Feb 03 14:54:13.466436 2022] [wsgi:error] [pid 1835110:tid 140666734245632] [remote 10.8.137.41:58079] ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials [Thu Feb 03 14:54:13.472887 2022] [:warn] [pid 1837963:tid 140666084521728] [client 10.8.137.41:58079] failed to set perms (3140) on file (/run/ipa/ccaches/user(a)EXAMPLE.LOCAL) referer: https://xxx.ipa.example.local/ipa/ui/ [Thu Feb 03 14:54:13.477997 2022] [wsgi:error] [pid 1835109:tid 140666733983488] [remote 10.8.137.41:58079] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (108962060): Credential cache is empty In the krb5kdc.log : Feb 03 14:54:13 xxxipaprd04.ipa.example.local krb5kdc[3151688](info): AS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), ca mellia128-cts-cmac(25)}) 10.30.200.220: REFERRAL: user\@EXAMPLE.local@IPA.EXAMPLE.LOCAL for krbtgt/IPA.EXAMPLE.LOCAL(a)IPA.EXAMPLE.LOCAL, Realm not local to KDC Feb 03 14:54:13 xxxipaprd04.ipa.example.local krb5kdc[3151688](info): closing down fd 12 Feb 03 14:54:13 xxxipaprd04.ipa.example.local krb5kdc[3151688](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), c amellia128-cts-cmac(25)}) 10.30.200.220: ISSUE: authtime 1643896453, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, user(a)EXAMPLE.LOCAL for HTTP/xxxipaprd04.ipa.example.local@IPA. EXAMPLE.LOCAL Feb 03 14:54:13 xxxipaprd04.ipa.example.local krb5kdc[3151688](info): closing down fd 12 Feb 03 14:54:13 xxxipaprd04.ipa.example.local krb5kdc[3151688](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), c amellia128-cts-cmac(25)}) 10.30.200.220: ISSUE: authtime 1643896453, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, HTTP/xxxipaprd04.ipa.example.local(a)IPA.EXAMPLE.LOCAL for ldap/c xxxipaprd04.ipa.example.local(a)IPA.EXAMPLE.LOCAL Feb 03 14:54:13 xxxipaprd04.ipa.example.local krb5kdc[3151688](info): ... CONSTRAINED-DELEGATION s4u-client=user(a)EXAMPLE.LOCAL Any help would be really appreciated. Regards, iulian roman

3 4

Re: Unable to use externa groups or users, truster domain object not found
by Mike Moser 04 Feb '22

04 Feb '22

Ran into the same issue, sharing this as it solved the issue for me: https://access.redhat.com/solutions/3656641 [Logo Description automatically generated] Michael S. Moser Sr. Linux Administrator, Aires Office 1.412.677.1851 ● Mobile 412.719.7765 [cid:image002.png@01D81830.EDD86BB0]<https://www.aires.com/> [cid:image003.png@01D81830.EDD86BB0]<https://www.linkedin.com/in/michaelsmoser/> [cid:image004.png@01D81830.EDD86BB0]<mailto:mmoser@aires.com> CONFIDENTIALITY NOTICE -- This email produced by Aires, including any accompanying attachment(s), is intended only for the person(s) designated above. Unless otherwise indicated, it contains information that is confidential, privileged and/or exempt from disclosure under applicable law. If you have received this message in error, please notify the sender and delete the message. If the reader of this message is not the intended recipient, you are hereby notified that any use of this communication is strictly prohibited.

1 0

Re: EMC Isilon and IPA - Kerberos
by thing.thing＠gmail.com 04 Feb '22

04 Feb '22

We appear to have the isilon talking to Redhat's IPA / IdM using kerberos as nfs4 and krb5 work, so I assume this will work with freeipa. Do the LDAP part as described elsewhere. If you have access to RH support kbase, based on RHEL6 notes for non-IPA joined NFS servers (See Debian10 NFS server example), https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/ht… On an IPA master obtain a kerberos ticket as an IPA admin. kinit admin add the isilon host, ipa host-add tststocoisnfs01.odstest.xxxxxx.ac.nz And add nfs service, ipa service-add-host nfs/tststocoisnfs01.odstest.xxxxxx.ac.nz --hosts=tststocoisnfs01.odstest.xxxxxx.ac.nz check, ipa service-show nfs/tststocoisnfs01.odstest.xxxxx.ac.nz you should see "false" for the keytab initially Delegate DNS. Allow the Isilon to manage its roundrobin DNS as it has 6 IPs, ipa host-add-managedby tststocoisnfs01.odstest.xxxxxx.ac.nz --hosts=tststocoisnfs01.odstest.xxxxxx.ac.nz Create the other keytabs the Isilon wants (there will be 4, host, HTTP, nfs and hdfs) ipa service-add hdfs/tststocoisnfs01.odstest.xxxxxx.ac.nz ipa service-add HTTP/tststocoisnfs01.odstest.xxxxxx.ac.nz generate the 4 keytabs, ipa-getkeytab -p nfs/tststocoisnfs01.odstest.xxxxxx.ac.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-nfs.keytab ipa-getkeytab -p HTTP/tststocoisnfs01.odstest.xxxxxx.ac.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-HTTP.keytab ipa-getkeytab -p host/tststocoisnfs01.odstest.xxxxxx.ac.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-host.keytab ipa-getkeytab -p hdfs/tststocoisnfs01.odstest.xxxxxx.nz(a)ODSTEST.xxxxxx.AC.NZ -k ~/tststocoisnfs01-hdfs.keytab (seems to complain if all 4 are not done) keytab should now be true scp the 4 keytabs to the isilon. run the isilon CLI to import these 4. (I will add more as I have the commands) So far RHEL8, RHEL7, Centos7 and Debian10 NFS clients mountnfs4 using kerberos fine.

1 0

ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.issc.io', port=8080): Read timed out
by Ricardo Mendes 03 Feb '22

03 Feb '22

Hi, I'm having an issue where I can't remove an host due to the error: "Operation Error Some entries were not deleted Show details: - Certificate operation cannot be completed: Unable to communicate with CMS (403)" getcert list Number of certificates and requests being tracked: 9. Request ID '20210401150403': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=IPA RA expires: 2023-03-22 16:04:03 WET key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20210401150418': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=CA Audit expires: 2023-03-22 16:03:31 WET key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150419': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=OCSP Subsystem expires: 2023-03-22 16:03:28 WET eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150420': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=CA Subsystem expires: 2023-03-22 16:03:30 WET key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150421': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='caSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=Certificate Authority expires: 2041-04-01 16:03:26 WEST key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign profile: caCACert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "caSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150422': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-03-22 16:03:29 WET dns: idm.domain.io key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-serverAuth profile: caServerCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Request ID '20210401150440': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-IO',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-DOMAIN-IO/pwdfile.txt' certificate: type=NSSDB,location='/etc/dirsrv/slapd-DOMAIN-IO',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-04-02 16:04:42 WEST dns: idm.domain.io principal name: ldap/idm.domain.io(a)domain.io key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth profile: caIPAserviceCert pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv DOMAIN-IO track: yes auto-renew: yes Request ID '20210401150509': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/lib/ipa/private/httpd.key',pinfile='/var/lib/ipa/passwds/idm.domain.io-443-RSA' certificate: type=FILE,location='/var/lib/ipa/certs/httpd.crt' CA: IPA issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-04-02 16:05:09 WEST dns: idm.domain.io,ipa-ca.domain.io principal name: HTTP/idm.domain.io(a)domain.io key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth profile: caIPAserviceCert pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes Request ID '20210401150519': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority subject: CN=idm.domain.io expires: 2023-04-02 16:05:20 WEST principal name: krbtgt/domain.io(a)domain.io key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes ski-tomcat doesn't fail to start, however I get the following errors: -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has begun start-up -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- Unit pki-tomcatd(a)pki-tomcat.service has begun starting up. Feb 02 15:22:15 idm.domain.io server[8216]: Java virtual machine used: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java Feb 02 15:22:15 idm.domain.io server[8216]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/ant.jar:/usr/share/java/ant-laun> Feb 02 15:22:15 idm.domain.io server[8216]: main class used: org.apache.catalina.startup.Bootstrap Feb 02 15:22:15 idm.domain.io server[8216]: flags used: -Dcom.redhat.fips=false Feb 02 15:22:15 idm.domain.io server[8216]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pk> Feb 02 15:22:15 idm.domain.io server[8216]: arguments used: start Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: pki.client: /usr/libexec/ipa/ipa-pki-wait-running:63: The subsystem in PKIConnection.__init__() has been deprecated (https:/> Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Created connection http://idm.domain.io:8080/ca Feb 02 15:22:16 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Max retries exceeded with url: /> Feb 02 15:22:17 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Max retries exceeded with url: /> Feb 02 15:22:18 idm.domain.io server[8216]: WARNING: Some of the specified [protocols] are not supported by the SSL engine and have been skipped: [[TLSv1, TLSv1.1]] Feb 02 15:22:19 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:21 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:23 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:25 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:27 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:29 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='idm.domain.io', port=8080): Read timed out. (read timeout=1.> Feb 02 15:22:31 idm.domain.io ipa-pki-wait-running[8217]: ipa-pki-wait-running: Success, subsystem ca is running! Feb 02 15:22:31 idm.domain.io systemd[1]: Started PKI Tomcat Server pki-tomcat. -- Subject: Unit pki-tomcatd(a)pki-tomcat.service has finished start-up -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- Unit pki-tomcatd(a)pki-tomcat.service has finished starting up. -- -- The start-up result is done. I have followed this solution as well, but it didn't made any difference. https://access.redhat.com/solutions/4796941 IPA doesn't fail, all services are running, I simply can't do any operations that involve the CMS. Any help appreciated, thank you. Ricardo M.

2 4

IPA WebGUI login fails with "Login failed due to an unknown reason"
by code bugs 03 Feb '22

03 Feb '22

Hello, -IPA WebGUI login fails with "Login failed due to an unknown reason" -After upgrading IPA, can no longer log into the WebGUI Version/Release/Distribution $ cat /etc/centos-release CentOS Linux release 8.5.2111 $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server package freeipa-server is not installed package freeipa-client is not installed ipa-server-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64 ipa-client-4.9.6-10.module_el8.5.0+1055+c415bbe9.x86_64 389-ds-base-1.4.3.23-12.module_el8.5.0+1056+b3c5a4b9.x86_64 pki-ca-10.11.2-2.module_el8.5.0+945+a81e57da.noarch krb5-server-1.18.2-14.el8.x86_64 Additional info: tail /var/log/httpd/error_log [wsgi:error] [pid 8833:tid 139812622513920] [remote 10.2.3.80:51404] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844948): TGT has been revoked further, 1. default "admin" user can IPA WebGUIlogin 2. other users cannot login IPA WebGUIlogin, but can login using cli (kinit) 3. when i create a new user, the new user can login IPA WebGUI.

3 17

IPA to IPA migration - lot more groups - why?
by lejeczek 02 Feb '22

02 Feb '22

Hi guys. I migrate: -> $ ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup --with-compat ldap://10.0.0.16 and I end up, according to 'group-find', having a lot more - one for each user - extra groups which do not exist(or don't show up?) on the source IPA domain. Why is that? Is that a symptom of a problem? Is it safe to remove those extra groups? many thanks, L

4 5

Rawhide upgrade dirsrv startup failure workaround
by Harry G. Coin 02 Feb '22

02 Feb '22

When 'upgrading' using Rawhide, (instead of a fresh install), you might notice ns-slapd / dirsrv fails to start. Do this to work around it: #mkdir /dev/shm/slapd-<your kerberos domain with - instead of .> #chown dirsrv:dirsrv /dev/shm/slapd-<your kerberos domain with - instead of .> #systemctl restart ipa

2 2

Group permissions failing on group with ipaNTSecurityIdentifier attribute
by Scott Serr 02 Feb '22

02 Feb '22

Hello, I have an IPA cluster of 5 servers, running version 4.9.6-10. The system was put in production Feb 2021 and has been updated several times. These updates have sometimes not gone well: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… I'll try to keep this concise. A user was not able to access an NFS share provided by our EMC Isilon. They were a member of the group that owned the directory/share. But not always, it depended upon what Isilon IP was mounted. After many hours of troubleshooting, we found the group was newly created and different than our old groups. The group had an attribute we are not yet familiar with: ipaNTSecurityIdentifier The group also had an objectClass none of our others have: ipaNTGroupAttrs This brought to my attention an issue I saw last week when trying to add an IPA replica to our cluster. This is new prompting that I have not seen before while setting up replicas: WARNING: 1755 existing users or groups do not have a SID identifier assigned. Installer can run a task to have ipa-sidgen Directory Server plugin generate the SID identifier for all these users. Please note, in case of a high number of users and groups, the operation might lead to high replication traffic and performance degradation. Refer to ipa-adtrust-install(1) man page for details. Do you want to run the ipa-sidgen task? [no]: ---- I'm trying to understand the thread "Login failed due to an unknown reason" https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… where Alexander explains how to fix SIDs. Also there is a thread: IPA WebGUI login fails with "Login failed due to an unknown reason". Are SIDs now required? An aside, in one of my install-replica attempts last week I was asked to provide a NetBIOS name. :( My IPA cluster is now wanting to do these SMB/AD sorts of things. Newly created groups now have ipaNTSecurityIdentifier, which causes permission issues when mounting NFS on our Isilon. Are we forced down this road or do I have something misconfigured that is "half-way" doing AD? I'd like to learn about the big picture. Thank you, Scott Serr

2 3

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2022