May 2023 - FreeIPA-users - Fedora mailing-lists

Load balancing LDAP connection multiple IdM servers
by James Steen 10 May '23

10 May '23

My team has asked me to investigate the introduction of two additional IPA server into our infrastructure. This means a total of 3 servers. We also want to be able to load balance between these servers since we already have client connected to our existing ipa server through LDAP. I came across this blog post by Dmitri Pal, where he discusses some part of Identity Manageent and Load Balancing (See: https://www.redhat.com/en/blog/identity-management-and-load-balancing-red-h…) Since we're using AWS i'm wondering if it's beneficial to load balance the LDAP or if we just try like Dmitri mention in the blog post to use DNS SRV records. Would it be possible for us to so and only point one FQDN in the /etc/sssd/sssd.conf for our hosts? E.g IPA servers: DNS SRV Record ipa1.example.com >> ldaps_ipa.example.com ipa2.example.com >> ldaps_ipa.example.com ipa3.example.com >> ldaps_ipa.example.com And put following in a sssd.conf file: [domain/example.com] id_provider = ldap ldap_uri = ldaps://ipa.example.com

1 0

Load balancing LDAP connection multiple IdM servers
by James Steen 10 May '23

10 May '23

My team has asked me to investigate the introduction of two additional IPA server into our infrastructure. This means a total of 3 servers. We also want to be able to load balance between these servers since we already have client connected to our existing ipa server through LDAP. I came across this blog post by Dmitri Pal, where he discusses some part of Identity Manageent and Load Balancing (See: https://www.redhat.com/en/blog/identity-management-and-load-balancing-red-h…) Since we're using AWS i'm wondering if it's beneficial to load balance the LDAP or if we just try like Dmitri mention in the blog post to use DNS SRV records. Would it be possible for us to so and only point one FQDN in the /etc/sssd/sssd.conf for our hosts? E.g IPA servers: DNS SRV Record ipa1.example.com >> ldaps_ipa.example.com ipa2.example.com >> ldaps_ipa.example.com ipa3.example.com >> ldaps_ipa.example.com And put following in a sssd.conf file: [domain/example.com] id_provider = ldap ldap_uri = ldaps://ipa.example.com

1 0

Minimum Privileges to list OTP already-created token users via API (otptoken_find)
by David Serrano Amarelle 10 May '23

10 May '23

Hi, Does anyone know how to create a user with the minimum privileges to list the users which have any OTP token created? I need to obtain this list via API (otptoken_find). It should be something alternative to assign "Full admin user" role. Thanks!

1 0

Minimum Privileges to list OTP already-created token users via API (otptoken_find)
by David Serrano Amarelle 10 May '23

10 May '23

Hi, Does anyone know how to create user with the minimum privileges to list the users which have any OTP token created? I need to obtain this list via API (otptoken_find). It should be something alternative to assign "Full admin user" role. Thanks!

1 0

SSL errors ... again
by Justin Sanderson 09 May '23

09 May '23

Ok. So once again my IPA server is having cert issues. Everything seems to be working except when I am in the web interface and goto "Authentication" --> "Certificates" --> Click any of the certs in the list. ---- I get this error from the browser.------ IPA ERROR 907: NetworkError cannot connect to https://[myservernamehere.fqdn]:443/ca/agent/ca/displayBySerial' : SSL_HANDSHAKE_FAILURE # getcert list |grep expires --> everything checks out ok. no expiry on any of the certs --- checked all the certs on there "Not Before" and "Not After" dates for the following NSS db's certutil -L -d /etc/pki/pki-tomcat/alias certutil -L -d /etc/httpd/alias ---- In /var/log/httpd/error_log, I do see some errors: ---- Bad Remote Server Certificate -8181 SSL Library Error: -8181 Certificate has expired I know it's an expired cert obviously from httpd errorlog but where is the darn thing. I thought i checked all the places and looked ok but I'm definitely missing something.... could use some advice. TIA

3 6

IPA installation and SSHD configuration - What is being configured?
by J N 09 May '23

09 May '23

When I have a look at either ipa-client-install or Ansible role 'ipaserver' I come across the options for OpenSSH: ipaclient_no_ssh ipaclient_no_sshd <--- What I'm interested in. I want to install a IPA server and my question is: What exactly is being configured, and should I use this option?

2 2

[SSSD] Announcing SSSD 2.9.0
by Pavel Březina 05 May '23

05 May '23

# SSSD 2.9.0 The SSSD team is announcing the release of version 2.9.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * `sss_simpleifp` library is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-libsifp` `./configure` option. * "Files provider" (i.e. `id_provider = files`) is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using `--with-files-provider` `./configure` option. Or consider using "Proxy provider" with `proxy_lib_name = files` instead. * Previously deprecated `--enable-files-domain` configure option, which was used to manage default value of the `enable_files_domain` config option, is now removed. * Long time unused '--enable-all-experimental-features' configure option was removed. * SSSD will no longer warn about changed defaults when using `ldap_schema = rfc2307` and default autofs mapping. This warning was introduced in 1.14 to loudly warn about different default values. ### New features * New passkey functionality, which will allow the use of FIDO2 compliant devices to authenticate a centrally managed user locally. Moreover, in the case of a FreeIPA user, it can also issue a Kerberos ticket automatically with upcoming FreeIPA version 4.11. * Add support for ldapi:// URLs to allow connections to local LDAP servers * NSS IDMAP has two new methods: `getsidbyusername` and `getsidbygroupname` Note: support for passkey is in its initial phase and the authentication policy will be adjusted in future versions. #### Packaging changes for passkey * Include passkey subpackage and dependency for libfido2. #### Configuration changes for passkey * New options to enable and tune passkey behavior: `pam_passkey_auth`, `ldap_user_passkey`, `passkey_verification`, `passkey_child_timeout`, `interactive`, `interactive_prompt`, `touch` and `touch_prompt`. * `--with-passkey` is a new configuration option to enable building passkey authentication. ### Important fixes * A regression when running sss_cache when no SSSD domain is enabled would produce a syslog critical message was fixed. ### Configuration changes * Default value of `cache_first` option was changed to `true` in case SSSD is built without `files provider`. * ipa_access_order parameter introduced. It behaves much like ldap_access_order but affects IPA domains (id_provider = ipa) and accepts limited values. Please see sssd-ipa(5) for more information.

1 0

ACME client certificate request from FreeIPA with DNS-01 challenge
by Djerk Geurts 04 May '23

04 May '23

Aware that ACME support is still relatively new. I'm looking at how the challenge works for an ACME client. DNS-01 seems superfluous as FreeIPA manages the DNS itself and HTTP-01 is often not an option, for example when using ACME on vSphere. If the DNS-01 verification is indeed fully local to a FreeIPA server with integrated DNS and CA then can't any machine that can reach the FreeIPA server request an internal certificate anonymously? Surely I'm missing something here?

3 6

broken trust chain resolving using 8.8.8.8 as forwarder
by Rob van Halteren 04 May '23

04 May '23

Hi, I have trouble resolving some addresses with my freeipa server . in the log there are lots of "broken trust chain" lines. like: validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: validating gew4-spclient.spotify.com/CNAME: bad cache hit (com/DS) May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/A/IN': 8.8.8.8#53 May 3 14:36:11 myserver named-pkcs11[30906]: broken trust chain resolving 'gew4-spclient.spotify.com/TYPE65/IN': 8.8.8.8#53 I setup a global forward to 8.8.8.8 and forward only setting in the web gui. I tried to change the dnssec settings in /etc/named.conf : dnssec-enable no; dnssec-validation no; That did not help. I run freeipa 4.6.8. Release: 5.el7.centos.12 on centos7.9 When I change forwarding to: forward disabled in the webgui, i get lots of "network unreachable resolving" in the logs. I then can resolve most addresses but not all To me looks like dns is not resolving as expected, but have no clue in where to look for a solution. Any help appreciated. Thanks, Rob.

2 3

Running 'sudo su' creates kerberos ticket for user on old IPA (4.6) not on new 4.10
by Finn Fysj 04 May '23

04 May '23

I'm trying to setup new IPA server and when I run 'sudo su' I get prompted with password, which is fine. However, when I successfully type my password on a RHEL7 instance running FreeIPA version 4.6 I get a kerberos ticket as the logged-in user in "root-mode", but when I do the same in the newer IPA instance I do not get any kerberos ticket when in root. How do I get kerberos ticket when I run 'sudo su'?

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2023