July 2023 - FreeIPA-users - Fedora mailing-lists

Disabling "kinit admin" on all machines
by Dominik Vogt 18 Nov '24

18 Nov '24

What is the correct way to disable "kinit admin" on all ipa clients? In our setup, becoming admin should only possible on the ipa server. (Everything is done by scripts runn through ssh; nobody ever logs in to the server directly.) Ciao Dominik ^_^ ^_^ -- Dominik Vogt

3 12

Unable to install KRA Replica - 4.8.7
by David Andrzejewski 04 Nov '24

04 Nov '24

I'm attempting to reinstall a replica that I had previously removed. When I run ipa-replica-install and include the --setup-kra option, it eventually fails. I've included the output of the ipa-replica-install command, and the only "bad" thing I can find is the following in the tomcat debug log: > 2020-11-29 03:51:35 [ajp-nio-127.0.0.1-8009-exec-3] SEVERE: addConnector: Connector is already defined I've gone through and run ipa-healthcheck, all is well there. After uninstalling, I couldn't find any old references to the replica in the LDAP database.... the ipa-replica-install works fine if I do not include --setup-kra. Any help would be appreciated. I'm happy to provide whatever additional logs that may be needed. I've replaced my internal DNS suffix with 'example.com'. Thanks! - Dave Failed to configure KRA instance: CalledProcessError(Command ['/usr/sbin/pkispawn', '-s', 'KRA', '-f', '/tmp/tmpf6kaucv2', '--debug'] returned non-zero exit status 1: 'INFO: Connecting to LDAP server at ldaps://ipa.example.com:636\nINFO: Connecting to LDAP server at ldaps://ipa.example.com:636\nINFO: Connecting to security domain at https://ipa.example.com:443\nINFO: Getting security domain info\nINFO: Logging into security domain IPA\nDEBUG: Installing Maven dependencies: False\nINFO: BEGIN spawning KRA subsystem in pki-tomcat instance\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Setting up pkiuser group\nINFO: Reusing existing pkiuser group with GID 17\nINFO: Setting up pkiuser user\nINFO: Reusing existing pkiuser user with UID 17\nDEBUG: Retrieving UID for \'pkiuser\'\nDEBUG: UID of \'pkiuser\' is 17\nDEBUG: Retrieving GID for \'pkiuser\'\nDEBUG: GID of \'pkiuser\' is 17\nINFO: Initialization\nINFO: Appending logs to /var/log/pki/pki-tomcat\nINFO: Setting up infrastructure\nINFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat\nINFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nDEBUG: Command: mkdir -p /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nDEBUG: Command: chmod 770 /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nDEBUG: Command: chown 17:17 /etc/sysconfig/pki/tomcat/pki-tomcat/kra\nINFO: Creating /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: cp -p /usr/share/pki/server/etc/default.cfg /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: chmod 660 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: chown 17:17 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/default.cfg\nDEBUG: Command: touch /etc/sysconfig/pki/tomcat/pki-tomcat/kra/deployment.cfg\nDEBUG: Command: chmod 660 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/deployment.cfg\nDEBUG: Command: chown 17:17 /etc/sysconfig/pki/tomcat/pki-tomcat/kra/deployment.cfg\nINFO: Creating /var/lib/pki/pki-tomcat\nINFO: Creating /var/lib/pki/pki-tomcat/kra\nDEBUG: Command: mkdir -p /var/lib/pki/pki-tomcat/kra\nDEBUG: Command: chmod 770 /var/lib/pki/pki-tomcat/kra\nDEBUG: Command: chown 17:17 /var/lib/pki/pki-tomcat/kra\nINFO: Preparing pki-tomcat instance\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Creating /etc/pki/pki-tomcat\nWARNING: Directory already exists: /etc/pki/pki-tomcat\nINFO: Creating /etc/pki/pki-tomcat/password.conf\nINFO: Reusing server NSS database password\nINFO: Using specified internal database password\nINFO: Reusing replication manager password\nINFO: Installing pki-tomcat instance\nINFO: Creating KRA subsystem\nINFO: Creating /var/log/pki/pki-tomcat/kra\nDEBUG: Command: mkdir /var/log/pki/pki-tomcat/kra\nINFO: Creating /var/log/pki/pki-tomcat/kra/archive\nDEBUG: Command: mkdir /var/log/pki/pki-tomcat/kra/archive\nINFO: Creating /var/log/pki/pki-tomcat/kra/signedAudit\nDEBUG: Command: mkdir /var/log/pki/pki-tomcat/kra/signedAudit\nINFO: Creating /etc/pki/pki-tomcat/kra\nDEBUG: Command: mkdir /etc/pki/pki-tomcat/kra\nINFO: Creating /etc/pki/pki-tomcat/kra/CS.cfg\nDEBUG: Command: cp /usr/share/pki/kra/conf/CS.cfg /etc/pki/pki-tomcat/kra/CS.cfg\nINFO: Creating /etc/pki/pki-tomcat/kra/registry.cfg\nINFO: Creating /var/lib/pki/pki-tomcat/kra/conf\nDEBUG: Command: ln -s /etc/pki/pki-tomcat/kra /var/lib/pki/pki-tomcat/kra/conf\nINFO: Creating /var/lib/pki/pki-tomcat/kra/logs\nDEBUG: Command: ln -s /var/log/pki/pki-tomcat/kra /var/lib/pki/pki-tomcat/kra/logs\nINFO: Creating /var/lib/pki/pki-tomcat/kra/registry\nDEBUG: Command: ln -s /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat/kra/registry\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Getting transport cert info from CS.cfg\nINFO: Getting storage cert info from CS.cfg\nINFO: Getting sslserver cert info from CS.cfg\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting audit_signing cert info from CS.cfg\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Deploying /kra web application\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Creating /var/lib/pki/pki-tomcat/kra/webapps\nDEBUG: Command: mkdir -p /var/lib/pki/pki-tomcat/kra/webapps\nDEBUG: Command: chmod 770 /var/lib/pki/pki-tomcat/kra/webapps\nDEBUG: Command: chown 17:17 /var/lib/pki/pki-tomcat/kra/webapps\nINFO: Setting up ownerships, permissions, and ACLs on /var/lib/pki/pki-tomcat/kra/webapps\nINFO: Creating /etc/pki/pki-tomcat/Catalina/localhost/kra.xml\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Creating password file: /etc/pki/pki-tomcat/pfile\nINFO: Updating /etc/pki/pki-tomcat/password.conf\nDEBUG: Command: chmod 660 /etc/pki/pki-tomcat/password.conf\nDEBUG: Command: chown 17:17 /etc/pki/pki-tomcat/password.conf\nDEBUG: Command: ln -s /var/lib/pki/pki-tomcat/alias /var/lib/pki/pki-tomcat/kra/alias\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile pkcs12-import --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug\nINFO: Certificates in PKCS #12 file:\nINFO: Java command: /usr/lib/jvm/jre-openjdk/bin/java -cp /usr/share/pki/lib/* -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile --debug pkcs12-cert-find --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug\nINFO: Server URL: https://ipa.example.com:8443\nINFO: Loading NSS password from /etc/pki/pki-tomcat/pfile\nINFO: NSS database: /etc/pki/pki-tomcat/alias\nINFO: Message format: null\nINFO: Command: pkcs12-cert-find --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug\nINFO: Module: pkcs12\nINFO: Module: cert\nINFO: Module: find\nINFO: Initializing NSS\nINFO: Logging into internal token\nINFO: Using internal token\nINFO: - auditSigningCert cert-pki-kra\nINFO: - caSigningCert cert-pki-ca\nINFO: - storageCert cert-pki-kra\nINFO: - subsystemCert cert-pki-ca\nINFO: - transportCert cert-pki-kra\nINFO: Importing CA certificates:\nINFO: - caSigningCert cert-pki-ca\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/pfile -n caSigningCert cert-pki-ca -a\nWARNING: Certificate already exists: caSigningCert cert-pki-ca\nINFO: Importing user certificates:\nINFO: - auditSigningCert cert-pki-kra\nINFO: - storageCert cert-pki-kra\nINFO: - subsystemCert cert-pki-ca\nINFO: - transportCert cert-pki-kra\nINFO: Java command: /usr/lib/jvm/jre-openjdk/bin/java -cp /usr/share/pki/lib/* -Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties com.netscape.cmstools.cli.MainCLI -d /etc/pki/pki-tomcat/alias -C /etc/pki/pki-tomcat/pfile --debug pkcs12-import --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug auditSigningCert cert-pki-kra storageCert cert-pki-kra subsystemCert cert-pki-ca transportCert cert-pki-kra\nINFO: Server URL: https://ipa.example.com:8443\nINFO: Loading NSS password from /etc/pki/pki-tomcat/pfile\nINFO: NSS database: /etc/pki/pki-tomcat/alias\nINFO: Message format: null\nINFO: Command: pkcs12-import --pkcs12 /tmp/tmp3plm5h3l --password-file /tmp/tmpm1sa32dg/password.txt --debug "auditSigningCert cert-pki-kra" "storageCert cert-pki-kra" "subsystemCert cert-pki-ca" "transportCert cert-pki-kra"\nINFO: Module: pkcs12\nINFO: Module: import\nINFO: Initializing NSS\nINFO: Logging into internal token\nINFO: Using internal token\nDEBUG: Command: certutil -M -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/pfile -n auditSigningCert cert-pki-kra -t u,u,Pu\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias\nDEBUG: Result of CA certificate export: \nINFO: Removing /etc/pki/pki-tomcat/pfile\nDEBUG: Command: rm -f /etc/pki/pki-tomcat/pfile\nINFO: Getting transport cert info from CS.cfg\nINFO: Getting storage cert info from CS.cfg\nINFO: Getting sslserver cert info from CS.cfg\nINFO: Getting subsystem cert info from CS.cfg\nINFO: Getting audit_signing cert info from CS.cfg\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Creating /root/.dogtag/pki-tomcat/kra\nDEBUG: Command: mkdir -p /root/.dogtag/pki-tomcat/kra\nDEBUG: Command: chmod 755 /root/.dogtag/pki-tomcat/kra\nDEBUG: Command: chown 0:0 /root/.dogtag/pki-tomcat/kra\nINFO: Creating password file: /root/.dogtag/pki-tomcat/kra/password.conf\nINFO: Updating /root/.dogtag/pki-tomcat/kra/password.conf\nDEBUG: Command: chmod 660 /root/.dogtag/pki-tomcat/kra/password.conf\nDEBUG: Command: chown 0:0 /root/.dogtag/pki-tomcat/kra/password.conf\nINFO: Storing PKCS #12 password in /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nINFO: Updating /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nDEBUG: Command: chmod 660 /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nDEBUG: Command: chown 17:17 /root/.dogtag/pki-tomcat/kra/pkcs12_password.conf\nWARNING: Directory already exists: /var/lib/ipa/tmp-6ae9ficu\nDEBUG: Command: certutil -N -d /var/lib/ipa/tmp-6ae9ficu -f /root/.dogtag/pki-tomcat/kra/password.conf\nINFO: Creating SELinux contexts\nINFO: Generating system keys\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nINFO: Configuring subsystem\nINFO: Loading instance: pki-tomcat\nINFO: Loading global Tomcat config: /etc/tomcat/tomcat.conf\nINFO: Loading PKI Tomcat config: /usr/share/pki/etc/tomcat.conf\nINFO: Loading instance Tomcat config: /etc/pki/pki-tomcat/tomcat.conf\nINFO: Loading password config: /etc/pki/pki-tomcat/password.conf\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/ca/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/ca/conf/registry.cfg\nINFO: Loading subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Loading subsystem registry: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Loading instance registry: /etc/sysconfig/pki/tomcat/pki-tomcat/pki-tomcat\nINFO: - user: pkiuser\nINFO: - group: pkiuser\nDEBUG: Setting ephemeral requests to true\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Importing sslserver cert data from CA\nINFO: Importing subsystem cert data from CA\nINFO: Importing sslserver request data from CA\nINFO: Importing subsystem request data from CA\nINFO: Joining existing domain\nINFO: Getting install token\nINFO: Using CA at https://ipa.example.com:443\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Reusing replicated database\nINFO: Initializing database\nDEBUG: Command: sudo -u pkiuser /usr/lib/jvm/jre-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/kra/webapps/kra/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/etc/pki/pki-tomcat/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI kra-db-init --setup-schema --setup-db-manager --setup-vlv-indexes --debug\nINFO: Loading /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Initializing database ipaca for o=kra,o=ipaca\nINFO: Creating com.netscape.cmsutil.password.PlainPasswordFile\nFINE: PlainPasswordFile: Initializing PlainPasswordFile\nFINE: LdapAuthInfo: init()\nFINE: LdapAuthInfo: init begins\nFINE: LdapAuthInfo: init ends\nFINE: TCP Keep-Alive: true\nFINE: LdapAuthInfo: init: prompt is internaldb\nFINE: LdapAuthInfo: init: try getting from memory cache\nFINE: LdapAuthInfo: init: password not in memory\nFINE: LdapAuthInfo: getPasswordFromStore: try to get it from password store\nFINE: LdapAuthInfo: getPasswordFromStore: about to get from passwored store: internaldb\nFINE: LdapAuthInfo: getPasswordFromStore: password store available\nFINE: LdapAuthInfo: getPasswordFromStore: password found for prompt in password store\nFINE: LdapAuthInfo: password ok: store in memory cache\nFINE: LdapBoundConnection: Connecting to ipa.example.com:636 with basic auth as cn=Directory Manager\nFINE: ldapconn/PKISocketFactory.makeSSLSocket: begins\nFINE: PKIClientSocketListener.handshakeCompleted: begins\nFINE: Handshake completed:\nFINE: - client: 10.1.1.7\nFINE: - server: 10.1.1.7\nFINE: - subject: SYSTEM\nFINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_ESTABLISH\nFINE: PKIClientSocketListener.handshakeCompleted: CS_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS\nFINE: PKIClientSocketListener.handshakeCompleted: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636\nFINE: SSL handshake happened\nINFO: Configuring directory\nINFO: Importing /usr/share/pki/server/conf/database.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-549427834453303422.ldif\nINFO: Modifying cn=config\nINFO: - replacing nsslapd-maxbersize: 209715200\nINFO: Enabling USN\nINFO: Importing /usr/share/pki/server/conf/usn.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-784255222034676900.ldif\nINFO: Modifying cn=USN,cn=plugins,cn=config\nINFO: - replacing nsslapd-pluginenabled: on\nINFO: Setting up PKI schema\nINFO: Importing /usr/share/pki/server/conf/schema.ldif\nINFO: Adding attributetypes: ( usertype-oid NAME \'usertype\' DESC \'Distinguish whether the user is administrator, agent or subsystem.\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( userstate-oid NAME \'userstate\' DESC \'Distinguish whether the user is administrator, agent or subsystem.\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( cmsuser-oid NAME \'cmsuser\' DESC \'CMS User\' SUP top STRUCTURAL MUST usertype MAY userstate X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( archivedBy-oid NAME \'archivedBy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( adminMessages-oid NAME \'adminMessages\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( algorithm-oid NAME \'algorithm\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( algorithmId-oid NAME \'algorithmId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( signingAlgorithmId-oid NAME \'signingAlgorithmId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( autoRenew-oid NAME \'autoRenew\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( certStatus-oid NAME \'certStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlName-oid NAME \'crlName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlSize-oid NAME \'crlSize\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( deltaSize-oid NAME \'deltaSize\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlNumber-oid NAME \'crlNumber\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( deltaNumber-oid NAME \'deltaNumber\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( firstUnsaved-oid NAME \'firstUnsaved\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlCache-oid NAME \'crlCache\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revokedCerts-oid NAME \'revokedCerts\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( unrevokedCerts-oid NAME \'unrevokedCerts\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( expiredCerts-oid NAME \'expiredCerts\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( crlExtensions-oid NAME \'crlExtensions\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfArchival-oid NAME \'dateOfArchival\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfRecovery-oid NAME \'dateOfRecovery\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfRevocation-oid NAME \'dateOfRevocation\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfCreate-oid NAME \'dateOfCreate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfModify-oid NAME \'dateOfModify\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( duration-oid NAME \'duration\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( extension-oid NAME \'extension\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( issuedBy-oid NAME \'issuedBy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( issueInfo-oid NAME \'issueInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( issuerName-oid NAME \'issuerName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( keySize-oid NAME \'keySize\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( clientId-oid NAME \'clientId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dataType-oid NAME \'dataType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( status-oid NAME \'status\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( keyState-oid NAME \'keyState\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( metaInfo-oid NAME \'metaInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( nextUpdate-oid NAME \'nextUpdate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( notAfter-oid NAME \'notAfter\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( notBefore-oid NAME \'notBefore\' DESC \'CMS defined attribute\'SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( ownerName-oid NAME \'ownerName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( password-oid NAME \'password\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( p12Expiration-oid NAME \'p12Expiration\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( proofOfArchival-oid NAME \'proofOfArchival\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( publicKeyData-oid NAME \'publicKeyData\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( publicKeyFormat-oid NAME \'publicKeyFormat\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( privateKeyData-oid NAME \'privateKeyData\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestId-oid NAME \'requestId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestInfo-oid NAME \'requestInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestState-oid NAME \'requestState\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestResult-oid NAME \'requestResult\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestOwner-oid NAME \'requestOwner\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestAgentGroup-oid NAME \'requestAgentGroup\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestSourceId-oid NAME \'requestSourceId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestType-oid NAME \'requestType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestFlag-oid NAME \'requestFlag\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( requestError-oid NAME \'requestError\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( resourceACLS-oid NAME \'resourceACLS\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revInfo-oid NAME \'revInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revokedBy-oid NAME \'revokedBy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( revokedOn-oid NAME \'revokedOn\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( serialno-oid NAME \'serialno\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( nextRange-oid NAME \'nextRange\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( publishingStatus-oid NAME \'publishingStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( beginRange-oid NAME \'beginRange\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( endRange-oid NAME \'endRange\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( subjectName-oid NAME \'subjectName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( sessionContext-oid NAME \'sessionContext\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( thisUpdate-oid NAME \'thisUpdate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transId-oid NAME \'transId\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transStatus-oid NAME \'transStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transName-oid NAME \'transName\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( transOps-oid NAME \'transOps\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( userDN-oid NAME \'userDN\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( userMessages-oid NAME \'userMessages\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( version-oid NAME \'version\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( Clone-oid NAME \'Clone\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( DomainManager-oid NAME \'DomainManager\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecurePort-oid NAME \'SecurePort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecureAgentPort-oid NAME \'SecureAgentPort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecureAdminPort-oid NAME \'SecureAdminPort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SecureEEClientAuthPort-oid NAME \'SecureEEClientAuthPort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( UnSecurePort-oid NAME \'UnSecurePort\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( SubsystemName-oid NAME \'SubsystemName\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( cmsUserGroup-oid NAME \'cmsUserGroup\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( realm-oid NAME \'realm\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( CertACLS-oid NAME \'CertACLS\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY resourceACLS X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( repository-oid NAME \'repository\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ou MAY ( serialno $ description $ nextRange $ publishingStatus ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( request-oid NAME \'request\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( requestId $ dateOfCreate $ dateOfModify $ requestState $ requestResult $ requestOwner $ requestAgentGroup $ requestSourceId $ requestType $ requestFlag $ requestError $ userMessages $ adminMessages $ realm ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( transaction-oid NAME \'transaction\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( transId $ description $ transName $ transStatus $ transOps ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( crlIssuingPointRecord-oid NAME \'crlIssuingPointRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ crlNumber $ crlSize $ thisUpdate $ nextUpdate $ deltaNumber $ deltaSize $ firstUnsaved $ certificateRevocationList $ deltaRevocationList $ crlCache $ revokedCerts $ unrevokedCerts $ expiredCerts $ cACertificate ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( certificateRecord-oid NAME \'certificateRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $ dateOfModify $ certStatus $ autoRenew $ issueInfo $ metaInfo $ revInfo $ version $ duration $ notAfter $ notBefore $ algorithmId $ subjectName $ signingAlgorithmId $ userCertificate $ issuedBy $ revokedBy $ revokedOn $ extension $ publicKeyData $ issuerName ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( userDetails-oid NAME \'userDetails\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST userDN MAY ( dateOfCreate $ dateOfModify $ password $ p12Expiration ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( keyRecord-oid NAME \'keyRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( serialno $ dateOfCreate $ dateOfModify $ keyState $ privateKeyData $ ownerName $ keySize $ metaInfo $ dateOfArchival $ dateOfRecovery $ algorithm $ publicKeyFormat $ publicKeyData $ archivedBy $ clientId $ dataType $ status $ realm ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiSecurityDomain-oid NAME \'pkiSecurityDomain\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( ou $ name ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiSecurityGroup-oid NAME \'pkiSecurityGroup\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiSubsystem-oid NAME \'pkiSubsystem\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( cn $ Host $ SecurePort $ SubsystemName $ Clone ) MAY ( DomainManager $ SecureAgentPort $ SecureAdminPort $SecureEEClientAuthPort $ UnSecurePort ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( pkiRange-oid NAME \'pkiRange\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( cn $ beginRange $ endRange $ Host $ SecurePort ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( securityDomainSessionEntry-oid NAME \'securityDomainSessionEntry\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST ( cn $ host $ uid $ cmsUserGroup $ dateOfCreate ) X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfCreate-oid NAME \'dateOfCreate\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( dateOfModify-oid NAME \'dateOfModify\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( modified-oid NAME \'modified\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenUserID-oid NAME \'tokenUserID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenStatus-oid NAME \'tokenStatus\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenAppletID-oid NAME \'tokenAppletID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( keyInfo-oid NAME \'keyInfo\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfResets-oid NAME \'numberOfResets\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfEnrollments-oid NAME \'numberOfEnrollments\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfRenewals-oid NAME \'numberOfRenewals\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( numberOfRecoveries-oid NAME \'numberOfRecoveries\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( allowPinReset-oid NAME \'allowPinReset\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( extensions-oid NAME \'extensions\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenOp-oid NAME \'tokenOp\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenID-oid NAME \'tokenID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenMsg-oid NAME \'tokenMsg\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenResult-oid NAME \'tokenResult\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenIP-oid NAME \'tokenIP\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenPolicy-oid NAME \'tokenPolicy\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenIssuer-oid NAME \'tokenIssuer\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenSubject-oid NAME \'tokenSubject\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenSerial-oid NAME \'tokenSerial\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenOrigin-oid NAME \'tokenOrigin\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenType-oid NAME \'tokenType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenKeyType-oid NAME \'tokenKeyType\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenReason-oid NAME \'tokenReason\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenNotBefore-oid NAME \'tokenNotBefore\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( tokenNotAfter-oid NAME \'tokenNotAfter\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( profileID-oid NAME \'profileID\' DESC \'CMS defined attribute\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tokenRecord-oid NAME \'tokenRecord\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ modified $ tokenReason $ tokenUserID $ tokenStatus $ tokenAppletID $ keyInfo $ tokenPolicy $ extensions $ numberOfResets $ numberOfEnrollments $ numberOfRenewals $ numberOfRecoveries $ userCertificate $ tokenType ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tokenActivity-oid NAME \'tokenActivity\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ tokenOp $ tokenIP $ tokenResult $ tokenID $ tokenUserID $ tokenMsg $ extensions $ tokenType ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tokenCert-oid NAME \'tokenCert\' DESC \'CMS defined class\' SUP top STRUCTURAL MUST cn MAY ( dateOfCreate $ dateOfModify $ userCertificate $ tokenUserID $ tokenID $ tokenIssuer $ tokenOrigin $ tokenSubject $ tokenSerial $ tokenStatus $ tokenType $ tokenKeyType $ tokenNotBefore $ tokenNotAfter $ extensions ) X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( tpsProfileID-oid NAME \'tpsProfileID\' DESC \'CMS defined class\' SUP top AUXILIARY MAY ( profileID ) X-ORIGIN \'user-defined\' )\nINFO: Adding attributetypes: ( classId-oid NAME \'classId\' DESC \'Certificate profile class ID\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( certProfileConfig-oid NAME \'certProfileConfig\' DESC \'Certificate profile configuration\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( certProfile-oid NAME \'certProfile\' DESC \'Certificate profile\' SUP top STRUCTURAL MUST cn MAY ( classId $ certProfileConfig ) X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityID-oid NAME \'authorityID\' DESC \'Authority ID\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityKeyNickname-oid NAME \'authorityKeyNickname\' DESC \'Authority key nickname\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN \'user-defined\' )\nINFO: Adding attributetypes: ( authorityParentID-oid NAME \'authorityParentID\' DESC \'Authority Parent ID\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityEnabled-oid NAME \'authorityEnabled\' DESC \'Authority Enabled\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityDN-oid NAME \'authorityDN\' DESC \'Authority DN\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authoritySerial-oid NAME \'authoritySerial\' DESC \'Authority certificate serial number\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityParentDN-oid NAME \'authorityParentDN\' DESC \'Authority Parent DN\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN \'user defined\' )\nINFO: Adding attributetypes: ( authorityKeyHost-oid NAME \'authorityKeyHost\' DESC \'Authority Key Hosts\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN \'user defined\' )\nINFO: Adding objectclasses: ( authority-oid NAME \'authority\' DESC \'Certificate Authority\' SUP top STRUCTURAL MUST ( cn $ authorityID $ authorityKeyNickname $ authorityEnabled $ authorityDN ) MAY ( authoritySerial $ authorityParentID $ authorityParentDN $ authorityKeyHost $ description ) X-ORIGIN \'user defined\' )\nINFO: Setting up ACME schema\nINFO: Importing /usr/share/pki/acme/database/ldap/schema.ldif\nINFO: Adding attributetypes: ( acmeExpires-oid NAME \'acmeExpires\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeValidatedAt-oid NAME \'acmeValidatedAt\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeStatus-oid NAME \'acmeStatus\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeError-oid NAME \'acmeError\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeNonceId-oid NAME \'acmeNonceId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeAccountId-oid NAME \'acmeAccountId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeAccountContact-oid NAME \'acmeAccountContact\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch )\nINFO: Adding attributetypes: ( acmeAccountKey-oid NAME \'acmeAccountKey\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeOrderId-oid NAME \'acmeOrderId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeIdentifier-oid NAME \'acmeIdentifier\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch )\nINFO: Adding attributetypes: ( acmeAuthorizationId-oid NAME \'acmeAuthorizationId\' SUP name )\nINFO: Adding attributetypes: ( acmeAuthorizationWildcard-oid NAME \'acmeAuthorizationWildcard\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 EQUALITY booleanMatch SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeChallengeId-oid NAME \'acmeChallengeId\' SUP name SINGLE-VALUE )\nINFO: Adding attributetypes: ( acmeToken-oid NAME \'acmeToken\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )\nINFO: Adding attributetypes: ( acmeCertificateId-oid NAME \'acmeCertificateId\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseExactMatch SINGLE-VALUE )\nINFO: Adding objectclasses: ( acmeNonce-oid NAME \'acmeNonce\' STRUCTURAL MUST ( acmeNonceId $ acmeExpires ) )\nINFO: Adding objectclasses: ( acmeAccount-oid NAME \'acmeAccount\' STRUCTURAL MUST ( acmeAccountId $ acmeAccountKey $ acmeStatus ) MAY acmeAccountContact )\nINFO: Adding objectclasses: ( acmeOrder-oid NAME \'acmeOrder\' STRUCTURAL MUST ( acmeOrderId $ acmeAccountId $ acmeStatus $ acmeIdentifier $ acmeAuthorizationId ) MAY ( acmeError $ acmeCertificateId $ acmeExpires ) )\nINFO: Adding objectclasses: ( acmeAuthorization-oid NAME \'acmeAuthorization\' STRUCTURAL MUST ( acmeAuthorizationId $ acmeAccountId $ acmeIdentifier $ acmeAuthorizationWildcard $ acmeStatus ) MAY acmeExpires )\nINFO: Adding objectclasses: ( acmeChallenge-oid NAME \'acmeChallenge\' ABSTRACT MUST ( acmeChallengeId $ acmeAccountId $ acmeAuthorizationId $ acmeStatus ) MAY ( acmeValidatedAt $ acmeError ) )\nINFO: Adding objectclasses: ( acmeChallengeDns01-oid NAME \'acmeChallengeDns01\' SUP acmeChallenge STRUCTURAL MUST acmeToken )\nINFO: Adding objectclasses: ( acmeChallengeHttp01-oid NAME \'acmeChallengeHttp01\' SUP acmeChallenge STRUCTURAL MUST acmeToken )\nINFO: Adding objectclasses: ( acmeCertificate-oid NAME \'acmeCertificate\' STRUCTURAL MUST ( acmeCertificateId $ userCertificate ) MAY acmeExpires )\nINFO: Creating indexes\nINFO: Importing /usr/share/pki/kra/conf/index.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-25296192129415365.ldif\nINFO: Adding cn=revokedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=revokedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=issuedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=issuedby,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=publicKeyData,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=publicKeyData,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=clientId,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=clientId,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=dataType,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=dataType,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=status,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=status,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=description,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=description,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=serialno,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=serialno,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=metaInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=metaInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=certstatus,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=certstatus,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requestid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requestid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requesttype,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requesttype,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requeststate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requeststate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requestowner,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requestowner,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=notbefore,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=notbefore,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=notafter,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=notafter,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=duration,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=duration,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=dateOfCreate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=dateOfCreate,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=revokedOn,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=revokedOn,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=archivedBy,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=archivedBy,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=ownername,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=ownername,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=subjectname,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=subjectname,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=requestsourceid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=requestsourceid,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=revInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=revInfo,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=extension,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nWARNING: Unable to add cn=extension,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Adding cn=realm,cn=index,cn=ipaca,cn=ldbm database, cn=plugins, cn=config\nINFO: Setting up database manager\nINFO: Importing /usr/share/pki/server/conf/manager.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-3984013368624234966.ldif\nINFO: Adding ou=csusers,cn=config\nWARNING: Unable to add ou=csusers,cn=config: netscape.ldap.LDAPException: error result (68); Already exists\nINFO: Modifying o=kra,o=ipaca\nINFO: - adding aci: (targetattr = "*")(version 3.0; acl "cert manager access v2"; allow (all) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify o=kra,o=ipaca: netscape.ldap.LDAPException: error result (20); Type or value exists\nINFO: Modifying cn=ldbm database,cn=plugins,cn=config\nINFO: - adding aci: (targetattr = "*")(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Modifying cn=config\nINFO: - adding aci: (targetattr != "aci")(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Modifying ou=csusers,cn=config\nINFO: - adding aci: (targetattr != "aci")(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Modifying cn="o=kra,o=ipaca",cn=mapping tree,cn=config\nINFO: - adding aci: (targetattr = "*")(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify cn="o=kra,o=ipaca",cn=mapping tree,cn=config: netscape.ldap.LDAPException: error result (32); No such object\nINFO: Modifying cn="o=kra,o=ipaca",cn=mapping tree,cn=config\nINFO: - adding aci: (targetattr = "*")(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify cn="o=kra,o=ipaca",cn=mapping tree,cn=config: netscape.ldap.LDAPException: error result (32); No such object\nINFO: Modifying cn="o=kra,o=ipaca",cn=mapping tree,cn=config\nINFO: - adding aci: (targetattr = "*")(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nWARNING: Unable to modify cn="o=kra,o=ipaca",cn=mapping tree,cn=config: netscape.ldap.LDAPException: error result (32); No such object\nINFO: Modifying cn=tasks,cn=config\nINFO: - adding aci: (targetattr = "*")(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=kra,o=ipaca";)\nINFO: Creating VLV indexes\nINFO: Importing /usr/share/pki/kra/conf/vlv.ldif\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-import-1261970238527115258.ldif\nINFO: Adding cn=allKeys-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraAll-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraArchival-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceled-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejected-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraComplete-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=allKeys-pki-tomcatIndex, cn=allKeys-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraAll-pki-tomcatIndex, cn=kraAll-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraArchival-pki-tomcatIndex, cn=kraArchival-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRecovery-pki-tomcatIndex, cn=kraRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceled-pki-tomcatIndex, cn=kraCanceled-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledEnrollment-pki-tomcatIndex, cn=kraCanceledEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCanceledRecovery-pki-tomcatIndex, cn=kraCanceledRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejected-pki-tomcatIndex, cn=kraRejected-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedEnrollment-pki-tomcatIndex, cn=kraRejectedEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraRejectedRecovery-pki-tomcatIndex, cn=kraRejectedRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraComplete-pki-tomcatIndex, cn=kraComplete-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteEnrollment-pki-tomcatIndex, cn=kraCompleteEnrollment-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Adding cn=kraCompleteRecovery-pki-tomcatIndex, cn=kraCompleteRecovery-pki-tomcat, cn=ipaca, cn=ldbm database, cn=plugins, cn=config\nINFO: Rebuilding VLV indexes\nINFO: Creating /var/lib/pki/pki-tomcat/temp/pki-kra-reindex-8248341685647863582.ldif\nINFO: Adding cn=index1160527115, cn=index, cn=tasks, cn=config\nINFO: Waiting for task cn=index1160527115, cn=index, cn=tasks, cn=config (1s)\nINFO: Getting cn=index1160527115, cn=index, cn=tasks, cn=config\nINFO: Task cn=index1160527115, cn=index, cn=tasks, cn=config complete\nFINE: PKIClientSocketListener.alertReceived: begins\nFINE: SSL alert received:\nFINE: - reason: CLOSE_NOTIFY\nFINE: - client: 10.1.1.7\nFINE: - server: 10.1.1.7\nFINE: - subject: SYSTEM\nFINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertReceived: CS_CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertReceived: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636 reason=CLOSE_NOTIFY\nFINE: PKIClientSocketListener.alertSent: begins\nFINE: PKIClientSocketListener.alertSent: got description:0\nFINE: PKIClientSocketListener.alertSent: got reason:CLOSE_NOTIFY\nFINE: PKIClientSocketListener.alertSent: CS_CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertSent: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636 reason=CLOSE_NOTIFY\nFINE: SSL alert sent:\nFINE: - reason: CLOSE_NOTIFY\nFINE: - client: 10.1.1.7\nFINE: - server: 10.1.1.7\nFINE: - subject: SYSTEM\nFINE: SignedAuditLogger: event CLIENT_ACCESS_SESSION_TERMINATED\nFINE: PKIClientSocketListener.alertSent: CS_CLIENT_ACCESS_SESSION_ESTABLISH_FAILURE\nFINE: PKIClientSocketListener.alertSent: clientIP=10.1.1.7 serverIP=10.1.1.7 serverPort=636 reason=CLOSE_NOTIFY\nINFO: Updating ranges for KRA clone\nINFO: Updating request ID range\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-range-request request --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:24 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Requesting request range\nINFO: HTTP request: POST /kra/admin/kra/updateNumberRange HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 57\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:25 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 165\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Response: <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>0</Status><beginNumber>99980001</beginNumber><endNumber>99990000</endNumber></XMLResponse>\nFINE: Status: 0\nINFO: Begin: 99980001\nINFO: End: 99990000\nINFO: Updating serial number range\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-range-request serialNo --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:28 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Requesting serialNo range\nINFO: HTTP request: POST /kra/admin/kra/updateNumberRange HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 58\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:29 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 167\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Response: <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>0</Status><beginNumber>11ffe0001</beginNumber><endNumber>11fff0000</endNumber></XMLResponse>\nFINE: Status: 0\nINFO: Begin: 11ffe0001\nINFO: End: 11fff0000\nINFO: Updating replica ID range\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-range-request replicaId --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:32 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Requesting replicaId range\nINFO: HTTP request: POST /kra/admin/kra/updateNumberRange HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 59\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:32 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 157\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Response: <?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><Status>0</Status><beginNumber>1285</beginNumber><endNumber>1289</endNumber></XMLResponse>\nFINE: Status: 0\nINFO: Begin: 1285\nINFO: End: 1289\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Updating configuration for KRA clone\nINFO: Updating configuration\nDEBUG: Command: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://ipa2.example.com:443 kra-config-export --names internaldb.ldapauth.password,internaldb.replication.password,cloning.ca.type --substores internaldb,internaldb.ldapauth,internaldb.ldapconn,kra.transport,kra.storage,kra.subsystem,kra.audit_signing --session 7645071616159216931 --output-format json --debug\nINFO: Connecting to https://ipa2.example.com:443\nINFO: HTTP request: GET /pki/rest/info HTTP/1.1\nINFO: Accept: application/xml\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: Server certificate: CN=ipa2.example.com,O=example.com\nINFO: HTTP response: HTTP/1.1 404 Not Found\nINFO: Date: Sun, 29 Nov 2020 07:38:36 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Length: 196\nINFO: Keep-Alive: timeout=30, max=100\nINFO: Connection: Keep-Alive\nINFO: Content-Type: text/html; charset=iso-8859-1\nWARNING: Unable to get server info: Not Found\nINFO: Getting configuration properties\nINFO: HTTP request: POST /kra/admin/kra/getConfigEntries HTTP/1.1\nINFO: Content-Type: application/x-www-form-urlencoded\nINFO: Content-Length: 269\nINFO: Host: ipa2.example.com:443\nINFO: Connection: Keep-Alive\nINFO: User-Agent: Apache-HttpClient/4.5.5 (Java/1.8.0_272)\nINFO: HTTP response: HTTP/1.1 200 200\nINFO: Date: Sun, 29 Nov 2020 07:38:36 GMT\nINFO: Server: Apache/2.4.43 (Fedora) OpenSSL/1.1.1g mod_wsgi/4.6.6 Python/3.7 mod_auth_gssapi/1.6.1\nINFO: Content-Type: application/xml\nINFO: Content-Length: 10909\nINFO: Keep-Alive: timeout=30, max=99\nINFO: Connection: Keep-Alive\nFINE: Status: 0\nINFO: Properties:\nINFO: - internaldb._000\nINFO: - internaldb._001\nINFO: - internaldb._002\nINFO: - internaldb.basedn\nINFO: - internaldb.database\nINFO: - internaldb.maxConns\nINFO: - internaldb.minConns\nINFO: - internaldb.ldapauth.authtype\nINFO: - internaldb.ldapauth.bindDN\nINFO: - internaldb.ldapauth.bindPWPrompt\nINFO: - internaldb.ldapauth.clientCertNickname\nINFO: - internaldb.ldapconn.host\nINFO: - internaldb.ldapconn.port\nINFO: - internaldb.ldapconn.secureConn\nINFO: - kra.transport.cert\nINFO: - kra.transport.certreq\nINFO: - kra.transport.nickname\nINFO: - kra.transport.tokenname\nINFO: - kra.storage.cert\nINFO: - kra.storage.certreq\nINFO: - kra.storage.nickname\nINFO: - kra.storage.tokenname\nINFO: - kra.subsystem.cert\nINFO: - kra.subsystem.certreq\nINFO: - kra.subsystem.dn\nINFO: - kra.subsystem.nickname\nINFO: - kra.subsystem.tokenname\nINFO: - kra.audit_signing.cert\nINFO: - kra.audit_signing.certreq\nINFO: - kra.audit_signing.nickname\nINFO: - kra.audit_signing.tokenname\nINFO: - internaldb.replication.password\nINFO: - cloning.ca.type\nINFO: Storing subsystem config: /var/lib/pki/pki-tomcat/kra/conf/CS.cfg\nINFO: Storing registry config: /var/lib/pki/pki-tomcat/kra/conf/registry.cfg\nINFO: Restarting server\nDEBUG: Command: systemctl restart pki-tomcatd(a)pki-tomcat.service\nINFO: FIPS mode is not enabled\nINFO: Subsystem status: running\nINFO: Configuring KRA subsystem\nINFO: Setting up clone\nINFO: Creating clone setup request\n/usr/lib/python3.6/site-packages/urllib3/connection.py:362: SubjectAltNameWarning: Certificate for ipa.example.com has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)\n SubjectAltNameWarning\nINFO: Setting up database\nINFO: Creating database setup request\nINFO: Getting sslserver cert info from CS.cfg\nINFO: Getting sslserver cert info from NSS database\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /tmp/tmpl_0lpu4u/password.txt -n Server-Cert cert-pki-ca -a\nDEBUG: Command: certutil -L -d /etc/pki/pki-tomcat/alias -f /tmp/tmpef27un35/password.txt\nINFO: Setting up transport certificate\nINFO: transport certificate is already set up\nINFO: Setting up storage certificate\nINFO: storage certificate is already set up\nINFO: Setting up sslserver certificate\nINFO: sslserver certificate is already set up\nINFO: Setting up subsystem certificate\nINFO: subsystem certificate is already set up\nINFO: Setting up audit_signing certificate\nINFO: audit_signing certificate is already set up\nINFO: Backing up keys into /etc/pki/pki-tomcat/alias/kra_backup_keys.p12\nDEBUG: Command: pki-server subsystem-cert-export kra -i pki-tomcat --pkcs12-file /etc/pki/pki-tomcat/alias/kra_backup_keys.p12 --pkcs12-password-file /tmp/tmpdeq3qnpk/password.txt\nINFO: Setting up security domain\nINFO: Creating security domain setup request\nINFO: Finalizing KRA configuration\nINFO: Creating finalize config request\n') See the installation logs and the following files/directories for more information: /var/log/pki/pki-tomcat [error] RuntimeError: KRA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. KRA configuration failed. The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@ipa]~#

4 4

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

Help with Ghost Replica removal please.
by Nicholas Cross 02 Aug '24

02 Aug '24

I am on a long journey upgrading from a mixture of different versions of freeipa to the lastest and i am almost there, currently on 4.10. After removing some older replicas yesterday, a new replica had a fault and we had to restart dirsrv. When it came back up we saw we have ghost replicas across the whole estate 6x replicas in two locations. Issues are reported via `cipa` Digging into the tombstone records, i find there are not the usual tombstone replica records but more like the below. My question is, how do i remove these redundant records? As I believe this is what `cipa` is counting to report the errors. (marked with <<<<<<<<<<<<<<) The usual things do not work: # ipa-replica-manage -p $pass clean-ruv 15 Replica ID 15 not found $ cat remove_ruv.ldif dn: cn=clean 15,cn=cleanallruv,cn=tasks,cn=config changetype: add objectclass: top objectclass: extensibleObject replica-base-dn: dc=ad,dc=companyx,dc=fm replica-id: 15 cn: clean 15 ldapmodify -Y GSSAPI -f remove_ruv.ldif Thanks in advance. Nick $ ldapsearch -D "cn=Directory Manager" -w $pass -Q -o ldif-wrap=no -LLL -b "dc=ad,dc=companyx,dc=fm" '(&(objectclass=nstombstone)(nsUniqueId=ffffffff-ffffffff-ffffffff-ffffffff))' dn: cn=replica,cn=dc\3Dad\2Cdc\3Dcompanyx\2Cdc\3Dfm,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaBindDNGroup: cn=replication managers,cn=sysaccounts,cn=etc,dc=ad,dc=companyx,dc=fm nsDS5ReplicaBindDnGroupCheckInterval: 60 nsDS5ReplicaId: 56 nsDS5ReplicaName: a6b5640c-ad3911ed-a50980fb-6203228c nsDS5ReplicaRoot: dc=ad,dc=companyx,dc=fm nsDS5ReplicaType: 3 nsState:: OAAAAAAAAABSPEJkAAAAAAAAAAAAAAAA7AAAAAAAAAAGAAAAAAAAAA== nsds5ReplicaBackoffMax: 300 nsds5ReplicaLegacyConsumer: off nsds5ReplicaReleaseTimeout: 60 objectClass: top objectClass: nsds5replica objectClass: extensibleobject nsds50ruv: {replicageneration} 5d9e2076000000040000 nsds50ruv: {replica 56 ldap://ipa006.ad.companyx.fm:389} 63ece66f000000380000 64423d4e000000380000 nsds50ruv: {replica 46 ldap://ipa005.ad.companyx.fm:389} 63dbcc200001002e0000 64423cf6000f002e0000 nsds50ruv: {replica 21 ldap://etcd0dc.ad.companyx.fm:389} 5f2d4bc1000000150000 64319ec3276200150000 nsds50ruv: {replica 48 ldap://ipa007.ad.companyx.fm:389} 63ea4e54000100300000 6442397e000a00300000 nsds50ruv: {replica 58 ldap://ipa001dc.ad.companyx.fm:389} 643d03280001003a0000 644232c00001003a0000 nsds50ruv: {replica 60 ldap://ipa002dc.ad.companyx.fm:389} 643d19680001003c0000 644232660004003c0000 nsds50ruv: {replica 62 ldap://ipa003dc.ad.companyx.fm:389} 643d491e0001003e0000 644233340000003e0000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa003dc.ad.companyx.fm;ipa003dc.ad.companyx.fm ;389;62;644238c9000000380000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa007.ad.companyx.fm;ipa007.ad.companyx.fm ;389;48;644238c9000000380000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-etcd2dc.ad.companyx.fm;etcd2dc.ad.companyx.fm;389;unavailable;64423cf6000f002e0000 <<<<<<<<<<<<<< nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa005.ad.companyx.fm;ipa005.ad.companyx.fm ;389;46;644238c9000000380000 nsruvReplicaLastModified: {replica 56 ldap://ipa006.ad.companyx.fm:389} 64423c62 nsruvReplicaLastModified: {replica 46 ldap://ipa005.ad.companyx.fm:389} 64423c0c nsruvReplicaLastModified: {replica 21 ldap://etcd0dc.ad.companyx.fm:389} 00000000 nsruvReplicaLastModified: {replica 48 ldap://ipa007.ad.companyx.fm:389} 64423894 nsruvReplicaLastModified: {replica 58 ldap://ipa001dc.ad.companyx.fm:389} 644231da nsruvReplicaLastModified: {replica 60 ldap://ipa002dc.ad.companyx.fm:389} 6442317a nsruvReplicaLastModified: {replica 62 ldap://ipa003dc.ad.companyx.fm:389} 64423249 nsruvReplicaLastModified: {replica 12} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 15} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 25} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 23} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 40} 644180f7 <<<<<<<<<<<<<< nsds5ReplicaChangeCount: 734077 nsds5replicareapactive: 0

3 14

KDC Self Signed Certificate Creation
by Mark Selby 22 May '24

22 May '24

My company has 6 FreeIPA servers across 3 different locations. Five of the six servers are ok, but one we could not login to. The error messages pointed to the expired certificate located at `/var/kerberos/krb5kdc/kdc.crt` My question is how do I "properly" renew or recreate this certificate. I have been able to renew it with the command listed below - but the renewed cert does not have the same characteristics as the other certs. The existing ones all see to be self signed with the specified profile while my new one does not have these features. It seems to be working Ok but it would great to understand how to generate this cert correctly. All is any help is greatly appreciated. The servers that work all display the following with using getcert list -f /var/kerberos/krb5kdc/kdc.crt Request ID '20191003181545': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: SelfSign issuer: CN=ipa01.sub1.acme.org,O=ACME.ORG subject: CN=ipa01.sub1.acme.org,O=ACME.ORG expires: 2022-08-09 22:06:33 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG certificate template/profile: KDCs_PKINIT_Certs pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes Using the local-getcert start-tracking command below gets me an updated cert but it is not self signed and does not have the specified profile. local-getcert start-tracking \ -k /var/kerberos/krb5kdc/kdc.key \ -f /var/kerberos/krb5kdc/kdc.crt \ -T KDCs_PKINIT_Certs \ -C /usr/libexec/ipa/certmonger/renew_kdc_cert Request ID '20220117193849': status: MONITORING stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: local issuer: CN=Certificate Authority,O=ACME.ORG subject: CN=vipa06.sub3.acme.org,O=ACME.ORG expires: 2024-01-18 17:32:20 UTC principal name: krbtgt/ACME.ORG(a)ACME.ORG key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes

2 2

How to prevent non-admin users of FreeIPA from reading the list of users in the web interface?
by cdknight 16 Apr '24

16 Apr '24

When a user signs in to FreeIPA, I do not want them to be able to view the list of users in my LDAP server under the "Active users" link. I still want them to be able to administer self-service, so they can reset their password, add OTP tokens, etc. How would I go about doing this? The users will only be able to access the web interface, so it doesn't matter whether they can access it from other sources.

5 10

"Credential cache is empty" error preventing certmonger from renewing a host's certificate
by Sam Morris 11 Apr '24

11 Apr '24

I've got an IPA client on which certmonger is unable to renew a certificate. Here are the log messages from certmonger... 2023-06-20 08:24:49 [622035] Certificate submission attempt complete. 2023-06-20 08:24:49 [622035] Child status = 2. 2023-06-20 08:24:49 [622035] Child output: "Server at https://ipa5.ipa.example.com/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is > " 2023-06-20 08:24:49 [622035] Server at https://ipa5.ipa.example.com/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more infor> Here's the tracking request, nothing looks out of the ordinary to me... # getcert list -i 20220519165212 Number of certificates and requests being tracked: 2. Request ID '20220519165212': status: MONITORING ca-error: Server at https://ipa5.ipa.example.com/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Cre. stuck: no key pair storage: type=FILE,location='/etc/cockpit/ws-certs.d/51-myhost.key' certificate: type=FILE,location='/etc/cockpit/ws-certs.d/51-myhost.crt' CA: IPA issuer: CN=Certificate Authority,O=IPA.EXAMPLE.COM subject: CN=myhost.ipa.example.com,O=IPA.EXAMPLE.COM issued: 2023-03-25 16:52:45 UTC expires: 2023-06-23 16:52:45 UTC dns: myhost.ipa.example.com principal name: host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes In order to rule out a problem with ipa5, I used 'ipactl' to stop everything on it, then re-ran 'getcert resubmit -i 20220519165212'. In the subsequent output of 'getcert list -i 20220519165212' I saw the same error message displayed but with the name of a different IPA server. So I don't think this is a problem with a particular IPA server. Next I extracted the CSR data from '/var/lib/certmonger/requests/20220519165212' to a file, authenticated as host/myhost.ipa.example.com (with 'kinit -k') and then ran 'ipa cert-request host.req --principal=host/myhost.ipa.example.com', which worked! So perhaps the problem is with certmonger, or with the way in which it interacts with the IPA server that differs from simply running 'ipa cert-request' as I did manually. I also tried to look for logs on the server side, but I didn't find anything very useful. /var/log/httpd/access_log has: 192.168.0.4 - - [20/Jun/2023:13:21:53 +0000] "POST /ipa/json HTTP/1.1" 401 2719 192.168.0.4 - host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [20/Jun/2023:13:21:53 +0000] "POST /ipa/json HTTP/1.1" 200 526 So it looks like certmonger is having no problem authenticating to ipaapi. httpd is logging: $ journalctl -u httpd -e Jun 20 13:21:56 [121899]: GSSAPI client step 1 Jun 20 13:21:56 [121899]: GSSAPI client step 1 Jun 20 13:21:57 [121899]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) So is looks like ipaapi might be having trouble using Kerberos as a client? I added KRB5_TRACE=/var/lib/httpd/krb5.trace to httpd.service's Environment= and restarted it, then re-ran 'getcert resubmit' on the tracking request. I got these messages: [124285] 1687270136.437160: Initializing FILE:/tmp/krb5cc-httpd with default princ HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM [124285] 1687270136.437161: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> Encrypted/Credentials/v1@X-GSSPROXY: in FILE:/tmp/krb5cc-httpd [124285] 1687270136.437163: Retrieving HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> Encrypted/Credentials/v1@X-GSSPROXY: from FILE:/tmp/krb5cc-httpd with result: 0/Success [124285] 1687270136.437165: Initializing FILE:/run/ipa/ccaches/host~myhost.ipa.example.com@IPA.EXAMPLE.COM-h3azdl with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124285] 1687270136.437166: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> Encrypted/Credentials/v1@X-GSSPROXY: in FILE:/run/ipa/ccaches/host~myhost.ipa.example.com@IPA.EXAMPLE.COM-h3azdl No errors there either. I set KRB5_TRACE=/var/lib/gssproxy/krb5.trace in gssproxy.service's Environment= and got: [124798] 1687270460.854044: Resolving unique ccache of type MEMORY [124798] 1687270460.854045: Initializing MEMORY:GJanRRF with default princ HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270460.854046: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:GJanRRF [124798] 1687270460.854047: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:GJanRRF [124798] 1687270460.854048: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:GJanRRF [124798] 1687270460.854049: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:GJanRRF [124798] 1687270460.854052: Destroying ccache MEMORY:GJanRRF [124798] 1687270460.854054: Resolving unique ccache of type MEMORY [124798] 1687270460.854055: Initializing MEMORY:Cn5E8Va with default princ HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270460.854056: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:Cn5E8Va [124798] 1687270460.854057: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:Cn5E8Va [124798] 1687270460.854058: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:Cn5E8Va [124798] 1687270460.854059: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:Cn5E8Va [124798] 1687270460.854062: Destroying ccache MEMORY:Cn5E8Va [124798] 1687270460.854064: Resolving unique ccache of type MEMORY [124798] 1687270460.854065: Initializing MEMORY:8e5DNHy with default princ HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270460.854066: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:8e5DNHy [124798] 1687270460.854067: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:8e5DNHy [124798] 1687270460.854068: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:8e5DNHy [124798] 1687270460.854069: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:8e5DNHy [124798] 1687270460.854071: Decrypted AP-REQ with server principal HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM: aes256-cts/E0A2 [124798] 1687270460.854072: AP-REQ ticket: host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM, session key aes256-cts/1952 [124798] 1687270460.854073: Negotiated enctype based on authenticator: aes256-cts [124798] 1687270460.854074: Authenticator contains subkey: aes256-cts/2098 [124798] 1687270460.854075: Resolving unique ccache of type MEMORY [124798] 1687270460.854076: Initializing MEMORY:FX6Yqgq with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270460.854077: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:FX6Yqgq [124798] 1687270460.854078: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:FX6Yqgq [124798] 1687270460.854079: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:FX6Yqgq [124798] 1687270460.854080: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:FX6Yqgq [124798] 1687270460.854081: Storing config in MEMORY:FX6Yqgq for : proxy_impersonator: HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270460.854082: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:FX6Yqgq [124798] 1687270460.854083: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:FX6Yqgq [124798] 1687270460.854085: Creating AP-REP, time 1687270460.725581, subkey aes256-cts/BB66, seqnum 668121546 [124798] 1687270461.005570: Destroying ccache MEMORY:FX6Yqgq [124798] 1687270461.005573: Destroying ccache MEMORY:8e5DNHy [124798] 1687270461.005575: Resolving unique ccache of type MEMORY [124798] 1687270461.005576: Initializing MEMORY:NmnNwyD with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270461.005577: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:NmnNwyD [124798] 1687270461.005578: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:NmnNwyD [124798] 1687270461.005579: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:NmnNwyD [124798] 1687270461.005580: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:NmnNwyD [124798] 1687270461.005581: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:NmnNwyD [124798] 1687270461.005582: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:NmnNwyD [124798] 1687270461.005585: Destroying ccache MEMORY:NmnNwyD [124798] 1687270461.005587: Resolving unique ccache of type MEMORY [124798] 1687270461.005588: Initializing MEMORY:gUnl8Xt with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270461.005589: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:gUnl8Xt [124798] 1687270461.005590: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:gUnl8Xt [124798] 1687270461.005591: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:gUnl8Xt [124798] 1687270461.005592: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:gUnl8Xt [124798] 1687270461.005593: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:gUnl8Xt [124798] 1687270461.005594: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:gUnl8Xt [124798] 1687270461.005597: Destroying ccache MEMORY:gUnl8Xt [124798] 1687270461.005599: Resolving unique ccache of type MEMORY [124798] 1687270461.005600: Initializing MEMORY:wBGblf3 with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270461.005601: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:wBGblf3 [124798] 1687270461.005602: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:wBGblf3 [124798] 1687270461.005603: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:wBGblf3 [124798] 1687270461.005604: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:wBGblf3 [124798] 1687270461.005605: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:wBGblf3 [124798] 1687270461.005606: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:wBGblf3 [124798] 1687270461.005609: Destroying ccache MEMORY:wBGblf3 [124798] 1687270461.005611: Resolving unique ccache of type MEMORY [124798] 1687270461.005612: Initializing MEMORY:4uHf47g with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270461.005613: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:4uHf47g [124798] 1687270461.005614: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:4uHf47g [124798] 1687270461.005615: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:4uHf47g [124798] 1687270461.005616: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:4uHf47g [124798] 1687270461.005617: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:4uHf47g [124798] 1687270461.005618: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:4uHf47g [124798] 1687270461.005621: Destroying ccache MEMORY:4uHf47g [124798] 1687270461.005623: Resolving unique ccache of type MEMORY [124798] 1687270461.005624: Initializing MEMORY:9LUdBez with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270461.005625: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:9LUdBez [124798] 1687270461.005626: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:9LUdBez [124798] 1687270461.005627: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:9LUdBez [124798] 1687270461.005628: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:9LUdBez [124798] 1687270461.005629: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:9LUdBez [124798] 1687270461.005630: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:9LUdBez [124798] 1687270461.005634: Initializing MEMORY:cred_allowed_0x7f85d9152380 with default princ host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM [124798] 1687270461.005635: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM in MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005636: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/fast_avail/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005637: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/IPA.EXAMPLE.COM\@IPA.EXAMPLE.COM@X-CACHECONF: in MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005638: Storing HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/refresh_time@X-CACHECONF: in MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005639: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: in MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005640: Storing host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM in MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005641: Destroying ccache MEMORY:cred_allowed_0x7f85d9152380 [124798] 1687270461.005644: Getting credentials host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> ldap/ipa5.ipa.example.com@ using ccache MEMORY:9LUdBez [124798] 1687270461.005645: Retrieving host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:9LUdBez with result: -1765328243/Matching credential not found [124798] 1687270461.005646: Retrieving host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> ldap/ipa5.ipa.example.com@ from MEMORY:9LUdBez with result: -1765328243/Matching credential not found [124798] 1687270461.005647: Retrying host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> ldap/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM with result: -1765328243/Matching credential not found [124798] 1687270461.005648: Retrieving host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM from MEMORY:9LUdBez with result: 0/Success [124798] 1687270461.005649: Getting credentials HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM using ccache MEMORY:9LUdBez [124798] 1687270461.005650: Retrieving host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from MEMORY:9LUdBez with result: -1765328243/Matching credential not found [124798] 1687270461.005651: Retrieving HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM -> krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM from MEMORY:9LUdBez with result: 0/Success [124798] 1687270461.005652: Get cred via TGT krbtgt/IPA.EXAMPLE.COM(a)IPA.EXAMPLE.COM after requesting ldap/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM (canonicalize on) [124798] 1687270461.005653: Generated subkey for TGS request: aes256-cts/FBB4 [124798] 1687270461.005654: etypes requested in TGS request: aes256-cts, aes256-sha2, camellia256-cts, aes128-cts, aes128-sha2, camellia128-cts [124798] 1687270461.005656: Encoding request body and padata into FAST request [124798] 1687270461.005657: Sending request (5335 bytes) to IPA.EXAMPLE.COM [124798] 1687270461.005658: Initiating TCP connection to stream 192.168.0.5:88 [124798] 1687270461.005659: Sending TCP request to stream 192.168.0.5:88 [124798] 1687270461.005660: Received answer (508 bytes) from stream 192.168.0.5:88 [124798] 1687270461.005661: Terminating TCP connection to stream 192.168.0.5:88 [124798] 1687270461.005662: Response was from master KDC [124798] 1687270461.005663: Decoding FAST response [124798] 1687270461.005664: Decoding FAST response [124798] 1687270461.005665: Got cred; -1765328371/KDC can't fulfill requested option [124798] 1687270461.005669: Destroying ccache MEMORY:9LUdBez The only thing that looks like an error in that output is "KDC can't fulfill requested option". The last place I can think of looking is in /var/log/krb5kdc.log: Jun 20 14:17:34 ipa5.ipa.example.com krb5kdc[119948](info): TGS_REQ : handle_authdata (-1765328371) Jun 20 14:17:34 ipa5.ipa.example.com krb5kdc[119948](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25)}) 192.168.0.5: HANDLE_AUTHDATA: authtime 1687270653, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM for ldap/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM, KDC can't fulfill requested option Jun 20 14:17:34 ipa5.ipa.example.com krb5kdc[119948](info): ... CONSTRAINED-DELEGATION s4u-client=host/myhost.ipa.example.com(a)IPA.EXAMPLE.COM Jun 20 14:17:34 ipa5.ipa.example.com krb5kdc[119948](info): closing down fd 12 There's another instance of "KDC can't fulfill requested option". My best guess is that there's something wrong with the constrained delegation setup that lets ipaapi access the directory on behalf of the client host? But this looks fine: $ ipa servicedelegationrule-show ipa-http-delegation Delegation name: ipa-http-delegation Allowed Target: ipa-ldap-delegation-targets, ipa-cifs-delegation-targets Member principals: HTTP/ipa3.ipa.example.com(a)IPA.EXAMPLE.COM, HTTP/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM, HTTP/ipa6.ipa.example.com(a)IPA.EXAMPLE.COM $ ipa servicedelegationtarget-show ipa-ldap-delegation-targets Delegation name: ipa-ldap-delegation-targets Member principals: ldap/ipa3.ipa.example.com(a)IPA.EXAMPLE.COM, ldap/ipa5.ipa.example.com(a)IPA.EXAMPLE.COM, ldap/ipa6.ipa.example.com(a)IPA.EXAMPLE.COM ... and in any case a simple 'ipa cert-request' as the host worked fine, it's only certmonger's attempts to request a certificate that are failing. The IPA client has: ipa-client-4.9.11-5.module+el8.8.0+18147+84fe6ec1.x86_64 certmonger-0.79.17-2.el8.x86_64 ... and the server has: ipa-server-4.9.11-5.module+el8.8.0+18146+a1d8660b.x86_64 Any troubleshooting help is really appreciated! -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 5

missing attribute "sambaGroupType" when attempting to create a new group - creating groups worked previously
by Tom Spettigue 20 Mar '24

20 Mar '24

Hey all - I seem to be getting the following error message whenever I try to create a group via the web interface: ``` IPA Error 4205: ObjectclassViolation missing attribute "sambaGroupType" required by object class "sambaGroupMapping" ``` I'm not sure exactly what's happening, except that I know I've created groups numerous times before, and never gotten this error message. Does anyone have any ideas?

1 2

ipa: ERROR: No valid Negotiate header - from/in container replica
by lejeczek 14 Mar '24

14 Mar '24

Hi guys. This is my first trial/test of replicas in container - here I added a replica to already existing, bare-metal IPA domain, which otherwise works a okey - so numerous issues are possible. In container, only in this replica, I get: bash-5.1# ipa dnszone-find ipa: ERROR: No valid Negotiate header in server response What that is, might be, a symptom of? Where to go with troubleshooting? All thoughts share are much appreciated. many thanks, L.

2 2

Login failed due to an unknown reason
by Dan West 06 Mar '24

06 Mar '24

I am running into a strange issue with a few user accounts where logging into the web interface gives them the error message "Login failed due to an unknown reason”. It also prevents them from SSH’ing into IPA bound systems using passwords. Pubkeys work fine (as long as it is manually added to the local accounts) and any services I have bound to it (Gitlab, Mattermost, Owncloud, etc) seem to work fine. I ’think’ this is kerberos related since the only services that are using it is SSH and probably the IPA web interface. Here is the apache error log for it: [Thu Jan 13 09:15:38.688228 2022] [wsgi:error] [pid 579266:tid 139812542121728] [remote xx.xxx.xx.xxx:52162] ipa: INFO: 401 Unauthorized: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2598844948): TGT has been revoked I ’think’ the message "TGT has been revoked” is due to the 401 error, since the user is not showing as being authorized to login. However, this user is enabled and I have tried a number of things to try to fix it: 1. Disable/Re-enable account 2. Reset passwords 3. Kinit username (seems to get a ticket, but logins still do not work) 4. Run the account migration task (using the web gui) 5. Restart the IPA server and services 6. Re-initialize the IPA server from another master Also, I can confirm that the passwords are correct since a failed password error message shows up differently and other services are using it correctly. Going down the Kerberos path, here is the krb5kdc log file: Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: ISSUE: authtime 1642094138, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, WELLKNOWN/ANONYMOUS(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: NEEDED_PREAUTH: testuser(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM, Additional pre-authentication required Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): AS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: ISSUE: authtime 1642094138, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, testuser(a)EXAMPLE.COM for krbtgt/EXAMPLE.COM(a)EXAMPLE.COM Jan 13 09:15:38 ipa.example.com krb5kdc[579225](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-997841278-3584560916-1456654135], PAC [S-1-5-21-2108153867-2082035330-3701898995] Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ : handle_authdata (-1765328364) Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: HANDLE_AUTHDATA: authtime 1642094138, etypes {rep=UNSUPPORTED:(0)} testuser(a)EXAMPLE.COM for HTTP/ipa.example.com(a)EXAMPLE.COM, TGT has been revoked Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): closing down fd 12 Jan 13 09:15:38 ipa.example.com krb5kdc[579226](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-997841278-3584560916-1456654135], PAC [S-1-5-21-2108153867-2082035330-3701898995] Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ : handle_authdata (-1765328364) Jan 13 09:15:38 ipa.example.com krb5kdc[579226](info): TGS_REQ (7 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), camellia256-cts-cmac(26), aes128-cts-hmac-sha1-96(17), aes128-cts-hmac-sha256-128(19), camellia128-cts-cmac(25), DEPRECATED:arcfour-hmac(23)}) yy.yy.yy.yy: HANDLE_AUTHDATA: authtime 1642094138, etypes {rep=UNSUPPORTED:(0)} testuser(a)EXAMPLE.COM for HTTP/ipa.example.com(a)EXAMPLE.COM, TGT has been revoked I only see two errors that might be related: "PAC record claims domain SID different to local domain SID or any trusted domain SID” "DEPRECATED:arcfour-hmac(23)” However, those might just be red herrings or something else that is unrelated. So far, there are only a small number of accounts that have this problem, but more seem to be popping up on a daily basis. The only fix I have found is the nuclear option, where I completely remove the account and then add it back in with the same UID/GID, group memberships and policies. After that it seems to work fine. However, I would rather not want to do this to all accounts since that would be a logistical nightmare. Are there any suggestions for either troubleshooting or fixing this problem with a lighter approach? Is it possible to reset or regenerate the users kerberos authentication? Thanks, Dan West Systems Administrator Galois Inc. http://galois.com

4 8

certmonger error on ubuntu
by Robson Francisco de Souza 08 Feb '24

08 Feb '24

Hello! I've been running FreeIPA 4.3.1 on Ubuntu 16.04 for almost two years and most certificates should expire within three weeks. As this deadline approaches, I noticed certmonger has been unable to renew certificates due to the error below. After googling for two days, I found this issue has been observed by many people before, mostly after expiration of the certificates, as in https://tinyurl.com/vajmocw Still, I couldn't find a solution to this problem. If it is impossible to fix this issue while using FreeIPA 4.3.1, I would like to: 1) Find a way to renew all certificates even if certmonger can't be fixed. This would allow me to postpone the solution to after the next OS and/or FreeIPA upgrade 2) Find out what version of FreeIPA I should upgrade to while the operating system remains Ubuntu 16.04 Any help would be appreciated! Thanks! Robson ======> Command: systemctl status certmonger Nov 17 20:53:08 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 20:53:08 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:10:13 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875188]: dogtag-ipa-renew-agent returned 3 Nov 17 21:10:13 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:10:13 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:20 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875738]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:21 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:21 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: Forwarding request to dogtag-ipa-renew-agent Nov 17 21:25:31 ipa.cefapnet.icb.usp.br dogtag-ipa-ca-renew-agent-submit[3875766]: dogtag-ipa-renew-agent returned 3 Nov 17 21:25:31 ipa.cefapnet.icb.usp.br certmonger[3873125]: 2019-11-17 21:25:31 [3873125] Error 77 connecting to https://ipa.cefapnet.icb.usp.br:8443/ca/agent/ca/profileReview: Problem with the SSL CA cert (path? access rights?). -- Robson Francisco de Souza, PhD Laboratório de Estrutura e Evolução de Proteínas (LEEP/PSEL) Departamento de Microbiologia Instituto de Ciências Biomédicas Universidade de São Paulo Av. Prof. Lineu Prestes, 1374 - Ed. Biomédicas II - Sala 250 - 2o. andar Tel: 3091-0891 Cidade Universitária - CEP 05508-900 - São Paulo - SP - Brasil ---- Robson Francisco de Souza, PhD Protein Structure and Evolution Laboratory (LEEP/PSEL) Microbiology Departament Biomedical Sciences Institute University of Sao Paulo Av. Prof. Lineu Prestes, 1374 - Biomédicas II - Sala 250 Phone: 55-11-3091-0891 Cidade Universitária - ZIP 05508-900 - São Paulo - SP - Brazil

6 10

Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Braden McGrath 11 Jan '24

11 Jan '24

Hello FreeIPA-users. The Subject line is the core of my question here; I'll provide a bit more detail below. I work for what is (effectively) a startup, non-profit internet provider. I have an extensive Windows background, and "know enough to be dangerous" with Linux & BSD (have been tinkering with GNU/Linux on and off since Slackware 3.0 or 3.1). I'm very familiar with Windows Active Directory, but the org does not have any AD infrastructure right now (and being nonprofit, are trying to avoid spending money for MS, especially when all of the other VMs will be Linux or BSD anyway). Given the nonprofit nature, I discovered FreeIPA when looking for a free centralized directory system. The goal is to consolidate all credentials for *other* Linux VMs (customer-facing DNS, CRM web server, SNMP/network graphing servers, etc) as well as provide a back-end for RADIUS for management of network equipment (switches, routers, P2P wireless, etc). Simplifying DNS management and replication is also appealing, I'd rather administrate one system than two or three. In case it changes your opinion of the plan at all - all of the network equipment and VMs will be on *private* (10.x) IPv4 space and behind one or more firewalls, at least initially. We do want to add public IPv6, but do not have that yet. We only have a small allocation (/26) of public v4 from our upstream that will be NATed through a firewall and not directly on any devices. The traffic to FreeIPA is going to be internal-only, I do not plan on exposing FreeIPA's DNS "to the world" at all. Even customer-facing internal DNS will likely be through separate caching forwarders pointing back to FreeIPA. I have a completely unused, publicly registered domain (let's just call it "example.net" for this thread) available to dedicate to this system. We also own "example.org" and are using that for our public web presence, and I intend to keep that entirely standalone. Given that I have no current "interoperability" concerns, is there anything "wrong" with putting FreeIPA directly at the root of example.net? Or would it be more wise, from an interop, security, or manageability standpoint (i.e. a "best practice"), to root FreeIPA at something like auth.example.net or ipa.example.net and then have a separate set of nameservers handling the base domain? If I put FreeIPA's root (and Kerberos realm) in a subdomain, is it possible to *also* have it manage the parent domain's DNS entries? I've read through the Quick Start Guide and Deployment Recommendations (https://www.freeipa.org/page/Deployment_Recommendations) which is part of how I've come to the decisions I've made thus far. I couldn't really find guidance one way or the other on whether FreeIPA "should" be in a subdomain or not, hence this posting. I would appreciate any insight the community can provide!

3 4

FreeIPA web session timeout
by Yuri Krysko 11 Jan '24

11 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

Auto cleanup old enrolled hosts
by Russ Long 01 Dec '23

01 Dec '23

We're adding FreeIPA to an immutable, often rotated environment (AWS ECS Hosts). These hosts are spun up and down at least daily. Is there a way to check FreeIPA to see when a host has last communicated with the FreeIPA Cluster? I'd like to use this information to auto-delete hosts that have not reported in from the FreeIPA host list.

5 4

New plugin almost ready - postfixadmin
by Francis Augusto Medeiros-Logeay 12 Nov '23

12 Nov '23

Hi, I have almost finished a plugin for FreeIPA, so that admins can have similar functionality found on Postfix Admin. https://github.com/oculos/freeipa-postfixadmin/blob/main/README.md freeipa-postfixadmin/README.md at main · oculos/freeipa-postfixadmin github.com There is already a good plugin that does a bit of that, but the goal is a bit different. My main goal is not to mix up postfix configuration with groups and hosts, but have separate entities for domain, aliases and virtual domains, in addition to mailboxes. It was written mostly to allow me to migrate my mailboxes from MySQL to FreeIPA, and I don’t have a huge postfix configuration - I only have multiple domains, mailboxes, aliases and virtual domains, so that’s the functionality I wanted with this plugin. There are a few things missing before this can go in production («production» here means to actually migrate my mailboxes to FreeIPA), adding a mailbox to ipa users on the gui being the most important one. I would appreciate any comments and feedbacks regarding this plugin. It wasn’t easy to understand the logic on how to write one, but I got the hang of it (for simple stuff). Best, Francis

2 3

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

Installing FreeIPA server + replica using Ansible Role FreeIPA
by Finn Fysj 25 Oct '23

25 Oct '23

The installation of IPA server and replica does not produce desired result. Even though the mkhomedir is set to true the feature is not enabled in the authselect. Also the replica server does not replicate SUDO and HBAC rules from the IPA master. Is the only solution to re-install the whole IPA server/replicas stuff? Kinda stupid. Example of the IPA server role: - role: freeipa.ansible_freeipa.ipaserver vars: ipaserver: "{{ ansible_hostname }}.example" ipaserver_hostname: "{{ ansible_hostname }}.example" ipaadmin_password: "test123" ipadm_password: "test321" ipaserver_domain: "example.com" ipaserver_realm: "EXAMPLE.COM" ipaserver_no_host_dns: true ipaserver_mem_check: true ipaserver_install_packages: true ipaserver_setup_dns: false ipaserver_no_pkinit: true ipaserver_no_hbac_allow: true ipaserver_no_ui_redirect: false ipaclient_no_ntp: true ipaclient_mkhomedir: true ipaclient_no_sudo: false

5 24

FreeIPA PKI Certs wont renew "Adjustment limit exceeded"
by T A 22 Sep '23

22 Sep '23

On FreeIPA version 4.6.8-5 realized that pki-tomcatd wouldnt start ipactl status pki-tomcatd Service: STOPPED Ran 'getcert list' and found the 'pki-tomcat' cert was expired Rolled back the system clock to before the cert expired, now starts up ipactl status pki-tomcatd Service: STARTED Tried to renew with 'ipa-getcert resubmit -i "123456"' but it shows "status: CA_UNREACHABLE" 'ipa-cert fix' didnt work either Checked logs again 'journalctl -t certmonger' and found 'ns-slapd' was giving out this error when it tried to renew 'csngen_adjust_local_time - Adjustment limit exceeded: value - 435060 limit - 86400' Any way to change the adjustment limit or force this cert to renew anyway?

3 6

kinit: KDC can't fulfill requested option while renewing credentials - which approach?
by Pieter Baele 20 Sep '23

20 Sep '23

I tried various approached to get Renewable tickets : modifying the kdc modifying krb5.conf using kadmin.local on every replica to modify the principal; which is not working - as designed (?)- in IPA What should I do to get a ticket with the correct R flag from IPA ? I don't think this is SSSD related (the service needing the renewable ticket this way is Apache Storm) Thanks a lot!

3 4

AIX - IPA group membership
by Ronald Wimmer 12 Sep '23

12 Sep '23

I can and use IPA users on an AIX client. As well as groups. But somehow group membership does not seem to be configured correctly... # id y179768 uid=1246660005(y179768) gid=1246660005(y179768) # lsgroup -R LDAP ipa-aix-g ipa-aix-g id=1246690508 users= registry=LDAP Anyone has a hint what could be misconfigured?

4 15

2FA only for certain hosts/host groups
by Ronald Wimmer 04 Sep '23

04 Sep '23

Is it possible to enforce the second factor for a user only when trying to login to specific hosts/host groups? List here says yes... https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-indi… I'm gonna give it a try. Cheers, Ronald

2 4

Custom ssl cert for freeipa docker
by Leo O 26 Aug '23

26 Aug '23

Hello Guys, I'm would like to use custom ssl certificates for http and ldap, I saw the following: https://www.freeipa.org/page/Using_3rd_part_certificates_for_HTTP/LDAP But I wonder how would this be done when using freeipa in a docker/podman container. I mean the container is started with "--read-only" flag. So it's not clear to me what the correct approach here would be. I hope it's not that you have to re-build an own image with the ssl certificates every time? Background Info: I'm using acme.sh in a VM, which creates my wildcard letsencrypt certificates and puts them on an nfs share. Freeipa should simply use that certificates for http and ldap and that's it. No renewing as this is done by the acme.sh VM itself.

3 10

In FreeIPA AD trust environment add AD user to local group
by Sameer Gurung 14 Aug '23

14 Aug '23

I have integrated freeipa with AD via a two way trust. However I now have a problem How do I add my AD users logging in to linux clients to the local machines docker group so that they can run docker. Any help would be appreciated. Thanks everyone! Sameer K Gurung -- This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. Saint Mary's College, Shillong, Meghalaya, India-793003, smcs.ac.in <http://smcs.ac.in>

3 9

Visibility/access of Freeipa users to windows on trusted AD
by Francis Augusto Medeiros-Logeay 09 Aug '23

09 Aug '23

Hi, I have searched this everywhere, but can't find it. I want to grant access to a FreeIPA user to a Windows machine. When I try to grant the user access on windows, adding it like FREEIPADOMAIN\freeipauser, I get an error. There is a trust between both domains, but every place where I see the trusted domain on Windows (for example when configuring a GPO) I can't search for FreeIPA users. Is this how it is supposed to be, or how can I see my FreeIPA users on Windows the same way I see AD users on my freeipa linux clients? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

2 4

Help with ACIError: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure in attempt to loadbalance
by dweller dweller 30 Jul '23

30 Jul '23

Hi. I am aware that there have been many discussions regarding fully load balancing FreeIPA replicas, but I am doing it for the sake of experimentation. For my tests, I mainly rely on this article - https://mrgecko.org/blog/2022/freeipa-load-balance, although I am using nginx instead of HAProxy. Currently, I have only one replica that is behind an nginx proxy, and I am able to access the FreeIPA WebUI via the load balancer's hostname and perform usual operations without any issues. However, I am now trying to enroll a host using the "--server=<loadbalancer_hostname>" option, but the installation fails. I have collected two types of ipaclient-install logs - one that fails when I try to add the host with "--server=<loadbalancer>", and one "healthy" log from the enrollment of the same host, bypassing the proxy directly to the ipa-server (as in the usual operation). with "--server=<loadbalancer>": >failed to find session_cookie in persistent storage for principal 'host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL' >trying https://lb.ipa.edu.novalocal/ipa/json >Created connection context.rpcclient_140218712782800 >[try 1]: Forwarding 'schema' to json server 'https://lb.ipa.edu.novalocal/ipa/json' >New HTTP connection (lb.ipa.edu.novalocal) >[4637] 1690357386.007597: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL >[4637] 1690357386.007598: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL using ccache FILE:/etc/ipa/.dns_ccache >[4637] 1690357386.007599: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache with result: -1765328243/Matching credential not found (filename: /etc/ipa/.dns_ccache) >[4637] 1690357386.007600: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krbtgt/EDU-IPA.NOVALOCAL(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[4637] 1690357386.007601: Starting with TGT for client realm: host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krbtgt/EDU-IPA.NOVALOCAL(a)EDU-IPA.NOVALOCAL >[4637] 1690357386.007602: Requesting tickets for HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL, referrals on >[4637] 1690357386.007603: Generated subkey for TGS request: aes256-cts/F148 >[4637] 1690357386.007604: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts >[4637] 1690357386.007606: Encoding request body and padata into FAST request >[4637] 1690357386.007607: Sending request (2338 bytes) to EDU-IPA.NOVALOCAL >[4637] 1690357386.007608: Initiating TCP connection to stream 172.28.19.159:88 >[4637] 1690357386.007609: Sending TCP request to stream 172.28.19.159:88 >[4637] 1690357386.007610: Received answer (2307 bytes) from stream 172.28.19.159:88 >[4637] 1690357386.007611: Terminating TCP connection to stream 172.28.19.159:88 >[4637] 1690357386.007612: Response was from master KDC >[4637] 1690357386.007613: Decoding FAST response >[4637] 1690357386.007614: FAST reply key: aes256-cts/2EEF >[4637] 1690357386.007615: TGS reply is for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL with session key aes256-cts/011A >[4637] 1690357386.007616: TGS request result: 0/Success >[4637] 1690357386.007617: Received creds for desired service HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL >[4637] 1690357386.007618: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL in FILE:/etc/ipa/.dns_ccache >[4637] 1690357386.007620: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/lb.ipa.edu.novalocal(a)EDU-IPA.NOVALOCAL, seqnum 355879243, subkey aes256-cts/2361, session key aes256-cts/011A >[4637] 1690357386.007625: Read AP-REP, time 1690357386.7621, subkey aes256-cts/9ABD, seqnum 40531156 >received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=%2bhag7JQJbAfw2IDK9dAniiDEoewHlMpUXT5bjUBYHxr4jsjVz7FOJdB7Ch8KsOBwJAOlnf6NAdJOJik2a%2buW%2bRhvchtk3puGPk0Q6PZ34UESQLVyelSgVzjsWPeybbNKAwa%2f6pQJoCYWd5drZDbxnv%2fz0qxNkJ2niQikaXi1ZkgndV7z5r00gPluZhJS9Mb6Nrl9T1JWUVc0UZJAk0LaJGTjjEBUxcpDaXs6QMq1LvY8BYfmff3KLkm%2b8JyfX6hRkUA088wimKQsLsHnHKbInDtgt2SwQCntfKIXQt9YEbvyOr9w1%2bWNEXDXLtGMxQT3;path=/ipa;httponly;secure;']' >storing cookie 'ipa_session=MagBearerToken=%2bhag7JQJbAfw2IDK9dAniiDEoewHlMpUXT5bjUBYHxr4jsjVz7FOJdB7Ch8KsOBwJAOlnf6NAdJOJik2a%2buW%2bRhvchtk3puGPk0Q6PZ34UESQLVyelSgVzjsWPeybbNKAwa%2f6pQJoCYWd5drZDbxnv%2fz0qxNkJ2niQikaXi1ZkgndV7z5r00gPluZhJS9Mb6Nrl9T1JWUVc0UZJAk0LaJGTjjEBUxcpDaXs6QMq1LvY8BYfmff3KLkm%2b8JyfX6hRkUA088wimKQsLsHnHKbInDtgt2SwQCntfKIXQt9YEbvyOr9w1%2bWNEXDXLtGMxQT3;' for principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL >[4637] 1690357386.007629: Storing config in FILE:/etc/ipa/.dns_ccache for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL: X-IPA-Session-Cookie: ipa_session=MagBearerToken=%2bhag7JQJbAfw2IDK9dAniiDEoewHlMpUXT5bjUBYHxr4jsjVz7FOJdB7Ch8KsOBwJAOlnf6NAdJOJik2a%2buW%2bRhvchtk3puGPk0Q6PZ34UESQLVyelSgVzjsWPeybbNKAwa%2f6pQJoCYWd5drZDbxnv%2fz0qxNkJ2niQikaXi1ZkgndV7z5r00gPluZhJS9Mb6Nrl9T1JWUVc0UZJAk0LaJGTjjEBUxcpDaXs6QMq1LvY8BYfmff3KLkm%2b8JyfX6hRkUA088wimKQsLsHnHKbInDtgt2SwQCntfKIXQt9YEbvyOr9w1%2bWNEXDXLtGMxQT3;\x00 >[4637] 1690357386.007630: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krb5_ccache_conf_data/X-IPA-Session-Cookie/host\/test-lb-enroll.edu.novalocal\@EDU-IPA.NOVALOCAL@X-CACHECONF: in FILE:/etc/ipa/.dns_ccache >Destroyed connection context.rpcclient_140218712782800 > File "/usr/lib64/python3/site-packages/ipapython/admintool.py", line 180, in execute > return_value = self.run() > File "/usr/lib64/python3/site-packages/ipapython/install/cli.py", line 342, in run > return cfgr.run() > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 360, in run > return self.execute() > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 386, in execute > for rval in self._executor(): > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 431, in __runner > exc_handler(exc_info) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception > self._handle_exception(exc_info) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 450, in _handle_exception > six.reraise(*exc_info) > File "/usr/lib/python3/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 421, in __runner > step() > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 418, in <lambda> > step = lambda: next(self.__gen) > File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from > six.reraise(*exc_info) > File "/usr/lib/python3/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from > value = gen.send(prev_value) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 655, in _configure > next(executor) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 431, in __runner > exc_handler(exc_info) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception > self._handle_exception(exc_info) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 518, in _handle_exception > self.__parent._handle_exception(exc_info) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 450, in _handle_exception > six.reraise(*exc_info) > File "/usr/lib/python3/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 515, in _handle_exception > super(ComponentBase, self)._handle_exception(exc_info) > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 450, in _handle_exception > six.reraise(*exc_info) > File "/usr/lib/python3/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 421, in __runner > step() > File "/usr/lib64/python3/site-packages/ipapython/install/core.py", line 418, in <lambda> > step = lambda: next(self.__gen) > File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from > six.reraise(*exc_info) > File "/usr/lib/python3/site-packages/six.py", line 693, in reraise > raise value > File "/usr/lib64/python3/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from > value = gen.send(prev_value) > File "/usr/lib64/python3/site-packages/ipapython/install/common.py", line 65, in _install > for unused in self._installer(self.parent): > File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 3833, in main > install(self) > File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 2520, in install > _install(options) > File "/usr/lib64/python3/site-packages/ipaclient/install/client.py", line 2846, in _install > api.finalize() > File "/usr/lib64/python3/site-packages/ipalib/plugable.py", line 751, in finalize > self.__do_if_not_done('load_plugins') > File "/usr/lib64/python3/site-packages/ipalib/plugable.py", line 438, in __do_if_not_done > getattr(self, name)() > File "/usr/lib64/python3/site-packages/ipalib/plugable.py", line 630, in load_plugins > for package in self.packages: > File "/usr/lib64/python3/site-packages/ipalib/__init__.py", line 949, in packages > ipaclient.remote_plugins.get_package(self), > File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/__init__.py", line 134, in get_package > plugins = schema.get_package(server_info, client) > File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/schema.py", line 553, in get_package > schema = Schema(client) > File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/schema.py", line 402, in __init__ > fingerprint, ttl = self._fetch(client, ignore_cache=read_failed) > File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/schema.py", line 427, in _fetch > schema = client.forward(u'schema', **kwargs)['result'] > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1151, in forward > return self._call_command(command, params) > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1127, in _call_command > return command(*params) > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1281, in _call > return self.__request(name, args) > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 1275, in __request > raise error_class(**kw) > >The ipa-client-install command failed, exception: ACIError: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) >Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) normal enrollment (same spot in the logs): >restart of certmonger.service complete >Adding SSH public key from /etc/openssh/ssh_host_rsa_key.pub >Adding SSH public key from /etc/openssh/ssh_host_dsa_key.pub >Adding SSH public key from /etc/openssh/ssh_host_ecdsa_key.pub >Adding SSH public key from /etc/openssh/ssh_host_ed25519_key.pub >[try 1]: Forwarding 'host_mod' to json server 'https://infra-ipa-master-01.edu-ipa.novalocal/ipa/json' >HTTP connection keep-alive (infra-ipa-master-01.edu-ipa.novalocal) >[3825] 1690356381.860222: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356381.860223: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ using ccache FILE:/etc/ipa/.dns_ccache >[3825] 1690356381.860224: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[3825] 1690356381.860226: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@, seqnum 279994011, subkey aes256-cts/E278, session key aes256-cts/B2AD >[3825] 1690356381.860231: Read AP-REP, time 1690356381.860227, subkey aes256-cts/6032, seqnum 235082758 >received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=5XuhX%2bo07hp5qHnzynQMGsdohzfvuaAYlilcKWmx%2fE2xeBKvvbqvWVEsk2gPHGr7hdQoDcXXirlgzgHDsIKEk7gNOuDHYO8fo%2fuXzYsTQU4osh4GhNtfZu7sZvnWoZz8uKe3ggoF%2b5%2fdZIy7Sao%2b6GnrEKTVzmHBNCPUUyyMBMBOX83eGmJO2WunWXMoJw4NEM%2buSPWwkpUtp4nuniTxuFzEtoyDnBGuJqMB93dTA7hkE7ASNy3o5TjbvXBjIuM3Y1R9ecbfWxI4psuQfnkQKOaCTidU3xRDyY72%2brrH2U5N0yBggeL3CEExSm%2fWQadG;path=/ipa;httponly;secure;']' >storing cookie 'ipa_session=MagBearerToken=5XuhX%2bo07hp5qHnzynQMGsdohzfvuaAYlilcKWmx%2fE2xeBKvvbqvWVEsk2gPHGr7hdQoDcXXirlgzgHDsIKEk7gNOuDHYO8fo%2fuXzYsTQU4osh4GhNtfZu7sZvnWoZz8uKe3ggoF%2b5%2fdZIy7Sao%2b6GnrEKTVzmHBNCPUUyyMBMBOX83eGmJO2WunWXMoJw4NEM%2buSPWwkpUtp4nuniTxuFzEtoyDnBGuJqMB93dTA7hkE7ASNy3o5TjbvXBjIuM3Y1R9ecbfWxI4psuQfnkQKOaCTidU3xRDyY72%2brrH2U5N0yBggeL3CEExSm%2fWQadG;' for principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356381.860235: Storing config in FILE:/etc/ipa/.dns_ccache for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL: X-IPA-Session-Cookie: ipa_session=MagBearerToken=5XuhX%2bo07hp5qHnzynQMGsdohzfvuaAYlilcKWmx%2fE2xeBKvvbqvWVEsk2gPHGr7hdQoDcXXirlgzgHDsIKEk7gNOuDHYO8fo%2fuXzYsTQU4osh4GhNtfZu7sZvnWoZz8uKe3ggoF%2b5%2fdZIy7Sao%2b6GnrEKTVzmHBNCPUUyyMBMBOX83eGmJO2WunWXMoJw4NEM%2buSPWwkpUtp4nuniTxuFzEtoyDnBGuJqMB93dTA7hkE7ASNy3o5TjbvXBjIuM3Y1R9ecbfWxI4psuQfnkQKOaCTidU3xRDyY72%2brrH2U5N0yBggeL3CEExSm%2fWQadG;\x00 >[3825] 1690356381.860236: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krb5_ccache_conf_data/X-IPA-Session-Cookie/host\/test-lb-enroll.edu.novalocal\@EDU-IPA.NOVALOCAL@X-CACHECONF: in FILE:/etc/ipa/.dns_ccache > > >Found zone name: edu.novalocal >The master is: infra-ipa-master-01.edu-ipa.novalocal >start_gssrequest >[3898] 1690356381.745962: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal DNS/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3898] 1690356381.745963: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> DNS/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL using ccache FILE:/etc/ipa/.dns_ccache >[3898] 1690356381.745964: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> DNS/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[3898] 1690356381.745966: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> DNS/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL, seqnum 15181654, subkey aes256-cts/ECC7, session key aes256-cts/607C >send_gssrequest > > >Process finished, return code=1 >stdout= >stderr= >[3825] 1690356380.148934: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148935: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal@ using ccache FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148936: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal@ from FILE:/etc/ipa/.dns_ccache with result: -1765328243/Matching credential not found (filename: /etc/ipa/.dns_ccache) >[3825] 1690356380.148937: Retrying host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL with result: -1765328243/Matching credential not found (filename: /etc/ipa/.dns_ccache) >[3825] 1690356380.148938: Server has referral realm; starting with ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148939: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krbtgt/EDU-IPA.NOVALOCAL(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[3825] 1690356380.148940: Starting with TGT for client realm: host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krbtgt/EDU-IPA.NOVALOCAL(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148941: Requesting tickets for ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL, referrals on >[3825] 1690356380.148942: Generated subkey for TGS request: aes256-cts/3DE8 >[3825] 1690356380.148943: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts >[3825] 1690356380.148945: Encoding request body and padata into FAST request >[3825] 1690356380.148946: Sending request (2377 bytes) to EDU-IPA.NOVALOCAL >[3825] 1690356380.148947: Initiating TCP connection to stream 172.28.19.159:88 >[3825] 1690356380.148948: Sending TCP request to stream 172.28.19.159:88 >[3825] 1690356380.148949: Received answer (2302 bytes) from stream 172.28.19.159:88 >[3825] 1690356380.148950: Terminating TCP connection to stream 172.28.19.159:88 >[3825] 1690356380.148951: Response was from master KDC >[3825] 1690356380.148952: Decoding FAST response >[3825] 1690356380.148953: FAST reply key: aes256-cts/BBE7 >[3825] 1690356380.148954: TGS reply is for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL with session key aes256-cts/207E >[3825] 1690356380.148955: TGS request result: 0/Success >[3825] 1690356380.148956: Received creds for desired service ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148957: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal@ in FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148958: Also storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL based on ticket >[3825] 1690356380.148959: Removing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148961: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> ldap/infra-ipa-master-01.edu-ipa.novalocal@, seqnum 224156792, subkey aes256-cts/6EF9, session key aes256-cts/207E >[3825] 1690356380.148966: Read AP-REP, time 1690356380.148962, subkey aes256-cts/4E53, seqnum 820684970 >Adding CA certificates to the IPA NSS database. > > >failed to find session_cookie in persistent storage for principal 'host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL' >trying https://infra-ipa-master-01.edu-ipa.novalocal/ipa/json >Created connection context.rpcclient_139803356784400 >Try RPC connection >[try 1]: Forwarding 'ping' to json server 'https://infra-ipa-master-01.edu-ipa.novalocal/ipa/json' >New HTTP connection (infra-ipa-master-01.edu-ipa.novalocal) >[3825] 1690356380.148857: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148858: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ using ccache FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148859: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ from FILE:/etc/ipa/.dns_ccache with result: -1765328243/Matching credential not found (filename: /etc/ipa/.dns_ccache) >[3825] 1690356380.148860: Retrying host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL with result: -1765328243/Matching credential not found (filename: /etc/ipa/.dns_ccache) >[3825] 1690356380.148861: Server has referral realm; starting with HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148862: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krbtgt/EDU-IPA.NOVALOCAL(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[3825] 1690356380.148863: Starting with TGT for client realm: host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krbtgt/EDU-IPA.NOVALOCAL(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148864: Requesting tickets for HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL, referrals on >[3825] 1690356380.148865: Generated subkey for TGS request: aes256-cts/46AB >[3825] 1690356380.148866: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts >[3825] 1690356380.148868: Encoding request body and padata into FAST request >[3825] 1690356380.148869: Sending request (2377 bytes) to EDU-IPA.NOVALOCAL >[3825] 1690356380.148870: Initiating TCP connection to stream 172.28.19.159:88 >[3825] 1690356380.148871: Sending TCP request to stream 172.28.19.159:88 >[3825] 1690356380.148872: Received answer (2345 bytes) from stream 172.28.19.159:88 >[3825] 1690356380.148873: Terminating TCP connection to stream 172.28.19.159:88 >[3825] 1690356380.148874: Response was from master KDC >[3825] 1690356380.148875: Decoding FAST response >[3825] 1690356380.148876: FAST reply key: aes256-cts/4ACD >[3825] 1690356380.148877: TGS reply is for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL with session key aes256-cts/B2AD >[3825] 1690356380.148878: TGS request result: 0/Success >[3825] 1690356380.148879: Received creds for desired service HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148880: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ in FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148881: Also storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL based on ticket >[3825] 1690356380.148882: Removing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL from FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148884: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@, seqnum 232117189, subkey aes256-cts/E5F8, session key aes256-cts/B2AD >[3825] 1690356380.148889: Read AP-REP, time 1690356380.148885, subkey aes256-cts/9C66, seqnum 920243718 >received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=nBJ5K%2f0zqcv8v2%2bivGh1TAlnIQEQXaojxHZZL6lPgVtAEv%2f6j%2bEclnVBY6dlnoUVRkyvnAkIVuxLx6HNXZsVsLxhbOZmYkyspRIE59scDW0R%2bBuRiTeBmDKza6GUSTW%2b53ppLozZH8ijT88lpy3%2fnbZKk607ez97vomrVzBCduj0G2y9u6wXyJdnw1TjBtjpr8VThkN46%2fS%2fK8qqf81s6xZiFHretceNwbPgzZFWJVSfUd7LGe%2bR5xGJ2XhNx5%2fVOZGzbhQhigkgullEuxQgV6oordsRg4DsIrOa542JTGTaV%2bvFRAbQ48XXEp1Jj5UV;path=/ipa;httponly;secure;']' >storing cookie 'ipa_session=MagBearerToken=nBJ5K%2f0zqcv8v2%2bivGh1TAlnIQEQXaojxHZZL6lPgVtAEv%2f6j%2bEclnVBY6dlnoUVRkyvnAkIVuxLx6HNXZsVsLxhbOZmYkyspRIE59scDW0R%2bBuRiTeBmDKza6GUSTW%2b53ppLozZH8ijT88lpy3%2fnbZKk607ez97vomrVzBCduj0G2y9u6wXyJdnw1TjBtjpr8VThkN46%2fS%2fK8qqf81s6xZiFHretceNwbPgzZFWJVSfUd7LGe%2bR5xGJ2XhNx5%2fVOZGzbhQhigkgullEuxQgV6oordsRg4DsIrOa542JTGTaV%2bvFRAbQ48XXEp1Jj5UV;' for principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148893: Storing config in FILE:/etc/ipa/.dns_ccache for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL: X-IPA-Session-Cookie: ipa_session=MagBearerToken=nBJ5K%2f0zqcv8v2%2bivGh1TAlnIQEQXaojxHZZL6lPgVtAEv%2f6j%2bEclnVBY6dlnoUVRkyvnAkIVuxLx6HNXZsVsLxhbOZmYkyspRIE59scDW0R%2bBuRiTeBmDKza6GUSTW%2b53ppLozZH8ijT88lpy3%2fnbZKk607ez97vomrVzBCduj0G2y9u6wXyJdnw1TjBtjpr8VThkN46%2fS%2fK8qqf81s6xZiFHretceNwbPgzZFWJVSfUd7LGe%2bR5xGJ2XhNx5%2fVOZGzbhQhigkgullEuxQgV6oordsRg4DsIrOa542JTGTaV%2bvFRAbQ48XXEp1Jj5UV;\x00 >[3825] 1690356380.148894: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krb5_ccache_conf_data/X-IPA-Session-Cookie/host\/test-lb-enroll.edu.novalocal\@EDU-IPA.NOVALOCAL@X-CACHECONF: in FILE:/etc/ipa/.dns_ccache >[try 1]: Forwarding 'ca_is_enabled' to json server 'https://infra-ipa-master-01.edu-ipa.novalocal/ipa/json' >HTTP connection keep-alive (infra-ipa-master-01.edu-ipa.novalocal) >[3825] 1690356380.148898: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148899: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ using ccache FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148900: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[3825] 1690356380.148902: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@, seqnum 678605449, subkey aes256-cts/747F, session key aes256-cts/B2AD >[3825] 1690356380.148907: Read AP-REP, time 1690356380.148903, subkey aes256-cts/C2C1, seqnum 37258182 >received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=mVqhYtLqfVgBwvixoFSlHLw2nOQULW20e%2f4LOsro2xvfKooihP%2bgVAkKlaRvnN2XMVs66AyoibsKmvEgzMKK07HwnPLuzetxHpHYHtK8NkDD7%2f%2bJB0W00ME%2bj153OQTv8qRRvzyWHUBEb56AucOvopC%2bHIBUNLUpN342m4Jjl754AR2c4gTcoy7vR3fkO9vop4CMSPIq5OsnOsEfUYz6DkkcOMb06axmoRZY%2f1JbF3ohIVOXC1Uvtjy5uVk7uQiszSegQDdwOrRBZlkeeShvAma6vyc%2b7MCDnpPAN0KuZ4Y1M6LeVo5JH3J6UwrZz0M%2f;path=/ipa;httponly;secure;']' >storing cookie 'ipa_session=MagBearerToken=mVqhYtLqfVgBwvixoFSlHLw2nOQULW20e%2f4LOsro2xvfKooihP%2bgVAkKlaRvnN2XMVs66AyoibsKmvEgzMKK07HwnPLuzetxHpHYHtK8NkDD7%2f%2bJB0W00ME%2bj153OQTv8qRRvzyWHUBEb56AucOvopC%2bHIBUNLUpN342m4Jjl754AR2c4gTcoy7vR3fkO9vop4CMSPIq5OsnOsEfUYz6DkkcOMb06axmoRZY%2f1JbF3ohIVOXC1Uvtjy5uVk7uQiszSegQDdwOrRBZlkeeShvAma6vyc%2b7MCDnpPAN0KuZ4Y1M6LeVo5JH3J6UwrZz0M%2f;' for principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148911: Storing config in FILE:/etc/ipa/.dns_ccache for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL: X-IPA-Session-Cookie: ipa_session=MagBearerToken=mVqhYtLqfVgBwvixoFSlHLw2nOQULW20e%2f4LOsro2xvfKooihP%2bgVAkKlaRvnN2XMVs66AyoibsKmvEgzMKK07HwnPLuzetxHpHYHtK8NkDD7%2f%2bJB0W00ME%2bj153OQTv8qRRvzyWHUBEb56AucOvopC%2bHIBUNLUpN342m4Jjl754AR2c4gTcoy7vR3fkO9vop4CMSPIq5OsnOsEfUYz6DkkcOMb06axmoRZY%2f1JbF3ohIVOXC1Uvtjy5uVk7uQiszSegQDdwOrRBZlkeeShvAma6vyc%2b7MCDnpPAN0KuZ4Y1M6LeVo5JH3J6UwrZz0M%2f;\x00 >[3825] 1690356380.148912: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krb5_ccache_conf_data/X-IPA-Session-Cookie/host\/test-lb-enroll.edu.novalocal\@EDU-IPA.NOVALOCAL@X-CACHECONF: in FILE:/etc/ipa/.dns_ccache >[try 1]: Forwarding 'config_show' to json server 'https://infra-ipa-master-01.edu-ipa.novalocal/ipa/json' >HTTP connection keep-alive (infra-ipa-master-01.edu-ipa.novalocal) >[3825] 1690356380.148916: ccselect module realm chose cache FILE:/etc/ipa/.dns_ccache with client principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL for server principal HTTP/infra-ipa-master-01.edu-ipa.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148917: Getting credentials host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ using ccache FILE:/etc/ipa/.dns_ccache >[3825] 1690356380.148918: Retrieving host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@ from FILE:/etc/ipa/.dns_ccache with result: 0/Success >[3825] 1690356380.148920: Creating authenticator for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> HTTP/infra-ipa-master-01.edu-ipa.novalocal@, seqnum 896576105, subkey aes256-cts/02A5, session key aes256-cts/B2AD >[3825] 1690356380.148925: Read AP-REP, time 1690356380.148921, subkey aes256-cts/D3B7, seqnum 175125735 >received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=%2fh0A2rAP%2b9B%2fKydCZfB9jTvCngqGmE4PpTSutwiDNm7LVxbA7pFr6WhMuHRuEnSo%2bzl8KEoelocipvUzAlZV2pvwelwygtqV0moRYWM6YlfEVX82J5o8DatYvaw24CksBRIH1DYZJJZPNrkC2MUj7XQdyPSr7RY8zF%2fw53iAdx3LFd2yyB2juwkxAp47eNVdLX%2fI4pFgBSFukOQKE0DSmv89qT7NSWvBGzb4PfO9mxMpGIkOqhawSYV%2ftLwpxg4dMOx64sCXnjdbVaghABYKzYzQkQ9UeJZOuvl3EH5xz6PomnG5crEQVjIi1UxbyDfX;path=/ipa;httponly;secure;']' >storing cookie 'ipa_session=MagBearerToken=%2fh0A2rAP%2b9B%2fKydCZfB9jTvCngqGmE4PpTSutwiDNm7LVxbA7pFr6WhMuHRuEnSo%2bzl8KEoelocipvUzAlZV2pvwelwygtqV0moRYWM6YlfEVX82J5o8DatYvaw24CksBRIH1DYZJJZPNrkC2MUj7XQdyPSr7RY8zF%2fw53iAdx3LFd2yyB2juwkxAp47eNVdLX%2fI4pFgBSFukOQKE0DSmv89qT7NSWvBGzb4PfO9mxMpGIkOqhawSYV%2ftLwpxg4dMOx64sCXnjdbVaghABYKzYzQkQ9UeJZOuvl3EH5xz6PomnG5crEQVjIi1UxbyDfX;' for principal host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL >[3825] 1690356380.148929: Storing config in FILE:/etc/ipa/.dns_ccache for host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL: X-IPA-Session-Cookie: ipa_session=MagBearerToken=%2fh0A2rAP%2b9B%2fKydCZfB9jTvCngqGmE4PpTSutwiDNm7LVxbA7pFr6WhMuHRuEnSo%2bzl8KEoelocipvUzAlZV2pvwelwygtqV0moRYWM6YlfEVX82J5o8DatYvaw24CksBRIH1DYZJJZPNrkC2MUj7XQdyPSr7RY8zF%2fw53iAdx3LFd2yyB2juwkxAp47eNVdLX%2fI4pFgBSFukOQKE0DSmv89qT7NSWvBGzb4PfO9mxMpGIkOqhawSYV%2ftLwpxg4dMOx64sCXnjdbVaghABYKzYzQkQ9UeJZOuvl3EH5xz6PomnG5crEQVjIi1UxbyDfX;\x00 >[3825] 1690356380.148930: Storing host/test-lb-enroll.edu.novalocal(a)EDU-IPA.NOVALOCAL -> krb5_ccache_conf_data/X-IPA-Session-Cookie/host\/test-lb-enroll.edu.novalocal\@EDU-IPA.NOVALOCAL@X-CACHECONF: in FILE:/etc/ipa/.dns_ccache >Starting external process >args=['/usr/bin/certutil', '-d', '/etc/ipa/nssdb', '-N', '-f', '/etc/ipa/nssdb/pwdfile.txt', '-@', '/etc/ipa/nssdb/pwdfile.txt'] Seems like for some reason install script is unable to save credentials to /etc/ipa/.dns_ccache in the first case. Any ideas why it can be happenning? Despite obvious permissions issues, cause I specifically ran normal installation in the same environment, to eliminate any host setup problems. Client version is: freeipa-client-4.8.9-alt4.c9f2.3.x86_64

2 4

local root can login but freeipa users can't
by barry y 29 Jul '23

29 Jul '23

This happen randomly, local root can login through SSH to the affected system but for freeipa user, login was successful but there's no prompt. When successfully logged in, it only display a message saying "Last login: xxx" and then no prompt. There's no sssd errors though, restarting the service doesn't help either. While the issue happen to one system, other systems freeipa users can login no problem. Only way to get out of this is to restart the entire system.

3 8

Using IPA's 389-ds for other directory information trees?
by Mathieu Baudier 27 Jul '23

27 Jul '23

Hello, we are using IPA as the backbone of a middle-sized infrastructure whose purpose is to host multi-tenants (Java) applications. These applications use 389-ds instances to manage the authentication and authorisation. The 389-ds instances are deployed on hosts which are IPA clients but are not IPA servers. Since we monitor closely the IPA servers and their 389-ds instances, I was wondering whether it could be efficient to also host the applicative 389-ds LDAP trees on the same hosts as the IPA servers. These instances are small (hundreds of applicative users maximum) and use only the standard LDAP schemas, consistently with IPA (which was taken as the reference when developing the user-management model of these applications). I can see three approaches: 1) Separate 389-ds instances on distinct ports. In that case, only the software is shared. 2) Separate 389-ds backends in the IPA instances, with their own replication agreements. 3) Separate LDAP subtrees within the IPA backends. In that case, IPA replication agreements are leveraged. Intuitively, I would favour 2), then 1), then 3). Did I miss something in this analysis? Is it reasonable/advisable to reuse the IPA servers for such purposes? Does anyone have experience with such a setup? Thanks in advance for any comment! Mathieu

2 1

Re: Exporting certificates with keys associated in FreeIPA
by Jernej Jakob 27 Jul '23

27 Jul '23

On Wed, 26 Jul 2023 11:10:23 +0000 Carlos Lopez via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: > Hi all, > > Sorry to disturb but I can not find which is the correct procedure to accomplish this. I have created a certificate in WebUI and I can export certificate in pem format, which it is what I need. But I need the private key also. This certificate is for a host outside of Kerberos and LDAP's FreeIPA domain. > > How can I export pem cert and key file? > > Regards, > C. L. Martinez > While I don't know the answer to your question, I can say that the private key should not leave the server (machine, service, user,...) which uses it. The standard procedure for PKI is to generate a private key on the machine, generate a CSR, send the CSR to the CA to get signed (which issues the certificate), then install the certificate back on the machine. If the machine is enrolled into FreeIPA you can do this with certmonger. If not, you can probably still get FreeIPA to sign your CSR.

4 3

TXT - SPF & DKIM
by lejeczek 26 Jul '23

26 Jul '23

Hi guys. Would you know a correct or best-practice way to add such records. When I look at how those resolve for some(a few a tried) well-know domains - in order to get the same/similar with IPA it seems, that I have to escape some chars, name white-spaces. Is that normal/expected - it did not feel as such to me. many thanks, L.

3 7

cert management - ? - pkcs format
by lejeczek 26 Jul '23

26 Jul '23

Hi guys. Is it possible IPA output format (when rendered into files) is _pkcs_, for both keys & certs? Being not a security/cryptography expert thus unable to put it into better words - format/container which works with/in Java? Like when: -> $ openssl pkcs8 ... -topk8 -nocrypt -v1 PBE-SHA1-3DES .. many thanks, L.

2 3

Exporting certificates with keys associated in FreeIPA
by Carlos Lopez 26 Jul '23

26 Jul '23

Hi all, Sorry to disturb but I can not find which is the correct procedure to accomplish this. I have created a certificate in WebUI and I can export certificate in pem format, which it is what I need. But I need the private key also. This certificate is for a host outside of Kerberos and LDAP's FreeIPA domain. How can I export pem cert and key file? Regards, C. L. Martinez

1 0

Krb5kdc and kadmin services not getting started
by Polavarapu Manideep Sai 25 Jul '23

25 Jul '23

Hi Team, Krb5kdc and kadmin services not getting started PFB error logs As you can see we are getting "Kerberos User Principal not found. Do you have a valid Credential Cache?" upon getting new keytab [root@dir ~]# tail -f /var/log/krb5kdc.log krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM ------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# tail -f /var/log/kadmind.log Jul 24 19:49:57 dir.IPA.DOMAIN.COM kadmind[211105](Error): Server error while initializing, aborting Jul 24 19:56:29 dir.IPA.DOMAIN.COM kadmind[2807](Error): Server error while initializing, aborting Jul 24 20:50:50 dir.IPA.DOMAIN.COM kadmind[5803](Error): Server error while initializing, aborting Jul 24 20:55:02 dir.IPA.DOMAIN.COM kadmind[6560](Error): Server error while initializing, aborting Jul 24 21:39:45 dir.IPA.DOMAIN.COM kadmind[9520](Error): Server error while initializing, aborting ---------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# klist -kt Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 05/14/2019 13:23:12 host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM 1 05/14/2019 13:23:12 host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM ---------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# mv /etc/krb5.keytab /etc/krb5.keytab-bak [root@dir ~]# ------------------------------------------------------------------------------------------------------------ [root@dir ~]# ipa-getkeytab -s central01.ipa.domain.com -p host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM -k /etc/krb5.keytab Kerberos User Principal not found. Do you have a valid Credential Cache? [root@dir ~]# [root@dir ~]# Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 1

Cannot get rid of a replica/agreement
by lejeczek 22 Jul '23

22 Jul '23

Hi guys. Two masters from which third got disconnected in a "dirty" manner. -> $ ipa-replica-manage del midway.ccn.priv.dom Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server love.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom Topology does not allow server midway.ccn.priv.dom to replicate with servers: love.ccn.priv.dom punch.ccn.priv.dom Topology does not allow server punch.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom. -> $ ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom Left node: punch.ccn.priv.dom Right node: love.ccn.priv.dom Connectivity: both ---------------------------- Number of entries returned 1 -> $ ipa-replica-manage del midway.ccn.priv.dom --force ipa: WARNING: /usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes) Updating DNS system records Not allowed on non-leaf entry I've tried to 'reinitialize' but without success. Anybody care to share suggestions & thoughts? many thanks, L.

4 6

Do you want to search for missing reverse zones?
by Ian Pilcher 21 Jul '23

21 Jul '23

I am attempting to automate a FreeIPA installation (for troubleshooting purposes), and I cannot figure out how to get rid of this question. I have tried adding '--no-reverse' to the ipa-server-install command, but I am still getting the prompt. What option do I need to use? Thanks! -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

2 2

ipa-ca-install fails on a install
by Rudi Gabler 19 Jul '23

19 Jul '23

Hi, I've a bunch of 5 servers for my domain. One has CA on it and on any other the attempt to bring it up as secondary,.. CA replica fails with: ipa-ca-install ... caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u Installation failed: <html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 500 - javax.ws.rs.ProcessingException: Unable to invoke request</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>javax.ws.rs.ProcessingException: Unable to invoke request</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.jboss.resteasy. spi.UnhandledException: javax.ws.rs.ProcessingException: Unable to invoke request org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149) org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372) org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) javax.servlet.http.HttpServlet.service(HttpServlet.java:731) sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) together with a (journalctl) Jul 17 10:24:14 kre.example.com server[21753]: CMS Warning: FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Property internaldb.ldapconn.port missing value| Jul 17 10:24:14 kre.example.com server[21753]: CA is started. Jul 17 10:24:17 server[21753]: getSystemCertProfileID tag: subsystem defaultName: caInternalAuthSubsystemCert keyType: null Jul 17 10:24:17 kre.example.com server[21753]: FATAL: SSL alert received: HANDSHAKE_FAILURE The pki-tomcat is the last thing started, but throws an exeption I can provide the ipareplication-install.log. For all servers the failure is exactly the same (without the running master of course). Software: centos 7 with pa-common-4.6.8-5.el7.centos.14.noarch ipa-server-trust-ad-4.6.8-5.el7.centos.14.x86_64 ipa-client-common-4.6.8-5.el7.centos.14.noarch ipa-client-4.6.8-5.el7.centos.14.x86_64 ipa-server-dns-4.6.8-5.el7.centos.14.noarch ipa-server-common-4.6.8-5.el7.centos.14.noarch ipa-server-4.6.8-5.el7.centos.14.x86_64 Maybe someone has a tip for me? Regards, Rudi G.

2 4

Clarification on automember rules
by dweller dweller 18 Jul '23

18 Jul '23

In our environment, we have deployed Dex as an Identity Provider (IdP) for authentication in various Kubernetes (k8s) clusters. However, we encountered an issue with configuring Dex to account for nested groups. As a workaround, we implemented a solution that assigns groups with automembership. Allow me to explain: Each k8s cluster has Role-Based Access Control (RBAC) configured, which is associated with four groups retrieved from LDAP via Dex. Consequently, we have the following naming convention: k8s-cluster-01-l0 k8s-cluster-01-l1 k8s-cluster-01-l2 k8s-cluster-01-l3 Additionally, we have user groups such as: team-l0 team-l1 team-l2 team-l3 We add users to the appropriate team group based on their entitlements, and subsequently, we associate the team-l* groups with their respective k8s-cluster-01-l* group. This arrangement grants the members of the team-* group specific access rights to the corresponding k8s cluster. However, initially, Dex was only able to recognize the groups that a user was directly a member of. To address this limitation, we implemented automember rules. For example, we created four rules as follows: k8s-cluster-01-l0 if memberof team-l0 k8s-cluster-01-l1 if memberof team-l1 k8s-cluster-01-l2 if memberof team-l2 k8s-cluster-01-l3 if memberof team-l3 As the number of clusters increased, we ended up with around 52 automember rules following the same pattern for k8s. Now, whenever I need to add a user or modify automember rules and trigger an automember rebuild, even for a small set of users (5-10), FreeIPA experiences a prolonged hang. Eventually, it times out the automember rebuild task, and this lagging behavior extends to all replicas. In light of this situation, I would like to clarify the following: Is my understanding correct that for each user in this setup, I create 52 automember rebuild tasks? Is it expected for the system to function this way, or am I using the automember plugin incorrectly? Could it be that the plugin is not intended for such high membership usage? I would appreciate any insights you can provide to help resolve these concerns. P.S.: I found a way to make a Dex to see nested groups membership, but for now I'm stuck with this workaround, cause it much harder to conform changes now.

2 3

bad list of CAs on FreeIPA client?
by Harald Dunkel 18 Jul '23

18 Jul '23

Hi folks, getcert list-cas returns on some FreeIPA clients root@nasl006a:~# getcert list-cas CA 'SelfSign': is-default: no ca-type: INTERNAL:SELF next-serial-number: 01 CA 'IPA': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/ipa-submit CA 'certmaster': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/certmaster-submit CA 'dogtag-ipa-renew-agent': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/dogtag-ipa-renew-agent-submit CA 'local': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/local-submit certmaster-submit doesn't exist, but there are others not included in this list: # find /usr/lib/certmonger -name \*-submit /usr/lib/certmonger/dogtag-ipa-renew-agent-submit /usr/lib/certmonger/scep-submit /usr/lib/certmonger/local-submit /usr/lib/certmonger/ipa-submit /usr/lib/certmonger/dogtag-submit Is this something to be worried about? FreeIPA is version 4.9.8-1~bpo11+1 from the Debian backports repository. Regards Harri

2 1

Failure during ipa-server-install on ipa-client-install part in the container
by dweller dweller 17 Jul '23

17 Jul '23

Introduction: We are currently using the Altlinux system, and the freeipa package is maintained in the repository provided at https://packages.altlinux.org/en/p10/srpms/freeipa/. To meet our specific requirements, I decided to create a container package based on the Altlinux p10 distribution. However, I have now encountered a problem while trying to install ipa-client inside the container. It seems that I am not receiving a session cookie for some reason. Although the logs indicate that the Ticket Granting Ticket (TGT) is successfully issued and stored at /etc/ipa/.dns_ccache (TGT for the host principal), there is a warning stating that the ipa_session cookie cannot be found. As a result, the request to /ipa/json fails with a 401 error. Despite the fact that this distribution is not based on RHEL and therefore not officially supported, I would appreciate any guidance. Precisely what should happen in normal sutiation without error. Any hints on where to investigate in the source code would also be helpful. ipaclient-install logs: https://pastebin.com/8NbieLK3 the error part is: >2023-07-12T03:50:08Z DEBUG Initializing principal host/ipamaster.ipa-test.novalocal(a)IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL using keytab /data/etc/krb5.keytab >2023-07-12T03:50:08Z DEBUG using ccache /etc/ipa/.dns_ccache >2023-07-12T03:50:08Z DEBUG Attempt 1/5: success >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/bin/certutil', '-d', '/tmp/tmpgi6acve3', '-N', '-f', '/tmp/tmpgi6acve3/pwdfile.txt', '-@', '/tmp/tmpgi6acve3/pwdfile.txt'] >2023-07-12T03:50:08Z DEBUG Process finished, return code=0 >2023-07-12T03:50:08Z DEBUG stdout= >2023-07-12T03:50:08Z DEBUG stderr= >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/bin/certutil', '-d', 'sql:/tmp/tmpgi6acve3', '-A', '-n', 'CA certificate 1', '-t', 'C,,', '-a', '-f', '/tmp/tmpgi6acve3/pwdfile.txt'] >2023-07-12T03:50:08Z DEBUG Process finished, return code=0 >2023-07-12T03:50:08Z DEBUG stdout= >2023-07-12T03:50:08Z DEBUG stderr= >2023-07-12T03:50:08Z DEBUG failed to find session_cookie in persistent storage for principal 'host/ipamaster.ipa-test.novalocal(a)IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL' >2023-07-12T03:50:08Z DEBUG trying https://ipamaster.ipa-test.novalocal/ipa/json >2023-07-12T03:50:08Z DEBUG Created connection context.rpcclient_139827748309840 >2023-07-12T03:50:08Z DEBUG [try 1]: Forwarding 'schema' to json server 'https://ipamaster.ipa-test.novalocal/ipa/json' >2023-07-12T03:50:08Z DEBUG ENTERING SINGLE_REQUEST >2023-07-12T03:50:08Z DEBUG HOST:i (ipamaster.ipa-test.novalocal) >2023-07-12T03:50:08Z DEBUG HANDLER: (/ipa/json) >2023-07-12T03:50:08Z DEBUG REQUEST_BODY: (b'{"method": "schema", "params": [[], {"version": "2.170"}], "id": 0}') >2023-07-12T03:50:08Z DEBUG New HTTP connection (ipamaster.ipa-test.novalocal) >2023-07-12T03:50:08Z DEBUG HTTP connection destroyed (ipamaster.ipa-test.novalocal) >Traceback (most recent call last): > File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package > plugins = api._remote_plugins >AttributeError: 'API' object has no attribute '_remote_plugins' > >During handling of the above exception, another exception occurred: > >Traceback (most recent call last): > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 727, in single_request > if not self._auth_complete(response): > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 673, in _auth_complete > raise errors.KerberosError( >ipalib.errors.KerberosError: No valid Negotiate header in server response >2023-07-12T03:50:08Z DEBUG Destroyed connection context.rpcclient_139827748309840 >2023-07-12T03:50:08Z DEBUG File "/usr/lib64/python3/site-packages/ipapython/admintool.py", line 180, in execute

4 6

FreeIPA on Fedora and dnf system-upgrade
by Ian Pilcher 16 Jul '23

16 Jul '23

I am currently running FreeIPA on CentOS 7, and I am considering moving it to Fedora. On RHEL and derivatives, in-place upgrades are not supported. It is necessary to provision a new server, running the new OS version, add it as a FreeIPA replica, and then decommission the old system. How does this work on Fedora? Will I be able to use dnf system-upgrade, or will I find myself having to use the process described above? -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

3 2

Running another app alongside IPA (gssproxy)
by Aurelien Bompard 16 Jul '23

16 Jul '23

Hey folks! I'm trying to run IPA and another wsgi piece of code (FASJSON) on the same VM, and I think I'm having trouble with the gssproxy config. I have set fasjson to a separate gssproxy socket (gssproxy conf & app env var), I have enabled logging in gssproxy, and it rejects authentication with: Stored ccache failed to decrypt; treating as empty. I don't think I've configured things much differently than how IPA is configured. FASJSON works fine with gssproxy when it's on its own VM, by the way. There is a ccache file created by mod_auth_gssapi in /run/fasjson/ccaches, and klist says it's encrypted by gssproxy In gssproxy config, fasjson has its own keytab set as cred_store, has allow_constrained_delegation set to true, and its own socket, but besides that it looks similar to the ipa-httpd service. I didn't set any ccache: entry as a cred_store because IPA doesn't have it, and there is no substitution I can use to point to the file that mod_auth_gssapi has created, because it's named after the principal (/run/fasjson/ccaches/admin(a)DOMAIN.TLD) and gssproxy only has substitutes for username and user id. Also, when I tried to hardcode it, selinux prevented access, so I thought that's not how it's supposed to work. (as you may be able to tell, I've been at this for quite a while now ;-) ) Any idea what I'm doing wrong? I can provide config files and logs as needed. Thanks! Aurélien

2 2

For automember rules is there any documentation about the regex library that is in use?
by Chris Cowan 14 Jul '23

14 Jul '23

I created some rules, and they worked as expected, but there's no guidance that I can find of which metacharacters are supported. Perhaps if I knew they were using the perl regex library, or whatever that might help. Also, it seems like the inclusive rules are OR'ed together, but that is not discussed either. I may not be looking in the right places for documentation. So, far I have found that this worked as expected. departmentnumber = ^(ABC|DEF|GHI) And I was able to accomplish the same thing with 3 distinct rules. Just wondering what flexibility, I have here.

2 1

ipa-replica-manage dnanextrange-del ?
by Harald Dunkel 13 Jul '23

13 Jul '23

Hi folks, being tired I have set a dnanextrange on 2 servers, instead of a dnarange. Very painful. Now our favorite ID range is blocked. Is there some kind of ipa-replica-manage dnanextrange-del to drop a dnanextrange and to return it to the available pool of IDs? Every helpful comment is highly appreciated. Harri

2 1

AccountPolicy erroring for some users
by LUCAS GUILHERME DIEDRICH 13 Jul '23

13 Jul '23

Hey, Since i updated to the lastest Freeipa version (IPA, version: 4.10.1), i started noticing some error in the 389 error.log. [11/Jul/2023:13:50:20.591388308 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:51:52.993254666 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed. [11/Jul/2023:13:51:52.995079255 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710114037Z) failed. [11/Jul/2023:13:51:53.014918310 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:52:12.898523693 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed. [11/Jul/2023:13:52:12.901073197 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165203Z) failed. [11/Jul/2023:13:52:12.914936792 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=abc,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:52:21.897598474 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed. [11/Jul/2023:13:52:21.899560503 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230711165144Z) failed. [11/Jul/2023:13:52:21.913459796 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'uid=xyz,cn=users,cn=accounts,dc=unila,dc=intranet' [11/Jul/2023:13:52:42.939623733 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed. [11/Jul/2023:13:52:42.942050331 -0300] - ERR - attrlist_replace - attr_replace (lastLoginHistory, 20230710221057Z) failed. [11/Jul/2023:13:52:42.955004117 -0300] - ERR - acct_update_login_history - Modify error 20 on entry 'fqdn=hostname.unila.intranet,cn=computers,cn=accounts,dc=unila,dc=intranet' I'm not sure why this is happening and how can i fix this, unfortunetly i'm using the account_plugin to update the last auth date via LDAP, but the field lastLoginHistory seems to be something added in the lastest releases. I have 3 replicas, but the account_plugin is enabled only in the machines which is currently erroring. Any ideas how to fix this? Thanks.

4 4

ipa-csreplica-manage -v list: duplicate replica ID detected
by Harald Dunkel 11 Jul '23

11 Jul '23

Hi folks, I have almost completed the FreeIPA migration from CentOS7 to Rocky8 (FreeIPA 4.9.11). Domain replications seems to be fine, but I get a replication error for ca: [root@ipa2 ~]# ipa-csreplica-manage -v list ipaca8.example.com Directory Manager password: ipa2.example.com last init status: Error (0) Total update succeeded last init ended: 2023-07-08 14:35:09+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:37+00:00 ipabak.ac.example.com last init status: Error (0) Total update succeeded last init ended: 2023-07-08 16:06:05+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:37+00:00 ipa0.example.com last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:37+00:00 [root@ipa2 ~]# ipa-csreplica-manage -v list ipa2.example.com Directory Manager password: ipaca8.example.com last update status: Error (11) Replication error acquiring replica: Unable to acquire replica: the replica has the same Replica ID as this one. Replication is aborting. (duplicate replica ID detected) last update ended: 2023-07-08 15:03:47+00:00 ipa1.example.com last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2023-07-08 16:20:40+00:00 Obviously replication between ipaca8 (the CA) amd ipa2 is bad. Here is the topology for ca: [root@ipa2 ~]# ipa topologysegment-find ca | sed s/aixigo.de/example.com/g ------------------ 5 segments matched ------------------ Segment name: ipa0.example.com-to-ipa1.example.com Left node: ipa0.example.com Right node: ipa1.example.com Connectivity: both Segment name: ipa0.example.com-to-ipaca8.example.com Left node: ipa0.example.com Right node: ipaca8.example.com Connectivity: both Segment name: ipa1.example.com-to-ipa2.example.com Left node: ipa1.example.com Right node: ipa2.example.com Connectivity: both Segment name: ipa2.example.com-to-ipaca8.example.com Left node: ipa2.example.com Right node: ipaca8.example.com Connectivity: both Segment name: ipabak.ac.example.com-to-ipaca8.example.com Left node: ipabak.ac.example.com Right node: ipaca8.example.com Connectivity: both ---------------------------- Number of entries returned 5 ---------------------------- Every helpful hint is highly appreciated Harri

2 3

Limiting access to GUI
by Entrepreneur AJ 11 Jul '23

11 Jul '23

Hey all, I have a wan facing install due to many of my team operating with mobile phone hotspots whilst visiting customers. An Issue I'm having is I want to restrict the GUI to only our admin team's IP address but editing the Apache Config with; # webUI is now completely static, and served out of that directory Alias /ipa/ui "/usr/share/ipa/ui" <Directory "/usr/share/ipa/ui"> SetHandler None AllowOverride None Satisfy Any Require all granted ExpiresActive On ExpiresDefault "access plus 1 year" <FilesMatch "(index.html|loader.js|login.html|reset_password.html)"> ExpiresDefault "access plus 0 seconds" </FilesMatch> Order allow,deny Allow from <ADMIN IP RANGE> </Directory> Is still allowing anyone with a browser to reach the IPA gui. We have Keycloak in place for staff and users to update their passwords. Any pointers? I would personally prefer to firewall it off but that effects other IPA features.

2 5

Help-Installing Third-Party Certificates for HTTP or LDAP
by Polavarapu Manideep Sai 10 Jul '23

10 Jul '23

Hi Team, I have generated central.csr and central.key in my ipa server and shared this central.csr to third-party certificate authority and i got certificates from certificate authority with two directories one as apache directory and it's certificates are 1f1f7ab616938168.crt, 1f1f7ab616938168.pem and gd_bundle-g2-g1.crt and another directory with tomcat name and its certficates are 1f1f7ab616938168.crt, 1f1f7ab616938168.pem, gd_bundle-g2-g1.crt and gdig2.crt.pem, now i want to install these certficates in my ipa server can you please guide on the same ? I tried this, but getting the below error, can you please share the steps to install this SSL certficates [root@ Apache]# ipa --version VERSION: 4.5.0, API_VERSION: 2.228 ipa-server-certinstall --http --dirsrv ssl.key ssl.crt [root@Apache]# ipa-server-certinstall --http --dirsrv central.key gd_bundle-g2-g1.crt Directory Manager password: Enter private key unlock password: No matching certificate found for private key from central.key Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

3 10

Propose "SSLOCSPEnable on no_ocsp_for_cert_ok" alternative to "off" when enabling smartcard (client cert) auth
by Jernej Jakob 10 Jul '23

10 Jul '23

The "ipa-advise config-client-for-smart-card-auth" script enables OCSP checks in httpd, the RHEL docs say to disable it if the client certificates don't have an OCSP responder URL (third-party CA). [1] Apache httpd has an undocumented flag "no_ocsp_for_cert_ok" which will pass certificates without OCSP URLs as valid but still perform OCSP server checks for certificates that do have an OCSP URL. [2][3] [1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… [2] https://bz.apache.org/bugzilla/show_bug.cgi?id=62112 [3] https://svn.apache.org/viewvc/httpd/httpd/tags/2.4.57/modules/ssl/ssl_engin…

2 1

pki-tomcatd service stopped
by Polavarapu Manideep Sai 08 Jul '23

08 Jul '23

Hi Team, As we checked pki-tomcatd service was stopped, couldn't possible to set the clock back as other certificates will not valid PFB details, please let us know if more details required on this As you can see Unable to communicate with CMS (404) when performed ipa cert-show for the serial no , ipa version is VERSION: 4.5.0 Please guide us to proceed further [root@sai ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |grep -i after Not After : Mon Jan 10 06:35:46 2022 [root@sai ~]# [root@sai ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |grep -i before Not Before: Tue Jan 21 06:35:46 2020 [root@sai ~]# [root@sai ~]# [root@sai ~]# certutil -L -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" |grep -i serial Serial Number: 80 (0x50) [root@sai ~]# [root@sai ~]# [root@sai ~]# ipa cert-show 80 ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (404) [root@sai ~]# [root@sai ~]# [root@sai ~]# # Not possible to reset clock back , because other certificates were not valid [root@sai ~]# [root@sai ~]# [root@sai ~]# [root@sai ~]# ipa --version VERSION: 4.5.0, API_VERSION: 2.228 [root@sai ~]# [root@sai ~]# Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

3 5

migrating CA renewal server to RHEL 8 (using an external root CA)
by Harald Dunkel 06 Jul '23

06 Jul '23

Hi folks, https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… describes how to move the CA renewal server from RHEL 7 to a new host with RHEL 8, apparently for using a self-signed root CA. Is this the same procedure for using an external root CA? Do I have to create a CSR for the new host first, to be signed by the external CA, and then import it? Sorry for asking, but I have the impression this detail is missing in RedHat's documentation. Every insightful comment is highly appreciated. Harri

2 1

PKINIT questions
by alexey safonov 06 Jul '23

06 Jul '23

Hi, I've a FreeIPA setup 4.10.1 (that's a long-living setup that was upgraded many times). It is CA-less setup (Inititally we had CA, but than it was removed). So now 4 of my servers are saying that PKINIT is enabled and one server is saying "disabled". I tried to re-install replica, but it says CA-less mode can't issue a certificate, so I tried with kdc-cert-file, but than it says cert is not valid (where it's definitly works for web and ldap). Anything I can do here and enable pkinit on that replica? Alex

3 5

Where is root CA private key stored?
by Ian Pilcher 05 Jul '23

05 Jul '23

(Hopefully Thunderbird will only send one copy of this. Sorry about the previous duplicate.) I run a single FreeIPA server (on CentOS 7) in my home network, and I'm thinking of migrating it to Fedora. AFAICT, doing this as an actual upgrade will require multiple cycles of creating a newer FreeIPA server, adding it as a replica, removing the older server, lather, rinse, repeat. I'm only using FreeIPA for its DNS, certificate authority, and LDAP authentication capabilities, and my home network isn't that large, so I'm considering simply installing a new server and re-creating the various users, hosts, services, and DNS zones/entries. (I don't have any systems that are truly managed with FreeIPA.) Thus, it would be nice if the new FreeIPA server could use the same root CA certificate as the existing one. I believe that I can do this by passing the --external-cert-file option to ipa-server-install, but I need both the certificate and the private key of the root CA to do so. Thus, I'm wondering how I can extract the root CA private key from my existing CentOS 7 (FreeIPA 4.6.8) server. Thanks! -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

2 4

Active Directory domain range with bad ID range
by Harald Dunkel 04 Jul '23

04 Jul '23

Hi folks, I have found an Active Directory domain range in my FreeIPA setup using -1 as the first Posix ID: Range name: EXAMPLE.COM_subid_range First Posix ID of the range: 2147483648 Number of IDs in the range: 2147352576 First RID of the corresponding RID range: 2147283648 Domain SID of the trusted domain: S-1-5-21-738065-838566-194929194 Range type: Active Directory domain range The GUI shows a warning about this, see https://pagure.io/freeipa/issue/9408. Is it save to kick out this ID range? AFAICS there are no users or groups defined using an ID out of this range. And there is not trust relationship to an AD server. Every insightful comment is highly appreciated Harri

2 1

struggling with RID base on migration from CentOS 7 to 8
by Harald Dunkel 03 Jul '23

03 Jul '23

Hi folks, still trying to migrate from Centos7 to 8 I get an error message from ipa-replica-install on the first CentOS 8 host saying : Finalize replication settings Restarting the KDC Configuring SID generation [1/7]: creating samba domain object Samba domain object already exists [2/7]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [3/7]: adding RID bases Found more than one local domain ID range with no RID base set. [error] RuntimeError: Too many ID ranges Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Too many ID ranges The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information The existing servers running CentOS 7 show a huge set of irritating error messages in their ipareplica-install.log, e.g. [01/Jul/2023:14:28:21.640127492 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:28:21.643664115 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:28:28.521873989 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:28:28.533330535 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:28:28.586507750 +0200] - ERR - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipaca8.example.com" (ipaca8:389) - Replication bind with GSSAPI auth failed: LDAP error 49 (Invalid credentials) () [01/Jul/2023:14:28:28.592028265 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:28:28.596813608 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:28:28.634530928 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipaca8.example.com" (ipaca8:389): Replication bind with GSSAPI auth resumed [01/Jul/2023:14:28:29.734133911 +0200] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=meToipaca8.example.com" (ipaca8:389)". [01/Jul/2023:14:28:29.879962503 +0200] - ERR - NSMMReplicationPlugin - check_flow_control_tot_init - agmt="cn=meToipaca8.example.com" (ipaca8:389) - Total update flow control gives time (2000 msec) to the consumer before sending more entries [ msgid sent: 1273, rcv: 272]) If total update fails you can try to increase nsds5ReplicaFlowControlPause and/or decrease nsds5ReplicaFlowControlWindow in the replica agreement configuration [01/Jul/2023:14:28:37.172991476 +0200] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=meToipaca8.example.com" (ipaca8:389)". Sent 2450 entries. [01/Jul/2023:14:28:37.184680247 +0200] - ERR - NSMMReplicationPlugin - agmt="cn=meToipaca8.example.com" (ipaca8:389): Total update flow control triggered 2 times You may increase nsds5ReplicaFlowControlPause and/or decrease nsds5ReplicaFlowControlWindow in the replica agreement configuration [01/Jul/2023:14:28:39.292861041 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:28:42.238638987 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:28:45.252557867 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:28:48.099823076 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:28:51.115124375 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:28:54.569369909 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:28:55.372406568 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:28:55.375939992 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:28:55.401821331 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:28:55.405166233 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:28:57.163613285 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:29:00.163149244 +0200] - ERR - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to acquire replica: permission denied. The bind dn "" does not have permission to supply replication updates to the replica. Will retry later. [01/Jul/2023:14:29:03.169779479 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later. [01/Jul/2023:14:29:06.194564448 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipaca8.example.com" (ipaca8:389): Replication bind with GSSAPI auth resumed [01/Jul/2023:14:29:12.781739365 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later. [01/Jul/2023:14:29:15.828272021 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipaca8.example.com" (ipaca8:389): Replication bind with GSSAPI auth resumed [01/Jul/2023:14:29:22.331677615 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:29:22.336648109 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:29:22.381929587 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:29:22.385856628 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:29:39.014631450 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:29:39.018564522 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:29:39.060413149 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:29:39.063778450 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:29:57.610268113 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:29:57.641460597 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:29:57.646901146 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:29:57.650273580 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:29:57.966813928 +0200] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=caToipaca8.example.com" (ipaca8:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [01/Jul/2023:14:29:58.254056287 +0200] - INFO - NSMMReplicationPlugin - repl5_tot_run - Beginning total update of replica "agmt="cn=caToipaca8.example.com" (ipaca8:389)". [01/Jul/2023:14:30:07.529903162 +0200] - INFO - NSMMReplicationPlugin - repl5_tot_run - Finished total update of replica "agmt="cn=caToipaca8.example.com" (ipaca8:389)". Sent 812 entries. [01/Jul/2023:14:30:21.240947781 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:30:21.258555098 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:30:21.265646281 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:30:21.269315594 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:30:30.822736296 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:30:30.826194504 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:31:23.431259302 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:31:23.434660242 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:31:23.460663707 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:31:23.463998899 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:31:27.728622122 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:31:27.731885674 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:32:21.101350084 +0200] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Attempting to release replica, but unable to receive endReplication extended operation response from the replica. Error -1 (Can't contact LDAP server) [01/Jul/2023:14:32:24.721580643 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipaca8.example.com" (ipaca8:389): Replication bind with GSSAPI auth resumed [01/Jul/2023:14:32:36.926940968 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=caToipaca8.example.com" (ipaca8:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later. [01/Jul/2023:14:32:37.826884159 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:32:37.832202241 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:32:37.849761419 +0200] - ERR - get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct. [01/Jul/2023:14:32:37.853061285 +0200] - ERR - ipa_sidgen_add_post_op - [file ipa_sidgen.c, line 140]: Failed to get ID ranges. [01/Jul/2023:14:32:43.233314167 +0200] - WARN - NSMMReplicationPlugin - acquire_replica - agmt="cn=meToipaca8.example.com" (ipaca8:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later. [01/Jul/2023:14:33:00.770698631 +0200] - ERR - repl_version_plugin_recv_acquire_cb - [file ipa_repl_version.c, line 119]: Incompatible IPA versions, pausing replication. This server: "20100614120000" remote server: "(null)". [01/Jul/2023:14:33:01.189340299 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipaca8.example.com" (ipaca8:389): Replication bind with GSSAPI auth resumed [01/Jul/2023:14:33:21.446637163 +0200] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=caToipaca8.example.com" (ipaca8:389): Replication bind with GSSAPI auth resumed Looking at this I don't have the impression that FreeIPA 4.6.8 (CentOS7) and 4.9.11 (CentOS8) work very well together. Esp I am concerned about the "Failed to convert LDAP entry to range struct". That seems to be exactly the item causing all that trouble. Just to be sure, I had increased the domainlevel to 1, as recommended in the migration gitelines: [root@ipa1 ~]# ipa domainlevel-get ----------------------- Current domain level: 1 ----------------------- Trying to manually set the base RID on CentOS7 I get: [root@ipa1 ~]# ipa idrange-find --raw ---------------- 3 ranges matched ---------------- cn: EXAMPLE.COM_id_range ipabaseid: 379400000 ipaidrangesize: 200000 iparangetype: ipa-local cn: EXAMPLE.COM_posix ipabaseid: 1000 ipaidrangesize: 99000 iparangetype: ipa-local cn: EXAMPLE.COM_subid_range ipabaseid: 2147483648 ipaidrangesize: 2147352576 ipabaserid: 2147283648 ipanttrusteddomainsid: S-1-5-21-738065-838566-194929194 iparangetype: ipa-ad-trust ---------------------------- Number of entries returned 3 ---------------------------- [root@ipa1 ~]# ipa idrange-mod --rid-base=1000 EXAMPLE.COM_posix ipa: ERROR: This command can not be used to change ID allocation for local IPA domain. Run `ipa help idrange` for more information Some doc on the net recommended to try setting the missing Base RID using ldapmodify. Won't that put my existing CentOS 7 hosts at risk? How can I get out of this nightmare? Every helpful comment is highly appreciated Harri

2 3

Broken plugin for FreeIPA Help Please
by Günther J. Niederwimmer 03 Jul '23

03 Jul '23

Hello FreeIPA list, I got the ipa module freeipa-user-mailalternateaddress-master from github, unfortunately the paths have apparently changed (version 9.2) with the IPA version 4.10.1 API version 2.251 one of YOU can change the script so that the files are back in the right PATHS come. I can't tell if it still works, but it's worth a try! Thanks for replies and help. -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

2 3

Re: FIPs enabled Install Fails
by Entrepreneur AJ 02 Jul '23

02 Jul '23

Thank you for the response Christian. I would rather not use FIPs at all but looks like it's going to become a requirement with me going into the financial industry. I will submit it on Pagure 2 Jul 2023 18:04:52 Entrepreneur AJ <aj(a)eajglobal.com>: > Thank you for the response Christian. > > I would rather not use FIPs at all but looks like it's going to become a requirement with me going into the financial industry. > > I will submit it on Pagure > > 2 Jul 2023 17:59:20 Christian Heimes via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>: > >> On 02/07/2023 12.21, Entrepreneur AJ via FreeIPA-users wrote: >>> I today spun up a fresh Fedora 38 VPS on Vultr and started the FreeIPA Server install. >>> This VPS has been switched to FIPs enabled. >>> I have then tried to install the latest FreeIPA server from DNF without the DNS package. >>> All was going well until it got to step 17 of 30 and outputted the following: >>> [17/30]: requesting RA certificate from CA >>> [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nokeys', '-clcerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmpfufotvvx', '-passin', 'file:/tmp/tmpwdlfgkkt'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n') >>> CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nokeys', '-clcerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmpfufotvvx', '-passin', 'file:/tmp/tmpwdlfgkkt'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n') >>> The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information >>> Any pointers on how to get passed this bit? >> >> Could you please report the problem at https://pagure.io/freeipa/issues ? The problem is probably to related to this PKCS#12 bug https://github.com/openssl/openssl/issues/19997 >> >> I recommend against installing FreeIPA in FIPS mode. Fedora is neither FIPS compliant nor FIPS certified. Fedora's FIPS mode doesn't give you any benefits, just more pain and trouble. In some cases it's also *less* secure, because some algorithms and features are disabled in FIPS mode. >> >> Further more there is very limited testing of FreeIPA in FIPS mode. A FreeIPA installation FIPS mode can break any time. You'll have more luck with CentOS Stream or a free developer license of RHEL. They'll get you closer to FIPS compliance. (IIRC even RHEL 9 isn't FIPS 140-3 certified, yet.) >> >> Christian >> >> -- >> Christian Heimes >> Principal Software Engineer, Identity Management and Platform Security >> >> Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn, >> Commercial register: Amtsgericht Muenchen, HRB 153243, >> Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

2 1

FIPs enabled Install Fails
by Entrepreneur AJ 02 Jul '23

02 Jul '23

I today spun up a fresh Fedora 38 VPS on Vultr and started the FreeIPA Server install. This VPS has been switched to FIPs enabled. I have then tried to install the latest FreeIPA server from DNF without the DNS package. All was going well until it got to step 17 of 30 and outputted the following: [17/30]: requesting RA certificate from CA [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nokeys', '-clcerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmpfufotvvx', '-passin', 'file:/tmp/tmpwdlfgkkt'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n') CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nokeys', '-clcerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmpfufotvvx', '-passin', 'file:/tmp/tmpwdlfgkkt'] returned non-zero exit status 1: 'Error verifying PKCS12 MAC; no PKCS12KDF support.\nUse -nomacver if MAC verification is not required.\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information Any pointers on how to get passed this bit?

2 1

How does FreeIPA actually auth client behind the scenes?
by dweller dweller 02 Jul '23

02 Jul '23

Hi, I am interested in understanding the process of user authentication in the FreeIPA WebUI behind the scenes. However, the available information is scattered, and I am struggling to piece it all together. I have attached a diagram illustrating my current understanding, which I know is incorrect. To clarify my confusion, I will break down each point into specific questions: https://tinyurl.com/freeipa-auth - link to the scheme in draw.io https://imgur.com/mQEvred - scheme image 1. So user is already sees before him FreeIPA login form. He types his login/password and submits the form 2. Request goes to /ipa/login_password. /ipa/login_password location by itself does not offer much: <Location "/ipa/session/login_password"> Satisfy Any Require all granted </Location> The interesting part is actually at /ipa location which handled by mod_auth_gssapi: <Location "/ipa"> AuthType GSSAPI AuthName "Kerberos Login" GssapiUseSessions On Session On SessionCookieName ipa_session path=/ipa;httponly;secure; SessionHeader IPASESSION GssapiSessionKey file:/etc/httpd/alias/ipasession.key GssapiImpersonate On GssapiDelegCcacheDir /run/ipa/ccaches GssapiDelegCcachePerms mode:0660 GssapiDelegCcacheUnique On GssapiUseS4U2Proxy on GssapiAllowedMech krb5 Require valid-user ErrorDocument 401 /ipa/errors/unauthorized.html Header always append X-Frame-Options DENY Header always append Content-Security-Policy "frame-ancestors 'none'" Header unset Set-Cookie Header unset ETag FileETag None </Location> Here is where things become vague for me. We see *GssapiImpersonate On* and *GssapiUseS4U2Proxy on*. ``` GssapiImpersonate This option can be used even if AuthType GSSAPI is not used for given Location or LocationMatch, to obtain service ticket for a user that was already authenticated by different module ``` and ``` GssapiUseS4U2Proxy Enables the use of the s4u2Proxy Kerberos extension also known as constrained delegation This option allows an application running within Apache to operate on behalf of the user against other servers by using the provided ticket (subject to KDC authorization). ``` So why do we need both? Isn't GssapiUseS4U2Proxy enough to issue service tickets on behalf of user and use them? Also, is there is no TGT actually obtained for the client's principal, only service tickets? 3. Here I have basic understanding that Apache need somehow to talk to KDC. It does it with help of mod_auth_gssapi, which implements GSS-API interface for Apache. Apache itself does not aware of any KDC or other auth provider present, cause there is no settings in apache config about it. So let's say apache makes some gssapi function call to initiate exchange. - Does it start with SPNEGO negotioation, or directly "asks" for kerberos5 mechanism? (cause it is in the settings GssapiAllowedMech krb5). We have a /etc/gss file with following settings: [root@ipa-test conf.d]# cat /etc/gss/mech.d/gssproxy.conf # GSS-API mechanism plugins # # Mechanism Name Object Identifier Shared Library Path Other Options gssproxy_v1 2.16.840.1.113730.3.8.15.1 /usr/lib64/gssproxy/proxymech.so <interposer> I guess by it we can confirm that gssproxy intercept all the gssapi calls on the host? Next look at the gssproxy config for the ipa: [root@ipa-test ~]# cat /etc/gssproxy/10-ipa.conf #Installed and maintained by ipa update tools, please do not modify [service/ipa-httpd] mechs = krb5 cred_store = keytab:/var/lib/ipa/gssproxy/http.keytab cred_store = client_keytab:/var/lib/ipa/gssproxy/http.keytab allow_protocol_transition = true allow_client_ccache_sync = true cred_usage = both euid = apache [service/ipa-api] mechs = krb5 cred_store = keytab:/var/lib/ipa/gssproxy/http.keytab allow_constrained_delegation = true allow_client_ccache_sync = true cred_usage = initiate euid = ipaapi [service/ipa-sweeper] mechs = krb5 cred_store = keytab:/var/lib/ipa/gssproxy/http.keytab socket = /var/lib/gssproxy/ipa_ccache_sweeper.sock euid = ipaapi cred_usage = initiate Let's review options for ipa-httpd and ipa-api services: - allow_protocol_transition (This option controls whether s4u2self requests are allowed for the requesting client) Ok, understandable, we need it in conjuction with GssapiUseS4U2Proxy on of the Apache, otherways it won't work. Though it is present for service/ipa-api and not for the service/ipa-httpd. Why so? - allow_client_ccache_sync This one is kind of vague for me. This option allows the proxy, in certain circumstances, to send back an additional option in the response structure of certain calls when it determines that a new ticket may have been added to the internal ccache. Clients can then replace their (encrypted) copy with the updated ccache. So gssproxy injects option in response for a client (apache in our case?) to renew service tickets? What are the "certain calls"? - allow_protocol_transition So, this one is enabled only for ipa-httpd. This option controls whether s4u2self requests are allowed for the requesting client. This is shows that for some reason for ipa-httpd service we only have s4u2self allowed type of requests and for ipa-api service we have s4u2proxy. Mm, why not both? I guess those interaction between Apache and KDC through gssproxy are the most vague in all of this. 4. Somehow user getting autheticated. But there is no TGT, is it? So how is it done? 5. What next is gssapi calls are getting intercepted by gssproxy, and when service tickets are recieved they are encrypted by it, so httpd process has no direct access to it, it can't decrypt it. This design likely aims to protect credentials in case of a successful attack on the Apache process. 6. After ldap service tickets aquired (stored in the /run/ipa/ccaches), apache access ldap on behalf of the user. Or better I say python code make ldap request to LDAP server, in GSS context that was handled by apache. 7. Getting data from LDAP 8. Perfoming http response with data from LDAP, and setting a coockie ipa_session. What is in the cookie, by the way? I thought it was TGT but now I'm not that sure So each point highlight my areas of confusion, and I would appreciate any corrections or insights from anyone familiar with the FreeIPA client authentication process.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2023