July 2023 - FreeIPA-users - Fedora mailing-lists

Exporting certificates with keys associated in FreeIPA
by Carlos Lopez 26 Jul '23

26 Jul '23

Hi all, Sorry to disturb but I can not find which is the correct procedure to accomplish this. I have created a certificate in WebUI and I can export certificate in pem format, which it is what I need. But I need the private key also. This certificate is for a host outside of Kerberos and LDAP's FreeIPA domain. How can I export pem cert and key file? Regards, C. L. Martinez

1 0

Krb5kdc and kadmin services not getting started
by Polavarapu Manideep Sai 25 Jul '23

25 Jul '23

Hi Team, Krb5kdc and kadmin services not getting started PFB error logs As you can see we are getting "Kerberos User Principal not found. Do you have a valid Credential Cache?" upon getting new keytab [root@dir ~]# tail -f /var/log/krb5kdc.log krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM ------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# tail -f /var/log/kadmind.log Jul 24 19:49:57 dir.IPA.DOMAIN.COM kadmind[211105](Error): Server error while initializing, aborting Jul 24 19:56:29 dir.IPA.DOMAIN.COM kadmind[2807](Error): Server error while initializing, aborting Jul 24 20:50:50 dir.IPA.DOMAIN.COM kadmind[5803](Error): Server error while initializing, aborting Jul 24 20:55:02 dir.IPA.DOMAIN.COM kadmind[6560](Error): Server error while initializing, aborting Jul 24 21:39:45 dir.IPA.DOMAIN.COM kadmind[9520](Error): Server error while initializing, aborting ---------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# klist -kt Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 05/14/2019 13:23:12 host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM 1 05/14/2019 13:23:12 host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM ---------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# mv /etc/krb5.keytab /etc/krb5.keytab-bak [root@dir ~]# ------------------------------------------------------------------------------------------------------------ [root@dir ~]# ipa-getkeytab -s central01.ipa.domain.com -p host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM -k /etc/krb5.keytab Kerberos User Principal not found. Do you have a valid Credential Cache? [root@dir ~]# [root@dir ~]# Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 1

Cannot get rid of a replica/agreement
by lejeczek 21 Jul '23

21 Jul '23

Hi guys. Two masters from which third got disconnected in a "dirty" manner. -> $ ipa-replica-manage del midway.ccn.priv.dom Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server love.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom Topology does not allow server midway.ccn.priv.dom to replicate with servers: love.ccn.priv.dom punch.ccn.priv.dom Topology does not allow server punch.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom. -> $ ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom Left node: punch.ccn.priv.dom Right node: love.ccn.priv.dom Connectivity: both ---------------------------- Number of entries returned 1 -> $ ipa-replica-manage del midway.ccn.priv.dom --force ipa: WARNING: /usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes) Updating DNS system records Not allowed on non-leaf entry I've tried to 'reinitialize' but without success. Anybody care to share suggestions & thoughts? many thanks, L.

4 6

Do you want to search for missing reverse zones?
by Ian Pilcher 21 Jul '23

21 Jul '23

I am attempting to automate a FreeIPA installation (for troubleshooting purposes), and I cannot figure out how to get rid of this question. I have tried adding '--no-reverse' to the ipa-server-install command, but I am still getting the prompt. What option do I need to use? Thanks! -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

2 2

ipa-ca-install fails on a install
by Rudi Gabler 19 Jul '23

19 Jul '23

Hi, I've a bunch of 5 servers for my domain. One has CA on it and on any other the attempt to bring it up as secondary,.. CA replica fails with: ipa-ca-install ... caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u Installation failed: <html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 500 - javax.ws.rs.ProcessingException: Unable to invoke request</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>javax.ws.rs.ProcessingException: Unable to invoke request</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.jboss.resteasy. spi.UnhandledException: javax.ws.rs.ProcessingException: Unable to invoke request org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149) org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372) org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) javax.servlet.http.HttpServlet.service(HttpServlet.java:731) sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) together with a (journalctl) Jul 17 10:24:14 kre.example.com server[21753]: CMS Warning: FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Property internaldb.ldapconn.port missing value| Jul 17 10:24:14 kre.example.com server[21753]: CA is started. Jul 17 10:24:17 server[21753]: getSystemCertProfileID tag: subsystem defaultName: caInternalAuthSubsystemCert keyType: null Jul 17 10:24:17 kre.example.com server[21753]: FATAL: SSL alert received: HANDSHAKE_FAILURE The pki-tomcat is the last thing started, but throws an exeption I can provide the ipareplication-install.log. For all servers the failure is exactly the same (without the running master of course). Software: centos 7 with pa-common-4.6.8-5.el7.centos.14.noarch ipa-server-trust-ad-4.6.8-5.el7.centos.14.x86_64 ipa-client-common-4.6.8-5.el7.centos.14.noarch ipa-client-4.6.8-5.el7.centos.14.x86_64 ipa-server-dns-4.6.8-5.el7.centos.14.noarch ipa-server-common-4.6.8-5.el7.centos.14.noarch ipa-server-4.6.8-5.el7.centos.14.x86_64 Maybe someone has a tip for me? Regards, Rudi G.

2 4

Clarification on automember rules
by dweller dweller 18 Jul '23

18 Jul '23

In our environment, we have deployed Dex as an Identity Provider (IdP) for authentication in various Kubernetes (k8s) clusters. However, we encountered an issue with configuring Dex to account for nested groups. As a workaround, we implemented a solution that assigns groups with automembership. Allow me to explain: Each k8s cluster has Role-Based Access Control (RBAC) configured, which is associated with four groups retrieved from LDAP via Dex. Consequently, we have the following naming convention: k8s-cluster-01-l0 k8s-cluster-01-l1 k8s-cluster-01-l2 k8s-cluster-01-l3 Additionally, we have user groups such as: team-l0 team-l1 team-l2 team-l3 We add users to the appropriate team group based on their entitlements, and subsequently, we associate the team-l* groups with their respective k8s-cluster-01-l* group. This arrangement grants the members of the team-* group specific access rights to the corresponding k8s cluster. However, initially, Dex was only able to recognize the groups that a user was directly a member of. To address this limitation, we implemented automember rules. For example, we created four rules as follows: k8s-cluster-01-l0 if memberof team-l0 k8s-cluster-01-l1 if memberof team-l1 k8s-cluster-01-l2 if memberof team-l2 k8s-cluster-01-l3 if memberof team-l3 As the number of clusters increased, we ended up with around 52 automember rules following the same pattern for k8s. Now, whenever I need to add a user or modify automember rules and trigger an automember rebuild, even for a small set of users (5-10), FreeIPA experiences a prolonged hang. Eventually, it times out the automember rebuild task, and this lagging behavior extends to all replicas. In light of this situation, I would like to clarify the following: Is my understanding correct that for each user in this setup, I create 52 automember rebuild tasks? Is it expected for the system to function this way, or am I using the automember plugin incorrectly? Could it be that the plugin is not intended for such high membership usage? I would appreciate any insights you can provide to help resolve these concerns. P.S.: I found a way to make a Dex to see nested groups membership, but for now I'm stuck with this workaround, cause it much harder to conform changes now.

2 3

bad list of CAs on FreeIPA client?
by Harald Dunkel 18 Jul '23

18 Jul '23

Hi folks, getcert list-cas returns on some FreeIPA clients root@nasl006a:~# getcert list-cas CA 'SelfSign': is-default: no ca-type: INTERNAL:SELF next-serial-number: 01 CA 'IPA': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/ipa-submit CA 'certmaster': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/certmaster-submit CA 'dogtag-ipa-renew-agent': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/dogtag-ipa-renew-agent-submit CA 'local': is-default: no ca-type: EXTERNAL helper-location: /usr/lib/certmonger/local-submit certmaster-submit doesn't exist, but there are others not included in this list: # find /usr/lib/certmonger -name \*-submit /usr/lib/certmonger/dogtag-ipa-renew-agent-submit /usr/lib/certmonger/scep-submit /usr/lib/certmonger/local-submit /usr/lib/certmonger/ipa-submit /usr/lib/certmonger/dogtag-submit Is this something to be worried about? FreeIPA is version 4.9.8-1~bpo11+1 from the Debian backports repository. Regards Harri

2 1

Failure during ipa-server-install on ipa-client-install part in the container
by dweller dweller 17 Jul '23

17 Jul '23

Introduction: We are currently using the Altlinux system, and the freeipa package is maintained in the repository provided at https://packages.altlinux.org/en/p10/srpms/freeipa/. To meet our specific requirements, I decided to create a container package based on the Altlinux p10 distribution. However, I have now encountered a problem while trying to install ipa-client inside the container. It seems that I am not receiving a session cookie for some reason. Although the logs indicate that the Ticket Granting Ticket (TGT) is successfully issued and stored at /etc/ipa/.dns_ccache (TGT for the host principal), there is a warning stating that the ipa_session cookie cannot be found. As a result, the request to /ipa/json fails with a 401 error. Despite the fact that this distribution is not based on RHEL and therefore not officially supported, I would appreciate any guidance. Precisely what should happen in normal sutiation without error. Any hints on where to investigate in the source code would also be helpful. ipaclient-install logs: https://pastebin.com/8NbieLK3 the error part is: >2023-07-12T03:50:08Z DEBUG Initializing principal host/ipamaster.ipa-test.novalocal(a)IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL using keytab /data/etc/krb5.keytab >2023-07-12T03:50:08Z DEBUG using ccache /etc/ipa/.dns_ccache >2023-07-12T03:50:08Z DEBUG Attempt 1/5: success >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/bin/certutil', '-d', '/tmp/tmpgi6acve3', '-N', '-f', '/tmp/tmpgi6acve3/pwdfile.txt', '-@', '/tmp/tmpgi6acve3/pwdfile.txt'] >2023-07-12T03:50:08Z DEBUG Process finished, return code=0 >2023-07-12T03:50:08Z DEBUG stdout= >2023-07-12T03:50:08Z DEBUG stderr= >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/sbin/selinuxenabled'] >2023-07-12T03:50:08Z DEBUG Process execution failed >2023-07-12T03:50:08Z DEBUG Starting external process >2023-07-12T03:50:08Z DEBUG args=['/usr/bin/certutil', '-d', 'sql:/tmp/tmpgi6acve3', '-A', '-n', 'CA certificate 1', '-t', 'C,,', '-a', '-f', '/tmp/tmpgi6acve3/pwdfile.txt'] >2023-07-12T03:50:08Z DEBUG Process finished, return code=0 >2023-07-12T03:50:08Z DEBUG stdout= >2023-07-12T03:50:08Z DEBUG stderr= >2023-07-12T03:50:08Z DEBUG failed to find session_cookie in persistent storage for principal 'host/ipamaster.ipa-test.novalocal(a)IPA-TEST-NOTLIKEDOMAIN.NOVALOCAL' >2023-07-12T03:50:08Z DEBUG trying https://ipamaster.ipa-test.novalocal/ipa/json >2023-07-12T03:50:08Z DEBUG Created connection context.rpcclient_139827748309840 >2023-07-12T03:50:08Z DEBUG [try 1]: Forwarding 'schema' to json server 'https://ipamaster.ipa-test.novalocal/ipa/json' >2023-07-12T03:50:08Z DEBUG ENTERING SINGLE_REQUEST >2023-07-12T03:50:08Z DEBUG HOST:i (ipamaster.ipa-test.novalocal) >2023-07-12T03:50:08Z DEBUG HANDLER: (/ipa/json) >2023-07-12T03:50:08Z DEBUG REQUEST_BODY: (b'{"method": "schema", "params": [[], {"version": "2.170"}], "id": 0}') >2023-07-12T03:50:08Z DEBUG New HTTP connection (ipamaster.ipa-test.novalocal) >2023-07-12T03:50:08Z DEBUG HTTP connection destroyed (ipamaster.ipa-test.novalocal) >Traceback (most recent call last): > File "/usr/lib64/python3/site-packages/ipaclient/remote_plugins/__init__.py", line 120, in get_package > plugins = api._remote_plugins >AttributeError: 'API' object has no attribute '_remote_plugins' > >During handling of the above exception, another exception occurred: > >Traceback (most recent call last): > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 727, in single_request > if not self._auth_complete(response): > File "/usr/lib64/python3/site-packages/ipalib/rpc.py", line 673, in _auth_complete > raise errors.KerberosError( >ipalib.errors.KerberosError: No valid Negotiate header in server response >2023-07-12T03:50:08Z DEBUG Destroyed connection context.rpcclient_139827748309840 >2023-07-12T03:50:08Z DEBUG File "/usr/lib64/python3/site-packages/ipapython/admintool.py", line 180, in execute

4 6

FreeIPA on Fedora and dnf system-upgrade
by Ian Pilcher 16 Jul '23

16 Jul '23

I am currently running FreeIPA on CentOS 7, and I am considering moving it to Fedora. On RHEL and derivatives, in-place upgrades are not supported. It is necessary to provision a new server, running the new OS version, add it as a FreeIPA replica, and then decommission the old system. How does this work on Fedora? Will I be able to use dnf system-upgrade, or will I find myself having to use the process described above? -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

3 2

Running another app alongside IPA (gssproxy)
by Aurelien Bompard 16 Jul '23

16 Jul '23

Hey folks! I'm trying to run IPA and another wsgi piece of code (FASJSON) on the same VM, and I think I'm having trouble with the gssproxy config. I have set fasjson to a separate gssproxy socket (gssproxy conf & app env var), I have enabled logging in gssproxy, and it rejects authentication with: Stored ccache failed to decrypt; treating as empty. I don't think I've configured things much differently than how IPA is configured. FASJSON works fine with gssproxy when it's on its own VM, by the way. There is a ccache file created by mod_auth_gssapi in /run/fasjson/ccaches, and klist says it's encrypted by gssproxy In gssproxy config, fasjson has its own keytab set as cred_store, has allow_constrained_delegation set to true, and its own socket, but besides that it looks similar to the ipa-httpd service. I didn't set any ccache: entry as a cred_store because IPA doesn't have it, and there is no substitution I can use to point to the file that mod_auth_gssapi has created, because it's named after the principal (/run/fasjson/ccaches/admin(a)DOMAIN.TLD) and gssproxy only has substitutes for username and user id. Also, when I tried to hardcode it, selinux prevented access, so I thought that's not how it's supposed to work. (as you may be able to tell, I've been at this for quite a while now ;-) ) Any idea what I'm doing wrong? I can provide config files and logs as needed. Thanks! Aurélien

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2023