January 2024 - FreeIPA-users - Fedora mailing-lists

Freeipa sudo
by Dmitry Krasov 18 Jan '24

18 Jan '24

Hello. The FreeIpa user has sudo rights on a Ubuntu 2204 desktop machine that is in the FreeIpa Linux domain. It can do sudo su, sudo apt install… But when starting some services and basic installation of applications from the market (in general, when it comes to gui admin rights), it asks the local administrator password. How can I fix this so the user’s password was requested from FreeIpa or not at all?

2 9

Is there any way to disable TOTP watermark support?
by Heo Paul 17 Jan '24

17 Jan '24

I use the core server (fedora 39, ipa-version : 4.11.0) I know that freeipa server adds TOTP watermark support since 4.1 version. But for some reason, I need to reuse otp-code from generated with TOPT for short time to login but it fails with otp watermark. Are there any ways to disable the feature from server side? Thanks in advance.

2 1

Redundancy and failover practices
by Justin Sanderson 15 Jan '24

15 Jan '24

I have built a 4 node environment in which all 4 servers have CA and domain replication via a tight-cell topology. I have some questions about redundancy and failover. 1. How are user logins affected if my master dies? 2. I understand that sssd has some built-in failover capabilities but is there anything that I need to do on the DNS SRV records for ldap and kerberos? 3. Is failover even a thing for krb5/ldap services since they're replicating? Overall, I would like some detail about what to do and how, when my master goes down? I see a decent amount of information about how to set it all up but how do I actually make use of it in the event of server failure? Any in-depth docs/info on this topic would be appreciated. Thanks in advance.

1 0

Bind9/named 4.10.2 segfaults under dnssec load, ISC points to lib version mismatches.
by Harry G Coin 15 Jan '24

15 Jan '24

Under opendnssec processing load, bind9 segfaults under v 4.10.2. The only mitigation was to add systemd restart override. Details here: https://gitlab.isc.org/isc-projects/bind9/-/issues/4533 Coredumps available. The ISC devs closed the issue with this comment: "Yeah, SoftHSM2 is pretty much broken with OpenSSL 3. If you want this to work, you need to compile both BIND 9 and SoftHSM2 to be compiled with OpenSSL 1.1. (The worst you can do is to compile one with OpenSSL 3 and second with OpenSSL 1.1, SoftHSM2 leaks symbols into the address space.) There’s also a libnss file provider that can be used as alternative. But combining old and new will not work here. SoftHSM2 is basically in maintained as of not. There’s nothing we can do here on BIND 9 side. There will be support for OpenSSL 3 providers in future, but not in the version near EOL." Looks like the freeipa team has some choices to make re: named-bind/opendnssec/softhsm2/pcks11/openssl ! Thanks Harry

1 0

Re: Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Thomas Letherby 12 Jan '24

12 Jan '24

I say always use a subdomain. You don't lose much (apart from a slightly longer domain to type in) but you get a whole lot more flexibility. If you need to stand up Active Directory, or another FreeIPA forest separate from the first, you can keep it in the same namespace and not worry about conflicts. You can use CNAMEs in the root for user accessed things to keep URLs short, and you don't have the issue of people not being able to use the company website without www.... Thomas On Thu, Jan 11, 2024 at 8:06 AM Paul Wilcox via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > Older thread, curious which direction you went with. > > I am kind of deciding the same as you. Build it with root domain and > then have resource domains or do a subdomain to start. Have not really > found a best practice guide. > > Wonder how redhat does there domain setup. > > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

1 0

Old Home Folders and Free ipa users
by Alper AYKUT 12 Jan '24

12 Jan '24

Hello I have 5 servers. The users of all servers are created locally. All users have Home. Now I will connect the Servers to the Free ipa server to enable them to log in with the Users I have created in Free IPA. However, how will the users' home folders that were created in the past match the User created in Free ipa? Or will the users need to delete their home folders to be created again. If I need to delete the Home folders of the users, I will need to back up the data of all users. This is a huge workload. Thankyou for support.

4 5

[SSSD] Announcing SSSD 2.9.4
by Pavel Březina 12 Jan '24

12 Jan '24

# SSSD 2.9.4 The SSSD team is announcing the release of version 2.9.4 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.4 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.4.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.4 Release Notes ## Highlights ### Important fixes * Fixes a crash when PAM passkey processing incorrectly handles non-passkey data. * A workaround was implemented to handle gracefully misbehaving applications that destroy internal state of SSSD client librarires. A particular example of such application is described in https://github.com/TigerVNC/tigervnc/issues/1709. * An error when rotating KCM's logs was fixed. When KCM's logs were rotated by logrotate, KCM would still use the old file (renamed sssd_kcm.log.1). Only after KCM was restarted (either manually or automatically) the new log file would be used. This problem is now solved and KCM uses the new file immediately. * Fixed group membership handling when members are coming from different forest domains and using ldap token groups is prohibited. * Files provider was erroneously taking into consideration `local_auth_policy` config option, thus breaking smartcard authentication of local user in setups that didn't explicitly specify this option. This is now fixed.

1 0

Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?
by Braden McGrath 11 Jan '24

11 Jan '24

Hello FreeIPA-users. The Subject line is the core of my question here; I'll provide a bit more detail below. I work for what is (effectively) a startup, non-profit internet provider. I have an extensive Windows background, and "know enough to be dangerous" with Linux & BSD (have been tinkering with GNU/Linux on and off since Slackware 3.0 or 3.1). I'm very familiar with Windows Active Directory, but the org does not have any AD infrastructure right now (and being nonprofit, are trying to avoid spending money for MS, especially when all of the other VMs will be Linux or BSD anyway). Given the nonprofit nature, I discovered FreeIPA when looking for a free centralized directory system. The goal is to consolidate all credentials for *other* Linux VMs (customer-facing DNS, CRM web server, SNMP/network graphing servers, etc) as well as provide a back-end for RADIUS for management of network equipment (switches, routers, P2P wireless, etc). Simplifying DNS management and replication is also appealing, I'd rather administrate one system than two or three. In case it changes your opinion of the plan at all - all of the network equipment and VMs will be on *private* (10.x) IPv4 space and behind one or more firewalls, at least initially. We do want to add public IPv6, but do not have that yet. We only have a small allocation (/26) of public v4 from our upstream that will be NATed through a firewall and not directly on any devices. The traffic to FreeIPA is going to be internal-only, I do not plan on exposing FreeIPA's DNS "to the world" at all. Even customer-facing internal DNS will likely be through separate caching forwarders pointing back to FreeIPA. I have a completely unused, publicly registered domain (let's just call it "example.net" for this thread) available to dedicate to this system. We also own "example.org" and are using that for our public web presence, and I intend to keep that entirely standalone. Given that I have no current "interoperability" concerns, is there anything "wrong" with putting FreeIPA directly at the root of example.net? Or would it be more wise, from an interop, security, or manageability standpoint (i.e. a "best practice"), to root FreeIPA at something like auth.example.net or ipa.example.net and then have a separate set of nameservers handling the base domain? If I put FreeIPA's root (and Kerberos realm) in a subdomain, is it possible to *also* have it manage the parent domain's DNS entries? I've read through the Quick Start Guide and Deployment Recommendations (https://www.freeipa.org/page/Deployment_Recommendations) which is part of how I've come to the decisions I've made thus far. I couldn't really find guidance one way or the other on whether FreeIPA "should" be in a subdomain or not, hence this posting. I would appreciate any insight the community can provide!

3 4

FreeIPA web session timeout
by Yuri Krysko 10 Jan '24

10 Jan '24

Hello, Could you please advise how to configure FreeIPA web UI user session timeout? Thanks, Yuri ________________________________ LEGAL DISCLAIMER: M.C. Dean, Inc. and its subsidiaries considers this e-mail and any files transmitted with it to be protected, proprietary or privileged information intended solely for the use of the named recipient(s). Any disclosure of this material or the information contained herein, in whole or in part, to anyone outside of the intended recipient or affiliates is strictly prohibited. M. C. Dean, Inc. accepts no liability for the content of this e-mail or for the consequences of any actions taken on the basis of the information contained in it, unless that information is subsequently confirmed in writing. Employees of M.C. Dean, Inc. are instructed not to infringe on any rights of the recipient; any such communication violates company policy. If you are not the intended recipient, any disclosure, copying, distribution, or action taken or omitted in reliance on this information is strictly prohibited by M.C. Dean, Inc.; please notify the sender immediately by return e-mail, delete this communication and destroy all copies.

4 4

FreeIPA security fix releases
by Antonio Torres 10 Jan '24

10 Jan '24

Hello, The FreeIPA team would like to announce the following security fix releases: 4.6.10: https://www.freeipa.org/release-notes/4-6-10.html 4.9.14: https://www.freeipa.org/release-notes/4-9-14.html 4.10.3: https://www.freeipa.org/release-notes/4-10-3.html 4.11.1: https://www.freeipa.org/release-notes/4-11-1.html

1 0

Re: AD Trust with multiple replicas
by Anil Rathod 10 Jan '24

10 Jan '24

I have below Setup: AD domain: abc.com maste IPA: node1.idm.abc.com Replica: node2.idm.com Both nodes are Enabled server roles: AD trust agent, AD trust controller, CA server, IPA master Now, on client side, while client connected with node1, I am able to resolve the AD Users. but when I connect the client with node2, then AD user not able to resolve. * anil This message, together with any attachments, is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient(s), or the employee or agent responsible for delivery of this message to the intended recipient(s), you are hereby notified that any dissemination, distribution or copying of this message, or any attachment, is strictly prohibited. If you have received this message in error, please immediately notify the sender and delete the message, together with any attachments, from your computer. Thank you for your cooperation.

1 0

Re: Create IPA user via LDAP
by Rob Crittenden 08 Jan '24

08 Jan '24

Ronald Wimmer wrote: > On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >> On 02.01.24 16:27, Rob Crittenden wrote: >>> Ronald Wimmer via FreeIPA-users wrote: >>>> >>>> >>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>> In our company we do have an IAM tool for user management. We need to >>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>> commands or API calls to create/modify or delete a user. >>>>>> >>>>>> As the tool does not support FreeIPA yet they asked if there is a way >>>>>> to manage users by using LDAP only. Could that work? What about >>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>> >>>>> Learn about lifecycle management. This is your way of integrating with >>>>> such tools bvy creating staged users: >>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>> >>>>> >>>> >>>> I followed the instructions from the documentation. >>>> >>>> How could I possibly overcome >>>> >>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>> >>>> I need to set passwords from the external system. >>> >>> You need to enable migration mode (ipa config-mod --enable-migration >>> true). >>> >>> By default a pre-hashed password can only be set once: during the user >>> add operation. >> >> Ok. So this would not work for a password change. So if we need to set >> an initial password and change that particular password in some point >> in time the only feasible way is the IPA API, right? >> >> Can the immediate password expiration be overridden? > > As we have an upcoming please allow me to ask if I got the point here. > > I appreciate your support in this matter! I'd recommend you look into the winsync documentation in IPA. There is a setting you can configure to allow a pre-hashed password to be written without marking it as expired (because this is what winsync does). If you use Kerberos then users are going to have to migrate their password every time it changes on the external system. rob

2 2

Ignore authselect configuration
by Finn Fysj 04 Jan '24

04 Jan '24

Hi, First: is it possible to ignore the authselect configuration during FreeIPA server installation? Reason I'm asking is because we're hardening the OS before we run FreeIPA installation, meaning there have been issues with UMASK and authselect overwrite. FreeIPA installation does not support UMASK stricter than 022. The FreeIPA installation also changes our authselect configuration as we configure this as part of our OS hardening and setting the immutable flag on some of these config files. We don't want FreeIPA installation to configure the authselect. Unfortunately we haven't found anything in /usr/lib/python3.9/site-packages/ipaplatform/redhat/authconfig.py that let us do this. Is it possible to ignore this?

2 2

(no subject)
by Finn Fysj 03 Jan '24

03 Jan '24

> Finn Fysj via FreeIPA-users wrote: > > There is not currently. > > I guess I would suggest hardening after installing IPA. You're moving > into an untested/unsupported configuration so keep that in mind. There > be dragons. > > rob Thanks Rob. However, does that mean we can get surprises if we're so bold and configure e.g UMASK after IPA installation etc.?

2 1

krb5kdc: No such file or directory
by Roberto Cornacchia 03 Jan '24

03 Jan '24

Hi there, clients are having trouble with kerberos authentication: $ kinit -V user Using existing cache: xxxxxxxxxx:yyyyy Using principal: user(a)SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM> Password for user(a)SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM>: kinit: Generic error (see e-text) while getting initial credentials On the ipa server, /var/log/krb5kdc.log says: Dec 24 14:40:34 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) < <http://192.168.0.202/>IP>: NEEDED_PREAUTH: user(a)SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM> for krbtgt/SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM, Additional pre-authentication required Dec 24 14:40:34 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:51 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ : handle_authdata (2) Dec 24 14:40:51 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) < <http://192.168.0.202/>IP>: HANDLE_AUTHDATA: user <roberto(a)SUB.EXAMPLE.COM> @SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM> for krbtgt/ SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM, No such file or directory Dec 24 14:40:51 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19)}) < <http://192.168.0.16/>IP>: NEEDED_PREAUTH: ldap/ ipa01.sub.example.com(a)SUB.EXAMPLE.COM for krbtgt/ SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM, Additional pre-authentication required Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19)}) < <http://192.168.0.16/>IP>: ISSUE: authtime 1703425257, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, ldap/ipa01.sub.example.com(a)SUB.EXAMPLE.COM for krbtgt/SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) < <http://192.168.0.16/>IP>: ISSUE: authtime 1703425257, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, ldap/ipa01.sub.example.com(a)SUB.EXAMPLE.COM for ldap/ipa02.sub.example.com(a)SUB.EXAMPLE.COM Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 There are 2 ipa servers, ipa01 (Rocky 9.3, ipa 4.10.2) and ipa02 (Rock 9.1, ipa4.10.0), both with CA and DNS. ipa02 is CRL master. On both, ipa-healthcheck doesn't find any issue. Also: kinit fails from within ipa01, succeeds from within ipa02. The issue seems to be in ipa01, and I have already tried to reinstall it from scratch. One thing that is different is the version. Could you please help me figure out what's wrong? Best regards, Roberto

3 10

Certificate Revoking error in FreeIPA domain
by Albert Stoune 03 Jan '24

03 Jan '24

Hello! I encountered a problem when revoking a certificate: "IPA Error 4035: HTTPRequestError: Request failed with status 500: Non-2xx response from CA REST API: 500." First of all, I looked at the Apache logs in /var/log/httpd/accsess.log and found next error: [08/Dec/2023:13:27:39 +0300] "POST /ca/rest/agent/certs/10/revoke HTTP/1.1" 500 6504 Then, in /var/log/httpd/error_log: ipa: INFO: [jsonserver_session] admin(a)TEST.LOCAL: cert_revoke('10', revocation_reason='0', cacn='ipa', version='2.253'): HTTPRequestError And finally I found traceback, which looks like bug in DogTag logs in /var/log/pki/pki-tomcat/ca/debug.2023-12-08.log: 2023-12-08 13:27:39 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: LDAPSession: Retrieving cn=10,ou=certificateRepository, ou=ca,o=ipaca 2023-12-08 13:27:39 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] SEVERE: Servlet.service() for servlet [Resteasy] in context with path [/ca] threw exception org.jboss.resteasy.spi.UnhandledException: java.lang.NullPointerException: Cannot invoke "String.toLowerCase()" because "<parameter1>" is null at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:78) at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:222) at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:179) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:422) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:213) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:228) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:764) at jdk.internal.reflect.GeneratedMethodAccessor42.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280) at java.base/java.security.AccessController.doPrivileged(AccessController.java:712) at java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:584) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:221) at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145) at java.base/java.security.AccessController.doPrivileged(AccessController.java:569) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at jdk.internal.reflect.GeneratedMethodAccessor41.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280) at java.base/java.security.AccessController.doPrivileged(AccessController.java:712) at java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:584) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187) at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145) at java.base/java.security.AccessController.doPrivileged(AccessController.java:569) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:660) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:83) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.rewrite.RewriteValve.invoke(RewriteValve.java:555) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360) at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:433) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:833) Caused by: java.lang.NullPointerException: Cannot invoke "String.toLowerCase()" because "<parameter1>" is null at org.mozilla.jss.netscape.security.x509.RevocationReason.valueOf(RevocationReason.java:91) at org.dogtagpki.server.ca.rest.CertService.revokeCert(CertService.java:180) at org.dogtagpki.server.ca.rest.CertService.revokeCert(CertService.java:162) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:236) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:406) ... 49 more It looks like internal mechanisms in DogTag can't parse some arguments from LDAP-response. When I'm check similar request to LDAP with ldapsearch I got response with certificate details. Looks like all correct in LDAP. Additional info for debug: command "ipactl status" shows like everything is good Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful Also, I can create new certificates, but can't delete already signed. And also I can't delete Services with signed certs, and can't delete Hosts with that Services FreeIPA version: VERSION: 4.11.0, API_VERSION: 2.253

4 16

Create IPA user via LDAP
by Ronald Wimmer 02 Jan '24

02 Jan '24

In our company we do have an IAM tool for user management. We need to create IPA users via this particular tool. I am aware of all IPA commands or API calls to create/modify or delete a user. As the tool does not support FreeIPA yet they asked if there is a way to manage users by using LDAP only. Could that work? What about attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber?

3 10

Can we go for replica installation without using 80 port instead only using 443 port
by Polavarapu Manideep Sai 02 Jan '24

02 Jan '24

Hi Team, Can we install IPA replica without using 80 port instead only using 443 port? Is it possible ? If it is possible how can we achieve this ? [using port forwarding ? or any configuration changes?] If it is not possible, why ? Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024