January 2024 - FreeIPA-users - Fedora mailing-lists

Re: api authorization stopped working after upgrade to 4.9.12-11 on RHEL8
by Sören Rothe 22 Jan '24

22 Jan '24

I have exactly the same issue after the update. Which logs do you need to check the issue? In kdc.conf there is no option set to ignore PAC.

1 1

FreeIPA 2FA OTP FIPS-140-2 Compliance
by Valentin Stancu 19 Jan '24

19 Jan '24

Hello, I've been searching for information on FIPS 140-2 compliance for OTP token generation in FreeIPA for a while, but I haven't been able to find anything conclusive. Could you tell me if the plugin that generates OTP tokens in FreeIPA is FIPS-140-2 compliant? If so, from which version has it been compliant? Could you also provide guidance on how we can verify the algorithms used by this 2FA component to generate these tokens? (Token generation system) Thank you and Best Regards, Valentin Stancu

2 1

SSSD LDAP provider fails to fetch nested groups (groups member of groups)
by Finn Fysj 19 Jan '24

19 Jan '24

I'm experiencing problems on my RHEL 9 instance when looking up members of group using getent group <GROUP NAME>. I can only get users which has direct access to a group, and no the "user groups" part of the group. My sssd.conf: [domain/<DOMAIN>] id_provider = ldap auth_provider = ldap chpass_provider = ldap sudo_provider = ldap ldap_uri = ldaps:/ipa.example.com ldap_schema = rfc2307bis ldap_search_base = dc=example,dc=com ldap_sudo_search_base = ou=sudoers,dc=example,dc=com ldap_user_search_base = cn=users,cn=accounts,dc=example,dc=com ldap_group_search_base = cn=groups,cn=accounts,dc=example,dc=com [sssd] services = nss, pam, sudo domains = default [nss] homedir_substring = /home [pam] [sudo]

3 2

Allow users from AD trust to run ipa commands
by Yuriy Halytskyy 19 Jan '24

19 Jan '24

Hi, At first I've just created an external group, added the user, and added that group to a role but that didn't work. Then I stumbled across this while googling: ipa idoverrideuser-add 'Default Trust View' username@DOMAIN And it works, the user can use IPA commands with AD kerberos ticket and roles apply properly. But I cannot for the life of me figure out what that did and are there any other consequences. Documentation talks about using ID views to override user properties but this doesn't specify any properties to override. Also, it says the view is applied to all AD users, but in that case why do I need to run that command? Cheers, Yuriy

2 2

CentOS to Ubuntu migration
by Satish Patel 19 Jan '24

19 Jan '24

Folks, We are running 4 freeIPA servers on CentOS 7.x in master-master replication and life is good. But now it's time to say goodbye to CentOS. What can I do to migrate them to Ubuntu OS? Can I create one Ubuntu instance with freeIPA and join my existing freeIPA cluster and slowly retire old CentOS nodes? Just looking for a better way to migrate everything off the CentOS.

2 1

Seeking an advice on migrating freeipa environment from centos 7 to Almalinux 9
by Polavarapu Manideep Sai 19 Jan '24

19 Jan '24

Hi Team, Seeking an advice on migrating freeipa environment from centos 7 to Almalinux 9 Consider there are 4 servers 1 as IPA master and rest are replicas 1. master.ipa.example.com [centos 7.9 IPA 4.6.8] 2. Replica1.ipa.example.com [centos 7.9 IPA 4.6.8] 3. Replica2.ipa.example.com [centos 7.9 IPA 4.6.8] 4. Replica3.ipa.example.com [centos 7.9 IPA 4.6.8] What is the best approach to migrate it to alma Linux 9 As we all know in place upgrade is not possible Gone through below link, but still looking for an advice, what happens to existing replicas and its ipa clients after promoting Almalinux 8/9 server as IPA master server? does replication work in case of higher version of ipa master[4.10.2, Almalinux] and lower version of ipa replica [4.6.8,Centos 7] ? any impact on functionality of existing replicas servers of [centos 7.9 IPA 4.6.8]? https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… As I tested we can integrate ipa clients of lower version [4.6.8,centso 7] to ipa-server of higher version [4.10.2, Alma linux] As I tested we can't add replica of lower version[4.6.8,centso 7] to ipa-server of higher version[4.10.2, Alma linux] Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 1

dirsrv cannot start on new replica server
by Schweiss, Chip 18 Jan '24

18 Jan '24

I'm trying to add a new replica server to an existing FreeIPA domain. It is failing to start dirsrv because there is not enough ramdisk for the db cache. This is still a very small domain with less than one dozen users/hosts. Adding the first replica was not a problem about 5 months ago. This is on Rocky Linux 9.3 with all updates. Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.227167031 +0000] - INFO - bdb_config_upgrade_dse_info - create config entry from old config Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.229348479 +0000] - NOTICE - bdb_start_autotune - found 16435108k physical memory Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.229942914 +0000] - NOTICE - bdb_start_autotune - found 15545732k available Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.230458948 +0000] - NOTICE - bdb_start_autotune - cache autosizing: db cache: 1027194k Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.230996494 +0000] - NOTICE - bdb_start_autotune - total cache size: 1051846912 B; Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.231761490 +0000] - ERR - bdb_no_diskspace - No enough space left on device (/dev/shm/slapd-APLD-AI) (361705472 bytes); at least 1157031603 bytes space is needed for db region files Jan 18 18:27:00 ipa01.msp01.apld.ai ns-slapd[2033]: [18/Jan/2024:18:27:00.232231378 +0000] - ERR - ldbm_back_start - Failed to init database, err=28 Unexpected dbimpl error code The add replica command: # ipa-replica-install -n apld.ai -r APLD.AI -d --setup-dns --server= ipa01.den01.apld.ai --server=ipa02.den01.apld.ai --forwarder=10.53.30.21 --forwarder=10.53.30.22 --setup-ca --setup-adtrust --add-agents --mkhomedir -p {my_otp} I'm guessing something changed between RHEL/Rocky 9.2 and 9.3, and it wants much more RAM for the db here. However, the existing servers have been upgraded to 9.3 and start just fine. I've tried doubling the ram to 16GB, but the problem persists. Any idea what is going on or how to fix this? -Chip

1 0

Re: Create IPA user via LDAP
by Ronald Wimmer 18 Jan '24

18 Jan '24

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. > So. Am I right that our options are to use LDAP with a cleartext passwort or use the IPA API?

2 1

web login failed after upgrade
by 彭勇 18 Jan '24

18 Jan '24

when we upgrade ipa-server-4.9.12-9 to ipa-server-4.9.12-11 on RHEL 8, we can't login to web. the web give me message: “Your session has expired. Please log in again.” we check the error_log [Thu Jan 18 21:56:42.535394 2024] [auth_gssapi:error] [pid 11025:tid 139639453087488] [client 118.184.176.67:30891] Failed to unseal session data!, referer: https://id1.netegn.com/ipa/xml [Thu Jan 18 21:56:43.113937 2024] [wsgi:error] [pid 11021:tid 139639621613312] [remote 118.184.176.67:30891] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) [Thu Jan 18 21:56:43.611962 2024] [wsgi:error] [pid 11023:tid 139639621613312] [remote 118.184.176.67:30893] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) all three ipa server failed. we can't resolve the problem, we restore the snapshot and it recovery. we install RHEL 9.3 with ipa-server-4.10.2-5，set it as replicator of master ipa server, it has same problem. -- Peng Yong

2 1

Freeipa Ansible Galaxy collection - missing idoverride module from community.general collection.
by slek kus 18 Jan '24

18 Jan '24

Hi, I have tested below playbook on a testmachine, where I downloaded the ansible roles and modules, which worked. Now trying to do repeat this on Ansible automation platform but cannot find the module there? Anyone any idea or clue? https://github.com/freeipa/ansible-freeipa/blob/master/playbooks/idoverride… Or is this simply missing, if so, and are there ways to have idoverride functionality in Ansible AP? https://docs.ansible.com/ansible/latest/collections/community/general/index… I am new to Ansible. Cheers, slekkus

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024