January 2024 - FreeIPA-users - Fedora mailing-lists

cannot login on FreeIPA web GUI: Your session has expired. Please log in again.
by Harald Dunkel 24 Jan '24

24 Jan '24

Hi folks, after the upgrade from ipa-server.x86_64 4.9.12-9 to version 4.9.12-11 my FreeIPA servers' web interfaces became inaccessible. At login time there is a message Your session has expired. Please log in again. I found some other threads about similar problems in this ML. However, the suggested fix to create SIDs [root@ipa0 log]# /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --netbios-name EXAMPLE --add-sids Configuring SID generation [1/8]: creating samba domain object Samba domain object already exists [2/8]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [3/8]: adding RID bases RID bases already set, nothing to do [4/8]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [5/8]: activating sidgen task Sidgen task plugin already configured, nothing to do [6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [7/8]: adding fallback group Fallback group already set, nothing to do [8/8]: adding SIDs to existing users and groups This step may take considerable amount of time, please wait.. Done. The ipa-enable-sid command was successful [root@ipa0 log]# echo $? 0 did not help. I still cannot login on the web interface. (Looking at the output it didn't had to do anything, anyway. AFAIR this SID thingy was already done during migration from CentOS 7 to 8, AFAIR). [root@ipa0 ~]# ipa idrange-find --raw ---------------- 3 ranges matched ---------------- cn: EXAMPLE.DE_id_range ipabaseid: 379400000 ipaidrangesize: 200000 ipabaserid: 379400000 ipasecondarybaserid: 379600000 iparangetype: ipa-local cn: EXAMPLE.DE_posix ipabaseid: 1000 ipaidrangesize: 99000 ipabaserid: 1000 ipasecondarybaserid: 100000 iparangetype: ipa-local cn: EXAMPLE.DE_subid_range ipabaseid: 2147483648 ipaidrangesize: 2147352576 ipabaserid: 2147283648 ipanttrusteddomainsid: S-1-5-21-738065-838566-194929194 iparangetype: ipa-ad-trust ---------------------------- Number of entries returned 3 ---------------------------- /var/log/messages shows Jan 23 13:50:28 ipa0 [6654]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) Jan 23 13:50:28 ipa0 [6653]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) Jan 23 13:50:31 ipa0 [6654]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) Jan 23 13:50:31 ipa0 [6653]: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) /var/log/krb5kdc.log Jan 23 13:50:28 ipa0.example.de krb5kdc[6611](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1706012763, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa0.example.de(a)EXAMPLE.DE for ldap/ipa0.example.de(a)EXAMPLE.DE, KDC policy rejects request Jan 23 13:50:28 ipa0.example.de krb5kdc[6611](info): ... CONSTRAINED-DELEGATION s4u-client=<unknown> Jan 23 13:50:28 ipa0.example.de krb5kdc[6611](info): closing down fd 4 Jan 23 13:50:28 ipa0.example.de krb5kdc[6611](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1706012763, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa0.example.de(a)EXAMPLE.DE for ldap/ipa0.example.de(a)EXAMPLE.DE, KDC policy rejects request Jan 23 13:50:28 ipa0.example.de krb5kdc[6611](info): ... CONSTRAINED-DELEGATION s4u-client=<unknown> Jan 23 13:50:28 ipa0.example.de krb5kdc[6611](info): closing down fd 4 Jan 23 13:50:30 ipa0.example.de krb5kdc[6611](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS(a)EXAMPLE.DE for krbtgt/EXAMPLE.DE(a)EXAMPLE.DE, Additional pre-authentication required Jan 23 13:50:30 ipa0.example.de krb5kdc[6611](info): closing down fd 4 Jan 23 13:50:31 ipa0.example.de krb5kdc[6587](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: ISSUE: authtime 1706014231, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, WELLKNOWN/ANONYMOUS(a)EXAMPLE.DE for krbtgt/EXAMPLE.DE(a)EXAMPLE.DE Jan 23 13:50:31 ipa0.example.de krb5kdc[6587](info): closing down fd 4 Jan 23 13:50:31 ipa0.example.de krb5kdc[6611](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: NEEDED_PREAUTH: hdunkel(a)EXAMPLE.DE for krbtgt/EXAMPLE.DE(a)EXAMPLE.DE, Additional pre-authentication required Jan 23 13:50:31 ipa0.example.de krb5kdc[6611](info): closing down fd 4 Jan 23 13:50:31 ipa0.example.de krb5kdc[6592](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: ISSUE: authtime 1706014231, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, hdunkel(a)EXAMPLE.DE for krbtgt/EXAMPLE.DE(a)EXAMPLE.DE Jan 23 13:50:31 ipa0.example.de krb5kdc[6592](info): closing down fd 4 Jan 23 13:50:31 ipa0.example.de krb5kdc[6588](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: ISSUE: authtime 1706014231, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, hdunkel(a)EXAMPLE.DE for HTTP/ipa0.example.de(a)EXAMPLE.DE Jan 23 13:50:31 ipa0.example.de krb5kdc[6588](info): closing down fd 4 Jan 23 13:50:31 ipa0.example.de krb5kdc[6587](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1706014231, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa0.example.de(a)EXAMPLE.DE for ldap/ipa0.example.de(a)EXAMPLE.DE, KDC policy rejects request Jan 23 13:50:31 ipa0.example.de krb5kdc[6587](info): ... CONSTRAINED-DELEGATION s4u-client=<unknown> Jan 23 13:50:31 ipa0.example.de krb5kdc[6587](info): closing down fd 4 Jan 23 13:50:31 ipa0.example.de krb5kdc[6588](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.19.96.2: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1706014231, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa0.example.de(a)EXAMPLE.DE for ldap/ipa0.example.de(a)EXAMPLE.DE, KDC policy rejects request Jan 23 13:50:31 ipa0.example.de krb5kdc[6588](info): ... CONSTRAINED-DELEGATION s4u-client=<unknown> Jan 23 13:50:31 ipa0.example.de krb5kdc[6588](info): closing down fd 4 Every helpful hint is highly appreciated. Harri

4 10

Is it possible to install FreeIPA on different disk than ('/')
by Finn Fysj 24 Jan '24

24 Jan '24

Currently our installation of FreeIPA is done on root ('/'). Is it possible to install FreeIPA on different disk & mount path wihtout causing too much issues?

3 2

Re: FreeIPA or RHEL IdM with Amazon Cognito
by Alexander Bokovoy 24 Jan '24

24 Jan '24

On Срд, 24 сту 2024, Carlos Lopez via FreeIPA-users wrote: >Hi all, > >I need to integrate authentication and role access for a few users >between Amazon Cognito and FreeIPA/IdM. The idea is that the user logs >in with Cognito but the access validation, password changes, roles, >etc. are hosted in FreeIPA. The resources where users login are outside >of Amazon (for example our internal password management app). Is this >possible? Could it be an option to use SAML? IPA can delegate authentication (actually, authorization as in OAuth2 Device Authorization Grant Flow) to an external IdP provider. Amazon Cognito does not have support for OAuth2 Device Authorization Grant flow but one can create a separate flow integrated with Cognito: https://aws.amazon.com/blogs/security/implement-oauth-2-0-device-grant-flow… See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… for RHEL IdM documentation. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

FreeIPA or RHEL IdM with Amazon Cognito
by Carlos Lopez 24 Jan '24

24 Jan '24

Hi all, I need to integrate authentication and role access for a few users between Amazon Cognito and FreeIPA/IdM. The idea is that the user logs in with Cognito but the access validation, password changes, roles, etc. are hosted in FreeIPA. The resources where users login are outside of Amazon (for example our internal password management app). Is this possible? Could it be an option to use SAML? Thanks. Best regards, C. L. Martinez

1 0

Different ID ranges cannot login to samba
by Rui Gomes 24 Jan '24

24 Jan '24

Hello Everyone, We are experiencing a strange error, where we have 2 ID ranges. The default one always worked well with samba, we have add a second ID range that works perfectly for everything but no user in that range can login to samba. All the users in the default ID range can authenticate with samba, but no user on a lower ID 5000-10000 manage to authenticate, no obvious errors in the logs. Does this ring any bells, we have tried to force samba ID range made no difference. Regards RG

2 1

Can't login to IPA
by Bogdan Stoica 24 Jan '24

24 Jan '24

After upgrading ipa to the latest version, login to webui is no longer working I'm using Rocky Linux 8.9 and these are the IPA installed packages: [root@ipa02 dnssec]# rpm -qa | grep ipa ipa-server-4.9.12-11.module+el8.9.0+1652+4ee71f6a.x86_64 ipa-server-common-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch libipa_hbac-2.9.1-4.el8_9.x86_64 ipa-client-common-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch ipa-client-4.9.12-11.module+el8.9.0+1652+4ee71f6a.x86_64 python3-libipa_hbac-2.9.1-4.el8_9.x86_64 sssd-ipa-2.9.1-4.el8_9.x86_64 ipa-common-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch python3-ipaclient-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch ipa-server-dns-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch rocky-logos-ipa-86.3-1.el8.noarch ipa-healthcheck-0.12-3.module+el8.9.0+1434+912e18bd.noarch python3-ipalib-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch ipa-healthcheck-core-0.12-3.module+el8.9.0+1434+912e18bd.noarch python3-ipaserver-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch ipa-selinux-4.9.12-11.module+el8.9.0+1652+4ee71f6a.noarch When trying to run this command (as some users suggested): ipa config-mod --enable-sid --add-sids I'm getting this: ipa: ERROR: cannot connect to 'https://ipa02.shtar.prod1/ipa/session/json': Exceeded number of tries to forward a request.

2 1

Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working
by Alexander Bokovoy 24 Jan '24

24 Jan '24

On Аўт, 23 сту 2024, Dungan, Scott A. via FreeIPA-users wrote: >I found the answer in this thread: > >https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > >Following that, we used ldapmodify to apply the correct values for the >rid-base and secondary-rid-base in the new range. Afterwards, running > >ipa config-mod --enable-sid --add-sids > >completed, and all users have been assigned sids, although the logs >show a few errors about sids already being used: > >Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.671583872 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101000116] is already used. >Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.672837572 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101000115] is already used. >Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.683585571 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101029028] is already used. >Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.703869107 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101029021] is already used. >Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.743343711 -0800] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [0] > >Not sure if we should be concerned about that or not. Since it doesn't say 'Secondary SID is used as well.', this means a first choice for that SID was not successful and sidgen plugin switched to a RID from the secondary RID base. It should be fine in the end -- a user/group got a unique SID assigned. > >-Scott > >From: Dungan, Scott A. via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> >Sent: Tuesday, January 23, 2024 8:05 AM >To: Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> >Cc: Dungan, Scott A. <sdungan(a)caltech.edu> >Subject: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working > >Thanks, Flo. > >I believe we now know what the correct values should be for the rid-base and secondary-rid-base, however, we can’t seem to modify the ID range with the missing values we created to cover the legacy NIS users: > >$ ipa idrange-mod ID.EXAMPLE.COM_legacy_range >ipa: ERROR: This command can not be used to change ID allocation for local IPA domain. Run `ipa help idrange` for more information > >Nor can we simply delete the range and try again: > >ipa idrange-del ID.EXAMPLE.COM_legacy_range >ipa: ERROR: invalid 'ipabaseid,ipaidrangesize': range modification leaving objects with ID out of the defined range is not allowed > >It seems that we are in a chicken or the egg bind here. Below is the output of iprange-find for reference. > >---------------- >3 ranges matched >---------------- > Range name: ID.EXAMPLE.COM _id_range > First Posix ID of the range: 866800000 > Number of IDs in the range: 200000 > First RID of the corresponding RID range: 1000 > First RID of the secondary RID range: 100000000 > Range type: local domain range > > Range name: ID.EXAMPLE.COM _legacy_range > First Posix ID of the range: 1000 > Number of IDs in the range: 98899 > Range type: local domain range > > Range name: ID.EXAMPLE.COM _subid_range > First Posix ID of the range: 2147483648 > Number of IDs in the range: 2147352576 > First RID of the corresponding RID range: 2147283648 > Domain SID of the trusted domain: S-1-5-21-538032-778436-45698521293 > Range type: Active Directory domain range >---------------------------- >Number of entries returned 3 >---------------------------- > >From: Florence Blanc-Renaud <flo(a)redhat.com<mailto:flo@redhat.com>> >Sent: Monday, January 22, 2024 11:50 PM >To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> >Cc: Dungan, Scott A. <sdungan(a)caltech.edu<mailto:sdungan@caltech.edu>> >Subject: Re: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working > >Hi, > >On Tue, Jan 23, 2024 at 1:05 AM Dungan, Scott A. via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: >Thanks to Paul for all the leg work on this issue. Based on that, I can confirm that we have the same problem after updating to 4.9.12-11 from 4.9.11-7. Running the oddjob command to add SIDs to the user accounts fails after encountering UIDs outside of the default IPA range. It was able to get the admin account working though. We have 294 users with UIDs in the range of 1001 to 99657. These were migrated from an ancient NIS domain when the IPA domain was provisioned. We tried adding a secondary IPA range that covers that scope: > >ipa idrange-add ID.EXAMPLE.COM_legacy_range --base-id=1000 --range-size=98899 > >And then running the oddjob command again, but we get the sidgen errors still, plus a error about overlapping rid ranges: > >[22/Jan/2024:15:09:50.398460268 -0800] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... >[22/Jan/2024:15:09:50.499604871 -0800] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [29034] into an unused SID. >[22/Jan/2024:15:09:50.499960197 -0800] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. >[22/Jan/2024:15:09:50.503257753 -0800] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. >[22/Jan/2024:15:09:55.035779436 -0800] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=id,dc=example,dc=com >[22/Jan/2024:15:09:55.036238563 -0800] - ERR - schema-compat-plugin - Finished plugin initialization. >[22/Jan/2024:15:47:04.969286883 -0800] - ERR - ipa_range_check_pre_op - [file ipa_range_check.c, line 670]: New primary rid range overlaps with existing primary rid range. > >I suspect that we may not have added the range correctly. We didn't pass the --rid-base= or --secondary-rid-base= flags/values as we were not sure what these values should be. > >These values are important in order to generate the SIDs. Please read The role of security and relative identifiers in IdM ID ranges<https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht…> and Security Identifiers<https://freeipa.readthedocs.io/en/latest/designs/id-mapping.html#security-i…> to understand how they are used. You need to pick values that do not conflict with the ones for your initial range. > >flo > >Any help would be much appreciated. > >Scott > >-----Original Message----- >From: Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> >Sent: Thursday, January 18, 2024 11:25 AM >To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> >Cc: Paul Nickerson <pgn674(a)gmail.com<mailto:pgn674@gmail.com>>; Rob Crittenden <rcritten(a)redhat.com<mailto:rcritten@redhat.com>> >Subject: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working > >Paul Nickerson via FreeIPA-users wrote: >> I confirmed that users who had an ipaNTSecurityIdentifier attribute could log in to the web UI, and those that did not have the ipaNTSecurityIdentifier attribute could not. >> >> I found the error in /var/log/dirsrv/slapd-SEMI-EXAMPLE-NET/errors like you said: >> [17/Jan/2024:20:28:09.571195828 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... >> [17/Jan/2024:20:28:09.637675948 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [1566000023] into an unused SID. >> [17/Jan/2024:20:28:09.658369523 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. >> [17/Jan/2024:20:28:09.666726494 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. >> >> I found some nice documentation at >> https://access.redhat.com/solutions/394763 >> >> I used this command to see the ranges that I have configured: >> ipa idrange-find >> >> And these two commands to see the UIDs of the users who had not yet been given SIDs (some were inside the existing range; I think you're correct that the process stops at the first error): >> ldapsearch -H ldap://ipa01.semi.example.net:389/<http://ipa01.semi.example.net:389/> -x -D "cn=Directory >> Manager" -W -b "cn=users,cn=accounts,dc=semi,dc=example,dc=net" >> "(!(ipaNTSecurityIdentifier=*))" uidNumber | grep uidNumber | grep -v >> "# requesting: " | sed 's/uidNumber: //' | sort -n ldapsearch -H >> ldap://ipa01.semi.example.net:389/<http://ipa01.semi.example.net:389/> -x -D "cn=Directory Manager" -W -b >> "cn=deleted >> users,cn=accounts,cn=provisioning,dc=semi,dc=example,dc=net" >> "(!(ipaNTSecurityIdentifier=*))" uidNumber | grep uidNumber | grep -v >> "# requesting: " | sed 's/uidNumber: //' | sort -n >> >> Here's some documentation on what ID and RID ranges are for: >> https://www.freeipa.org/page/V3/ID_Ranges >> >> After doing a bunch of math and guess and check, I ran this: >> ipa idrange-add SEMI.EXAMPLE.NET_US150777_range --base-id=1441400000 >> --range-size=531251000 --rid-base=101000000 >> --secondary-rid-base=633000000 >> >> That gave me an additional range (confirmed with ipa idrange-find). I >> ran ipa config-mod --enable-sid --add-sids again, saw no significant >> errors in /var/log/dirsrv/slapd-SEMI-EXAMPLE-NET/errors, and >> confirmed that there were 0 users left with no >> ipaNTSecurityIdentifier. >> >> All users are all set now. Thank you again. > >Glad to hear it and thank you for your detailed analysis. I think this >will be useful to other users that may run into this. > >rob >-- >_______________________________________________ >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> >To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> >Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue >-- >_______________________________________________ >FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> >To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> >Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working
by Dungan, Scott A. 23 Jan '24

23 Jan '24

I found the answer in this thread: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Following that, we used ldapmodify to apply the correct values for the rid-base and secondary-rid-base in the new range. Afterwards, running ipa config-mod --enable-sid --add-sids completed, and all users have been assigned sids, although the logs show a few errors about sids already being used: Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.671583872 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101000116] is already used. Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.672837572 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101000115] is already used. Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.683585571 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101029028] is already used. Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.703869107 -0800] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-437482216-426791213-2761072236-101029021] is already used. Jan 23 10:10:47 idm1.example.com ns-slapd[52294]: [23/Jan/2024:10:10:47.743343711 -0800] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [0] Not sure if we should be concerned about that or not. -Scott From: Dungan, Scott A. via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Tuesday, January 23, 2024 8:05 AM To: Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Dungan, Scott A. <sdungan(a)caltech.edu> Subject: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working Thanks, Flo. I believe we now know what the correct values should be for the rid-base and secondary-rid-base, however, we can’t seem to modify the ID range with the missing values we created to cover the legacy NIS users: $ ipa idrange-mod ID.EXAMPLE.COM_legacy_range ipa: ERROR: This command can not be used to change ID allocation for local IPA domain. Run `ipa help idrange` for more information Nor can we simply delete the range and try again: ipa idrange-del ID.EXAMPLE.COM_legacy_range ipa: ERROR: invalid 'ipabaseid,ipaidrangesize': range modification leaving objects with ID out of the defined range is not allowed It seems that we are in a chicken or the egg bind here. Below is the output of iprange-find for reference. ---------------- 3 ranges matched ---------------- Range name: ID.EXAMPLE.COM _id_range First Posix ID of the range: 866800000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range Range name: ID.EXAMPLE.COM _legacy_range First Posix ID of the range: 1000 Number of IDs in the range: 98899 Range type: local domain range Range name: ID.EXAMPLE.COM _subid_range First Posix ID of the range: 2147483648 Number of IDs in the range: 2147352576 First RID of the corresponding RID range: 2147283648 Domain SID of the trusted domain: S-1-5-21-538032-778436-45698521293 Range type: Active Directory domain range ---------------------------- Number of entries returned 3 ---------------------------- From: Florence Blanc-Renaud <flo(a)redhat.com<mailto:flo@redhat.com>> Sent: Monday, January 22, 2024 11:50 PM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Dungan, Scott A. <sdungan(a)caltech.edu<mailto:sdungan@caltech.edu>> Subject: Re: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working Hi, On Tue, Jan 23, 2024 at 1:05 AM Dungan, Scott A. via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: Thanks to Paul for all the leg work on this issue. Based on that, I can confirm that we have the same problem after updating to 4.9.12-11 from 4.9.11-7. Running the oddjob command to add SIDs to the user accounts fails after encountering UIDs outside of the default IPA range. It was able to get the admin account working though. We have 294 users with UIDs in the range of 1001 to 99657. These were migrated from an ancient NIS domain when the IPA domain was provisioned. We tried adding a secondary IPA range that covers that scope: ipa idrange-add ID.EXAMPLE.COM_legacy_range --base-id=1000 --range-size=98899 And then running the oddjob command again, but we get the sidgen errors still, plus a error about overlapping rid ranges: [22/Jan/2024:15:09:50.398460268 -0800] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... [22/Jan/2024:15:09:50.499604871 -0800] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [29034] into an unused SID. [22/Jan/2024:15:09:50.499960197 -0800] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. [22/Jan/2024:15:09:50.503257753 -0800] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. [22/Jan/2024:15:09:55.035779436 -0800] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=id,dc=example,dc=com [22/Jan/2024:15:09:55.036238563 -0800] - ERR - schema-compat-plugin - Finished plugin initialization. [22/Jan/2024:15:47:04.969286883 -0800] - ERR - ipa_range_check_pre_op - [file ipa_range_check.c, line 670]: New primary rid range overlaps with existing primary rid range. I suspect that we may not have added the range correctly. We didn't pass the --rid-base= or --secondary-rid-base= flags/values as we were not sure what these values should be. These values are important in order to generate the SIDs. Please read The role of security and relative identifiers in IdM ID ranges<https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht…> and Security Identifiers<https://freeipa.readthedocs.io/en/latest/designs/id-mapping.html#security-i…> to understand how they are used. You need to pick values that do not conflict with the ones for your initial range. flo Any help would be much appreciated. Scott -----Original Message----- From: Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Sent: Thursday, January 18, 2024 11:25 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: Paul Nickerson <pgn674(a)gmail.com<mailto:pgn674@gmail.com>>; Rob Crittenden <rcritten(a)redhat.com<mailto:rcritten@redhat.com>> Subject: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working Paul Nickerson via FreeIPA-users wrote: > I confirmed that users who had an ipaNTSecurityIdentifier attribute could log in to the web UI, and those that did not have the ipaNTSecurityIdentifier attribute could not. > > I found the error in /var/log/dirsrv/slapd-SEMI-EXAMPLE-NET/errors like you said: > [17/Jan/2024:20:28:09.571195828 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... > [17/Jan/2024:20:28:09.637675948 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [1566000023] into an unused SID. > [17/Jan/2024:20:28:09.658369523 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. > [17/Jan/2024:20:28:09.666726494 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. > > I found some nice documentation at > https://access.redhat.com/solutions/394763 > > I used this command to see the ranges that I have configured: > ipa idrange-find > > And these two commands to see the UIDs of the users who had not yet been given SIDs (some were inside the existing range; I think you're correct that the process stops at the first error): > ldapsearch -H ldap://ipa01.semi.example.net:389/<http://ipa01.semi.example.net:389/> -x -D "cn=Directory > Manager" -W -b "cn=users,cn=accounts,dc=semi,dc=example,dc=net" > "(!(ipaNTSecurityIdentifier=*))" uidNumber | grep uidNumber | grep -v > "# requesting: " | sed 's/uidNumber: //' | sort -n ldapsearch -H > ldap://ipa01.semi.example.net:389/<http://ipa01.semi.example.net:389/> -x -D "cn=Directory Manager" -W -b > "cn=deleted > users,cn=accounts,cn=provisioning,dc=semi,dc=example,dc=net" > "(!(ipaNTSecurityIdentifier=*))" uidNumber | grep uidNumber | grep -v > "# requesting: " | sed 's/uidNumber: //' | sort -n > > Here's some documentation on what ID and RID ranges are for: > https://www.freeipa.org/page/V3/ID_Ranges > > After doing a bunch of math and guess and check, I ran this: > ipa idrange-add SEMI.EXAMPLE.NET_US150777_range --base-id=1441400000 > --range-size=531251000 --rid-base=101000000 > --secondary-rid-base=633000000 > > That gave me an additional range (confirmed with ipa idrange-find). I ran ipa config-mod --enable-sid --add-sids again, saw no significant errors in /var/log/dirsrv/slapd-SEMI-EXAMPLE-NET/errors, and confirmed that there were 0 users left with no ipaNTSecurityIdentifier. > > All users are all set now. Thank you again. Glad to hear it and thank you for your detailed analysis. I think this will be useful to other users that may run into this. rob -- _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue -- _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 0

Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working
by Florence Blanc-Renaud 23 Jan '24

23 Jan '24

Hi, On Tue, Jan 23, 2024 at 1:05 AM Dungan, Scott A. via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > Thanks to Paul for all the leg work on this issue. Based on that, I can > confirm that we have the same problem after updating to 4.9.12-11 from > 4.9.11-7. Running the oddjob command to add SIDs to the user accounts fails > after encountering UIDs outside of the default IPA range. It was able to > get the admin account working though. We have 294 users with UIDs in the > range of 1001 to 99657. These were migrated from an ancient NIS domain when > the IPA domain was provisioned. We tried adding a secondary IPA range that > covers that scope: > > ipa idrange-add ID.EXAMPLE.COM_legacy_range --base-id=1000 > --range-size=98899 > > And then running the oddjob command again, but we get the sidgen errors > still, plus a error about overlapping rid ranges: > > [22/Jan/2024:15:09:50.398460268 -0800] - ERR - sidgen_task_thread - [file > ipa_sidgen_task.c, line 194]: Sidgen task starts ... > [22/Jan/2024:15:09:50.499604871 -0800] - ERR - find_sid_for_ldap_entry - > [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [29034] into > an unused SID. > [22/Jan/2024:15:09:50.499960197 -0800] - ERR - do_work - [file > ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. > [22/Jan/2024:15:09:50.503257753 -0800] - ERR - sidgen_task_thread - [file > ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. > [22/Jan/2024:15:09:55.035779436 -0800] - ERR - schema-compat-plugin - > warning: no entries set up under cn=computers, > cn=compat,dc=id,dc=example,dc=com > [22/Jan/2024:15:09:55.036238563 -0800] - ERR - schema-compat-plugin - > Finished plugin initialization. > [22/Jan/2024:15:47:04.969286883 -0800] - ERR - ipa_range_check_pre_op - > [file ipa_range_check.c, line 670]: New primary rid range overlaps with > existing primary rid range. > > I suspect that we may not have added the range correctly. We didn't pass > the --rid-base= or --secondary-rid-base= flags/values as we were not sure > what these values should be. > These values are important in order to generate the SIDs. Please read The role of security and relative identifiers in IdM ID ranges <https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht…> and Security Identifiers <https://freeipa.readthedocs.io/en/latest/designs/id-mapping.html#security-i…> to understand how they are used. You need to pick values that do not conflict with the ones for your initial range. flo > > Any help would be much appreciated. > > Scott > > -----Original Message----- > From: Rob Crittenden via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> > Sent: Thursday, January 18, 2024 11:25 AM > To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > Cc: Paul Nickerson <pgn674(a)gmail.com>; Rob Crittenden <rcritten(a)redhat.com > > > Subject: [Freeipa-users] Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused > web UI login and ipa command to stop working > > Paul Nickerson via FreeIPA-users wrote: > > I confirmed that users who had an ipaNTSecurityIdentifier attribute > could log in to the web UI, and those that did not have the > ipaNTSecurityIdentifier attribute could not. > > > > I found the error in /var/log/dirsrv/slapd-SEMI-EXAMPLE-NET/errors like > you said: > > [17/Jan/2024:20:28:09.571195828 +0000] - ERR - sidgen_task_thread - > [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... > > [17/Jan/2024:20:28:09.637675948 +0000] - ERR - find_sid_for_ldap_entry - > [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [1566000023] > into an unused SID. > > [17/Jan/2024:20:28:09.658369523 +0000] - ERR - do_work - [file > ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. > > [17/Jan/2024:20:28:09.666726494 +0000] - ERR - sidgen_task_thread - > [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. > > > > I found some nice documentation at > > https://access.redhat.com/solutions/394763 > > > > I used this command to see the ranges that I have configured: > > ipa idrange-find > > > > And these two commands to see the UIDs of the users who had not yet been > given SIDs (some were inside the existing range; I think you're correct > that the process stops at the first error): > > ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory > > Manager" -W -b "cn=users,cn=accounts,dc=semi,dc=example,dc=net" > > "(!(ipaNTSecurityIdentifier=*))" uidNumber | grep uidNumber | grep -v > > "# requesting: " | sed 's/uidNumber: //' | sort -n ldapsearch -H > > ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W -b > > "cn=deleted > > users,cn=accounts,cn=provisioning,dc=semi,dc=example,dc=net" > > "(!(ipaNTSecurityIdentifier=*))" uidNumber | grep uidNumber | grep -v > > "# requesting: " | sed 's/uidNumber: //' | sort -n > > > > Here's some documentation on what ID and RID ranges are for: > > https://www.freeipa.org/page/V3/ID_Ranges > > > > After doing a bunch of math and guess and check, I ran this: > > ipa idrange-add SEMI.EXAMPLE.NET_US150777_range --base-id=1441400000 > > --range-size=531251000 --rid-base=101000000 > > --secondary-rid-base=633000000 > > > > That gave me an additional range (confirmed with ipa idrange-find). I > ran ipa config-mod --enable-sid --add-sids again, saw no significant errors > in /var/log/dirsrv/slapd-SEMI-EXAMPLE-NET/errors, and confirmed that there > were 0 users left with no ipaNTSecurityIdentifier. > > > > All users are all set now. Thank you again. > > Glad to hear it and thank you for your detailed analysis. I think this > will be useful to other users that may run into this. > > rob > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

2 1

Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working
by Paul Nickerson 23 Jan '24

23 Jan '24

I have two FreeIPA servers in a cluster, both running on RHEL 8.9. They started on RHEL 8.0 I believe, and have been upgrading in-place since then. I recently restarted the FreeIPA services, which triggered an ipa-server-upgrade to upgrade from 4.9.11 to 4.9.12. When that ran, it errored out on some expired certificates, which I fixed with ipa-cert-fix, and then the ipa-server-upgrade's finished successfully. Now, when I or any of my users try to log on to the web UI, we get the error "Your session has expired. Please log in again." Also, when I try to run any ipa command on the command line, I get the error: ipa: ERROR: cannot connect to 'any of the configured servers': https://ipa01.semi.example.net/ipa/session/json, https://ipa02.semi.example.net/ipa/session/json I've traced down lots of errors, and I think this one is the most relevant: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) I see it in /var/log/httpd/error_log, in the body of the HTTP response from https://ipa01.semi.example.net/ipa/session/json in my web browser, and in the output from the command ipa --debug Also, in /var/log/krb5kdc.log, I see: Jan 17 01:14:47 ipa01.semi.example.net krb5kdc[55855](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 172.16.121.5: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime 1705454084, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa01.semi.example.net(a)SEMI.EXAMPLE.NET for ldap/ipa01.semi.example.net(a)SEMI.EXAMPLE.NET, KDC policy rejects request I have krb5 1.18.2 installed. disable_pac is not present in /var/kerberos/krb5kdc/kdc.conf. I think I'm experiencing the same issue seen in the recent thread at https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… (subject line "api authorization stopped working after upgrade to 4.9.12-11 on RHEL8"). I don't think any of my users or groups have an SID (ipantsecurityidentifier). This FreeIPA cluster was installed on RHEL 8.0 (or thereabouts), and the servers have been upgraded in-place since then. We've never integrated with any Active Directory or Microsoft product. This command has no output, showing that even the admin user does not have an SID: ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W -b cn=users,cn=accounts,dc=semi,dc=example,dc=net uid=admin '*' + | grep -i ipantsecurityidentifier The solution from the other thread, and from https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht…, does not work for me, since the ipa command doesn't work, not even for the admin user: [root(a)ipa01.semi.example.net ~] # kinit admin Password for admin(a)SEMI.EXAMPLE.NET: [root(a)ipa01.semi.example.net ~] # ipa config-mod --enable-sid --add-sids ipa: ERROR: cannot connect to 'any of the configured servers': https://ipa01.semi.example.net/ipa/json, https://ipa02.semi.example.net/ipa/json I found an alternative method at https://freeipa.readthedocs.io/en/latest/designs/adtrust/sidconfig.html#tro…, but this also does not work for me: [root(a)ipa01.semi.example.net ~] # ldapmodify -H ldapi://%2Frun%2Fslapd-SEMI-EXAMPLE-NET.socket -f /tmp/ipa-sidgen-task-run.ldif SASL/GSSAPI authentication started SASL username: admin(a)SEMI.EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. adding new entry "cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config" ldap_add: No such object (32) I think ipa-sidgen-task does not exist in my LDAP directory, but I'm not sure if I understand how this is supposed to work. I don't see ipa-sidgen-task or anything like it from this search: ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W -b cn=config | grep cn=tasks Can anyone help me here? I think if I could get a ipantsecurityidentifier attribute properly set up on my user or on the admin user, then I would be able to use the ipa command to get SID's enabled and created everywhere.

4 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024