FreeIPA-users January 2024

freeipa-users@lists.fedorahosted.org

52 participants
68 discussions

Re: AD Trust with multiple replicas
by Anil Rathod 10 Jan '24

10 Jan '24

I have below Setup: AD domain: abc.com maste IPA: node1.idm.abc.com Replica: node2.idm.com Both nodes are Enabled server roles: AD trust agent, AD trust controller, CA server, IPA master Now, on client side, while client connected with node1, I am able to resolve the AD Users. but when I connect the client with node2, then AD user not able to resolve. * anil This message, together with any attachments, is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient(s), or the employee or agent responsible for delivery of this message to the intended recipient(s), you are hereby notified that any dissemination, distribution or copying of this message, or any attachment, is strictly prohibited. If you have received this message in error, please immediately notify the sender and delete the message, together with any attachments, from your computer. Thank you for your cooperation.

1 0

Re: Create IPA user via LDAP
by Rob Crittenden 08 Jan '24

08 Jan '24

Ronald Wimmer wrote: > On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >> On 02.01.24 16:27, Rob Crittenden wrote: >>> Ronald Wimmer via FreeIPA-users wrote: >>>> >>>> >>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>> In our company we do have an IAM tool for user management. We need to >>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>> commands or API calls to create/modify or delete a user. >>>>>> >>>>>> As the tool does not support FreeIPA yet they asked if there is a way >>>>>> to manage users by using LDAP only. Could that work? What about >>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>> >>>>> Learn about lifecycle management. This is your way of integrating with >>>>> such tools bvy creating staged users: >>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>> >>>>> >>>> >>>> I followed the instructions from the documentation. >>>> >>>> How could I possibly overcome >>>> >>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>> >>>> I need to set passwords from the external system. >>> >>> You need to enable migration mode (ipa config-mod --enable-migration >>> true). >>> >>> By default a pre-hashed password can only be set once: during the user >>> add operation. >> >> Ok. So this would not work for a password change. So if we need to set >> an initial password and change that particular password in some point >> in time the only feasible way is the IPA API, right? >> >> Can the immediate password expiration be overridden? > > As we have an upcoming please allow me to ask if I got the point here. > > I appreciate your support in this matter! I'd recommend you look into the winsync documentation in IPA. There is a setting you can configure to allow a pre-hashed password to be written without marking it as expired (because this is what winsync does). If you use Kerberos then users are going to have to migrate their password every time it changes on the external system. rob

2 2

Ignore authselect configuration
by Finn Fysj 04 Jan '24

04 Jan '24

Hi, First: is it possible to ignore the authselect configuration during FreeIPA server installation? Reason I'm asking is because we're hardening the OS before we run FreeIPA installation, meaning there have been issues with UMASK and authselect overwrite. FreeIPA installation does not support UMASK stricter than 022. The FreeIPA installation also changes our authselect configuration as we configure this as part of our OS hardening and setting the immutable flag on some of these config files. We don't want FreeIPA installation to configure the authselect. Unfortunately we haven't found anything in /usr/lib/python3.9/site-packages/ipaplatform/redhat/authconfig.py that let us do this. Is it possible to ignore this?

2 2

(no subject)
by Finn Fysj 03 Jan '24

03 Jan '24

> Finn Fysj via FreeIPA-users wrote: > > There is not currently. > > I guess I would suggest hardening after installing IPA. You're moving > into an untested/unsupported configuration so keep that in mind. There > be dragons. > > rob Thanks Rob. However, does that mean we can get surprises if we're so bold and configure e.g UMASK after IPA installation etc.?

2 1

krb5kdc: No such file or directory
by Roberto Cornacchia 03 Jan '24

03 Jan '24

Hi there, clients are having trouble with kerberos authentication: $ kinit -V user Using existing cache: xxxxxxxxxx:yyyyy Using principal: user(a)SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM> Password for user(a)SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM>: kinit: Generic error (see e-text) while getting initial credentials On the ipa server, /var/log/krb5kdc.log says: Dec 24 14:40:34 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) < <http://192.168.0.202/>IP>: NEEDED_PREAUTH: user(a)SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM> for krbtgt/SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM, Additional pre-authentication required Dec 24 14:40:34 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:51 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ : handle_authdata (2) Dec 24 14:40:51 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) < <http://192.168.0.202/>IP>: HANDLE_AUTHDATA: user <roberto(a)SUB.EXAMPLE.COM> @SUB.EXAMPLE.COM <roberto(a)SUB.EXAMPLE.COM> for krbtgt/ SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM, No such file or directory Dec 24 14:40:51 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19)}) < <http://192.168.0.16/>IP>: NEEDED_PREAUTH: ldap/ ipa01.sub.example.com(a)SUB.EXAMPLE.COM for krbtgt/ SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM, Additional pre-authentication required Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): AS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19)}) < <http://192.168.0.16/>IP>: ISSUE: authtime 1703425257, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, ldap/ipa01.sub.example.com(a)SUB.EXAMPLE.COM for krbtgt/SUB.EXAMPLE.COM(a)SUB.EXAMPLE.COM Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) < <http://192.168.0.16/>IP>: ISSUE: authtime 1703425257, etypes {rep=aes256-cts-hmac-sha1-96(18), tkt=aes256-cts-hmac-sha1-96(18), ses=aes256-cts-hmac-sha1-96(18)}, ldap/ipa01.sub.example.com(a)SUB.EXAMPLE.COM for ldap/ipa02.sub.example.com(a)SUB.EXAMPLE.COM Dec 24 14:40:57 ipa01.sub.example.com krb5kdc[3324](info): closing down fd 11 There are 2 ipa servers, ipa01 (Rocky 9.3, ipa 4.10.2) and ipa02 (Rock 9.1, ipa4.10.0), both with CA and DNS. ipa02 is CRL master. On both, ipa-healthcheck doesn't find any issue. Also: kinit fails from within ipa01, succeeds from within ipa02. The issue seems to be in ipa01, and I have already tried to reinstall it from scratch. One thing that is different is the version. Could you please help me figure out what's wrong? Best regards, Roberto

3 10

Certificate Revoking error in FreeIPA domain
by Albert Stoune 03 Jan '24

03 Jan '24

Hello! I encountered a problem when revoking a certificate: "IPA Error 4035: HTTPRequestError: Request failed with status 500: Non-2xx response from CA REST API: 500." First of all, I looked at the Apache logs in /var/log/httpd/accsess.log and found next error: [08/Dec/2023:13:27:39 +0300] "POST /ca/rest/agent/certs/10/revoke HTTP/1.1" 500 6504 Then, in /var/log/httpd/error_log: ipa: INFO: [jsonserver_session] admin(a)TEST.LOCAL: cert_revoke('10', revocation_reason='0', cacn='ipa', version='2.253'): HTTPRequestError And finally I found traceback, which looks like bug in DogTag logs in /var/log/pki/pki-tomcat/ca/debug.2023-12-08.log: 2023-12-08 13:27:39 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] INFO: LDAPSession: Retrieving cn=10,ou=certificateRepository, ou=ca,o=ipaca 2023-12-08 13:27:39 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-7] SEVERE: Servlet.service() for servlet [Resteasy] in context with path [/ca] threw exception org.jboss.resteasy.spi.UnhandledException: java.lang.NullPointerException: Cannot invoke "String.toLowerCase()" because "<parameter1>" is null at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:78) at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:222) at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:179) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:422) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:213) at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:228) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) at javax.servlet.http.HttpServlet.service(HttpServlet.java:764) at jdk.internal.reflect.GeneratedMethodAccessor42.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280) at java.base/java.security.AccessController.doPrivileged(AccessController.java:712) at java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:584) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:221) at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145) at java.base/java.security.AccessController.doPrivileged(AccessController.java:569) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at jdk.internal.reflect.GeneratedMethodAccessor41.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280) at java.base/java.security.AccessController.doPrivileged(AccessController.java:712) at java.base/javax.security.auth.Subject.doAsPrivileged(Subject.java:584) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311) at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187) at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145) at java.base/java.security.AccessController.doPrivileged(AccessController.java:569) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:660) at com.netscape.cms.tomcat.ExternalAuthenticationValve.invoke(ExternalAuthenticationValve.java:83) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.rewrite.RewriteValve.invoke(RewriteValve.java:555) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360) at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:433) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:833) Caused by: java.lang.NullPointerException: Cannot invoke "String.toLowerCase()" because "<parameter1>" is null at org.mozilla.jss.netscape.security.x509.RevocationReason.valueOf(RevocationReason.java:91) at org.dogtagpki.server.ca.rest.CertService.revokeCert(CertService.java:180) at org.dogtagpki.server.ca.rest.CertService.revokeCert(CertService.java:162) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140) at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249) at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:236) at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:406) ... 49 more It looks like internal mechanisms in DogTag can't parse some arguments from LDAP-response. When I'm check similar request to LDAP with ldapsearch I got response with certificate details. Looks like all correct in LDAP. Additional info for debug: command "ipactl status" shows like everything is good Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful Also, I can create new certificates, but can't delete already signed. And also I can't delete Services with signed certs, and can't delete Hosts with that Services FreeIPA version: VERSION: 4.11.0, API_VERSION: 2.253

4 16

Create IPA user via LDAP
by Ronald Wimmer 02 Jan '24

02 Jan '24

In our company we do have an IAM tool for user management. We need to create IPA users via this particular tool. I am aware of all IPA commands or API calls to create/modify or delete a user. As the tool does not support FreeIPA yet they asked if there is a way to manage users by using LDAP only. Could that work? What about attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber?

3 10

Can we go for replica installation without using 80 port instead only using 443 port
by Polavarapu Manideep Sai 02 Jan '24

02 Jan '24

Hi Team, Can we install IPA replica without using 80 port instead only using 443 port? Is it possible ? If it is possible how can we achieve this ? [using port forwarding ? or any configuration changes?] If it is not possible, why ? Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024