February 2024 - FreeIPA-users - Fedora Mailing-Lists

by kt s

when I login in with administrator, I got an error "Kerberos principal expiration". I can't login in now ,so how to change Kerberos principal time.

4 months

2
1
0 / 0

Kerberos principal expiration

by kt s

when I login in with administrator, I got an error "Kerberos principal expiration". I can't login in now ,so how to change Kerberos principal time.

4 months

1
0
0 / 0

Cannot create users on platform migration: sambaSID failure

by Melissa Ferreira da Silva Boiko

Hi, I'm trying to upgrade an ancient master replica (the CA master) running FreeIPA 4.5 on CentOS 7.4. Upgrading the freeipa packages in-place (in a cloned VM) caused numerous problems so I'm trying to create a new master replica on a fresh Fedora 39, using the "Migrating to different platform or OS" procedure described on https://www.freeipa.org/page/Howto/Migration At first sight the new replica appears to work, but user creation fails, both on the web and command-line, with: ipa user-add --first=Testy --last=McTestface teste123 ipa: ERROR: missing attribute "sambaSID" required by object class "sambaSamAccount" Web searches seem to suggest this is due to a missing DNA plugin that should autogenerate the sambaSIDs, but I failed to find a guide on how to enable that plugin with current IPA (4.11). Should it be enabled automatically? Unless it's used for something internal to IPA I don't think we actually are even using AD integration or SMB shares, so removing Samba support altogether would also be an option, but I don't know what's the safe way of doing that to the schema either. Thanks for your help!

4 months

2
6
0 / 0

SSSD offline and AD authentication issues

by Heidi Hough

Hello, I'm unable to ssh as an AD user to a freeipa client. I am, however able to ssh as an AD user to a freeipa server. I can also ssh to a freeipa client AND server using a FreeIPA account. Our IPA domain (ipa.subdomain.contoso.com) is set up with a one-way trust with ad.contoso.com. Our AD is on the larger side with 400,000+ user accounts. An ldbsearch on the client cache file returns 42 records, the same search on the server cache returns 113551 records. Searching for a specific user; ldbsearch -H /var/lib/sss/db/cache_ipa.subdomain.contoso.com.ldb '(name=heidi-ad(a)ad.contoso.com)' returns zero records on the freeipa client and 1 record on the freeipa server. Dig commands (dig -t SRV _ldap._tcp.ipa.subdomain.contoso.com and dig -t SRV _ldap._tcp.ad.contoso.com) also return expected results. server:sssd.conf https://privatebin.net/?42cff7bd431068d7#FmeM5p3R88U9oQd98UvoaVHZ3PzeZTGv... client:sssd.conf https://privatebin.net/?d4f20faca95236f4#D8WtjwDMaAB932W66YMgW5HtXkdfez1H... I'm not sure what to key in on in the SSSD logs to identify what's going wrong here and how to resolve it. I've attempted to fiddle with multiple timeout settings, but haven't identified the right ones. I do see SSSD is reported as offline and this very much feels like a communication issue. I have uploaded sanitized SSSD logs from rl9-ipa-client1.in.subdomain.contoso.com and freeipa2.ipa.subdomain.contoso.com for a failed login attempt at the following: https://privatebin.net/?1028b6754421174b#DDDuthsRbLjxt4rS1mr263MmJ2qjhLgL... Thanks, Heidi

4 months, 1 week

2
8
0 / 0

Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working

by Oliver Nixon

Hi, I'm encountering the same issue after upgrading to 4.9.12. I had previously imported users from another FreeIPA deployment and their UIDs were outside of the defined ID ranges. I've created a new ID range to encompass these and run the following but the SIDs still don't get generated: ]# /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --netbios-name DOMAIN-NAME --add-sids Configuring SID generation [1/8]: creating samba domain object Samba domain object already exists [2/8]: adding admin(group) SIDs Admin SID already set, nothing to do Admin group SID already set, nothing to do [3/8]: adding RID bases RID bases already set, nothing to do [4/8]: updating Kerberos config 'dns_lookup_kdc' already set to 'true', nothing to do. [5/8]: activating sidgen task Sidgen task plugin already configured, nothing to do [6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account [7/8]: adding fallback group Fallback group already set, nothing to do [8/8]: adding SIDs to existing users and groups This step may take considerable amount of time, please wait.. Done.

4 months, 1 week

5
8
0 / 0

Requiring OTP thru PAM+LDAP

by G H

I am using SSSD in LDAP-only mode (no kerberos at all), communicating with FreeIPA. For certain hosts, I want to require sssd to demand OTP. Right now, they are allowing password OR password+OTP. But my 'ipa show-host' output for the hosts in question have "Authentication Indicators: otp". What do I need to do for sssd to only accept password+OTP ? Thank you.

4 months, 1 week

2
3
0 / 0

setup trusted Realm between two freeIPAs

by Farshad Allahdadi

Hi, I'm going to transfer data between two Hadoop clusters kerberizd/joined to separate freeIPAs using distcp. The distcp command or any tool requires to authenticate to both freeIPAs (grant permission to read from one server and write to other). My priority is to make the least possible changes to source cluster/freeIPA which is in production, so I tried to setup trusted real between these but failed, it seems that trusted realm is only possible (or documented) between AD and freeIPA. Is it possible to setup trusted Realm between two freeIPAs(and if yes how to)? What are the other options to do the job with less impact on source freeIPA? Also making freeIPAs to be replica for each other is not a good option for me, because i need to separate them later. Thanks in advance

4 months, 1 week

2
1
0 / 0

automount timeouts

by Steve Berg

Does IPA do anything to set a timeout on an nfs automount? I'm seeing some strange behavior on a few automounts and want to make sure I look in the right places to look up and/or set a timeout for those filesystems. -- //- Fixer of that which is broke -// //- Home = sberg(a)mississippi.com -// //- Sinners can repent, but stupid is forever. -//

4 months, 1 week

2
3
0 / 0

ldap bind user, getting "invalid credentials"

by slek kus

Hi, can't get an application to work with FreeIPA (4.10.2). Created a bind users as per manual (https://www.freeipa.org/page/HowTo/LDAP) but keep getting invalid creds. Created the user as below: ----- [root@idm01 log]# ldapmodify -x -D 'cn=Directory Manager' -W Enter LDAP Password: dn: uid=bndldapansibleforms,cn=sysaccounts,cn=etc,dc=linux,dc=bogus,dc=local changetype: add objectclass: account objectclass: simplesecurityobject uid: bndldapansibleforms userPassword: S3cr3t! passwordExpirationTime: 20380119031407Z nsIdleTimeout: 0 adding new entry "uid=bndldapansibleforms,cn=sysaccounts,cn=etc,dc=linux,dc=bogus,dc=local" ----- In the app I have: ----- Server: idm01.linux.bogus.local Port: 389 Search base: dc=linux,dc=bogus,dc=local Bind User distinguished name: bndldapansibleforms Bind User Password: S3cr3t! Username Attribute: sAMAccountName Groups Attribute: memberOf ----- Also tried with a normal user, but that prints the same invalid credentials error. How do I do this correctly? Cheers, slekkus.

4 months, 1 week

2
2
1 / 0

Re: reliability of external radius

by Alexander Bokovoy

On Пан, 12 лют 2024, Charles Hedrick via FreeIPA-users wrote: >Currently our department uses passwords in IPA, with a few users using >OTP. I'm considering using a University radius server for most users. >Are there reliability implications? My concern is what happens if the >radius server is slow to respond or even is down. I'd like users with >accounts in IPA to still work, and I'd hope things would survive >conditions of slow response. There is one potential issue that we fixed recently in MIT Kerberos: https://github.com/krb5/krb5/pull/1318 It is not yet part of any release. If you have RHEL subscription, making it known to RHEL support organization might help to get this fix out faster. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

4 months, 1 week

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2024