FreeIPA-users March 2024

freeipa-users@lists.fedorahosted.org

32 participants
52 discussions

problem allowing Windows Active Directory users to access SMB shares on IPA client machine (IPA has trust with AD)
by Thomas Handler 01 Mar '24

01 Mar '24

Hi all, I am facing a problem I got stuck upon. We have the following setup: +-----------+ | | | AD | | | +-----------+ +--------------+ ^ | +----------+ | ums012 | | | | IPA | +--------------+ ^ | +--------------+ | | | | | ums029 | | | | | | smbclient | | +---+----------+ +------+--------+ | | | | | ums025 | | | |<------------------+ | samba | +---------------+ IPA has a trust established with AD which is working fine. Active Directory users can logon on Linux machines which are connected to IPA, `id some-ad-user` properly shows the AD groups. ums012 and ums025 are running RHEL 9.3, ums029 is running RHEL 8.9. ums029 is used as a test client via smbclient. ums025 was setup following the instructions in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… Setup worked fine, all steps went ok. But when i switch over to ums029 and try to verify with an ad user I get kinit <ad user> smbclient -L ums025.idm.example.com -U <ad user> --use-kerberos=required Password for [<ad user>@EXAMPLE.COM]: gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/ums025.idm.example.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER session setup failed: NT_STATUS_INVALID_PARAMETER whereas this is working fine when running the verification as IPA user. I tried finding hints in the logs but was unsuccessful, thus I’m writing to the list. Best regards, Thomas

2 5

ipa: ERROR: No valid Negotiate header in server response
by Grant Janssen 01 Mar '24

01 Mar '24

It appears I have resolved my certificate expiration issue<https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… But I have a another issue grant@ef-idm01:~[20240229-10:11][#772]$ klist Ticket cache: KCM:555 Default principal: grant(a)PRODUCTION.EFILM.COM<mailto:grant@PRODUCTION.EFILM.COM> Valid starting Expires Service principal 02/29/2024 10:11:56 03/01/2024 09:42:34 krbtgt/PRODUCTION.EFILM.COM(a)PRODUCTION.EFILM.COM<mailto:krbtgt/PRODUCTION.EFILM.COM@PRODUCTION.EFILM.COM> grant@ef-idm01:~[20240229-10:12][#773]$ ipa user-find roland ipa: ERROR: No valid Negotiate header in server response grant@ef-idm01:~[20240229-10:12][#774]$ ipa server-find ipa: ERROR: No valid Negotiate header in server response grant@ef-idm01:~[20240229-10:18][#775]$ sudo systemctl status gssproxy.service [sudo] password for grant: ● gssproxy.service - GSSAPI Proxy Daemon Loaded: loaded (/usr/lib/systemd/system/gssproxy.service; disabled; vendor preset: disabled) Active: active (running) since Tue 2024-02-20 13:57:40 PST; 1 weeks 1 days ago Process: 2158008 ExecStart=/usr/sbin/gssproxy -D (code=exited, status=0/SUCCESS) Main PID: 2158009 (gssproxy) Tasks: 6 (limit: 74714) Memory: 10.5M CGroup: /system.slice/gssproxy.service └─2158009 /usr/sbin/gssproxy -D Feb 20 13:57:40 ef-idm01.production.efilm.com<http://ef-idm01.production.efilm.com> systemd[1]: gssproxy.service: Succeeded. Feb 20 13:57:40 ef-idm01.production.efilm.com<http://ef-idm01.production.efilm.com> systemd[1]: Stopped GSSAPI Proxy Daemon. Feb 20 13:57:40 ef-idm01.production.efilm.com<http://ef-idm01.production.efilm.com> systemd[1]: Starting GSSAPI Proxy Daemon... Feb 20 13:57:40 ef-idm01.production.efilm.com<http://ef-idm01.production.efilm.com> systemd[1]: Started GSSAPI Proxy Daemon. grant@ef-idm01:~[20240229-10:18][#776]$ I searched online for some references and it was suggested I generate the /var/lib/ipa/gssproxy/http.keytab The keytab file appears OKAY to me though. I would like to get this issue behind me thanx - grant

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2024