July 2024 - FreeIPA-users - Fedora mailing-lists

How does RBAC work?
by Francis Augusto Medeiros-Logeay 08 Oct '24

08 Oct '24

Ok, I am not sure how this works: I created this user, called biding. I want it to be able to create users on FreeIPA, mailing by biding Keycloak to it. So I created the role: [francis@freeipa]~% ipa role-show Role name: Keycloak biding Role name: Keycloak biding Member users: biding Privileges: User Administrators, Group Administrators, Stage User Administrators, Stage User Provisioning, Modify Users and Reset passwords, Modify Group membership, Keycloak admin Yes, too many roles, because it simply wasn’t doing it. Keycloak would fail saying the user didn’t have permissions. So what I did was to add this user to the admin group. Then it created users. But not even my admin user can delete those users created that way. Why isn’t this working? And why when giving it permissions it is creating objects that simply can’t be read by my previous biding users? Best, Francis

3 9

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

sidgen_task fails with SID conflict
by Basile Pinsard 16 Aug '24

16 Aug '24

Hi, I had an existing instance of freeipa that went broken so badly (pki-tomcat unrecoverable) that the only option was spinning up a new one and `ipa migrate-ds` from the broken one. The new instance was set to reuse the same id-range as the previous one, so all is good for the users in that range. The older instance has a number of user that were imported from an even older LDAP with IDs out of the IPA range. So after import, I quickly figured out that I need to create a small (1000) `legacy` range that covers these, most of these legacy users were then able to login. Here are the id-ranges after the legacy was added. # ipa idrange-find ---------------- 3 ranges matched ---------------- Range name: DOMAIN_id_range First Posix ID of the range: 944200000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range Range name: DOMAIN_id_range_legacy First Posix ID of the range: 1000 Number of IDs in the range: 1000 First RID of the corresponding RID range: 302000 First RID of the secondary RID range: 200000000 Range type: local domain range Range name: DOMAIN_subid_range First Posix ID of the range: 2147483648 Number of IDs in the range: 2147352576 First RID of the corresponding RID range: 2147283648 Domain SID of the trusted domain: S-1-5-21-738065-838566-3977953474 Range type: Active Directory domain range ---------------------------- Number of entries returned 3 ---------------------------- However, a number of the legacy users still cannot login. I tried starting the sidgen task, and from the logs it seems that there is a conflict with the ranges I chose for the legacy id range. ``` [18/Jul/2024:16:24:12.358313104 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... [18/Jul/2024:16:24:12.598768115 +0000] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-3076474616-2786889582-2859700629-302272] is already used. [18/Jul/2024:16:24:12.637972455 +0000] - ERR - rid_to_sid_with_check - [file ipa_sidgen_common.c, line 384]: SID [S-1-5-21-3076474616-2786889582-2859700629-200000272] is already used. [18/Jul/2024:16:24:12.696381619 +0000] - ERR - find_sid_for_id - [file ipa_sidgen_common.c, line 432]: Secondary SID is used as well. [18/Jul/2024:16:24:12.746590836 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 532]: Cannot convert Posix ID [1272] into an unused SID. [18/Jul/2024:16:24:12.796710604 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. [18/Jul/2024:16:24:12.854320074 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [19]. ``` I cannot figure out what is my error and the documentation is quite scarce on how to choose first-rids, except saying that ranges shouldn't overlap, which I thought I made care of when creating the legacy range. Maybe I am too dumb to understand where is the overlap I created, or why I do get conflict. Thanks for your help and expertise!

4 5

`ipa-acme-manager --enable` command failed on master replica
by Vadim Dobroskokin 12 Aug '24

12 Aug '24

`ipa-acme-manager --enable` command failed on master replica. On other replicas, the command completes successfully. FreeIPA 4.11, RockyLinux 9.4 Output fragment from failed command: ``` ipaserver.masters: DEBUG: Discovery: available servers for service 'CA' are ipa01.example.com, ipa11.example.com, ipa02.example.com ipaserver.masters: DEBUG: Discovery: using ipa01.example.com for 'CA' service ipapython.dogtag: DEBUG: request POST https://ipa01.example.com:8443/acme/login ipapython.dogtag: DEBUG: request body '' ipapython.dogtag: DEBUG: response status 404 ipapython.dogtag: DEBUG: response headers Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 765 ipapython.dogtag: DEBUG: response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/acme/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.87</h3></body></html>' ipapython.admintool: DEBUG: File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute return_value = self.run() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", line 403, in run with state as ca_api: File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_acme_manage.py", line 103, in __enter__ raise errors.RemoteRetrieveError( ipapython.admintool: DEBUG: The ipa-acme-manage command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API ipapython.admintool: ERROR: Failed to authenticate to CA REST API ipapython.admintool: ERROR: The ipa-acme-manage command failed. ``` How can I fix this problem?

4 11

SID woes when trying to add a replica on Alma 9 freeipa
by Thomas Boroske 02 Aug '24

02 Aug '24

Hello dear FreeIPA experts, I am currently in the process of trying to migrate a system consisting of two ipa masters ipa1,ipa2 (no ca, no dns, no pkinit) running on CentOS7 to two new systems running on Alma Linux 9 (RHEL 9 based). At least some of the user-IDs and GIDs in the system are very old, however, since before IPA there was an openldap based system and the user config data traveled over when the switch to IPA was initially made. I managed to setup new system ipa3, did a test ipa server install with some (solvable) problems, looks OK. But I needed a replica of course, so rollback and try ipa-replica-install instead of server-install. This eventually worked somewhat. During the replication/setup process I got told I have user accounts without SID and if I want to convert them/add the SIDs. I went with the default option of "no" since I didn't really know if I needed that and was not sure it wouldn't damage the function of the old master servers. The result was: kinit and login to web interface only worked for the admin user. WIth ipa-user find or in the web interface it seemed that other than that the data has traveled over. Modifications we hat in the 99user.ldif also traveled over. Of course, the problem with kinit and web login is due to the missing SIDs. I found out you can redo the conversion I skipped during the replica install by using "ipa config-mod –enable-sid –add-sids" However, this didn't change anything, and from looking at the dirsrv error log I learned the script did not work because some of my uid/gid is outside the idrange configured for IPA. At this point I decided to do a rollback to do more research on how to handle those issues, so I'm back to two masters on CentOS7. My existing IPA installation only has this one idrange: [root@charon ~]# LANG=C ipa idrange-find --------------- 1 range matched --------------- Range name: NET.IDA_id_range First Posix ID of the range: 531600000 Number of IDs in the range: 200000 Range type: local domain range ---------------------------- Number of entries returned 1 ---------------------------- Note there is no primary or secondary RID base set for this range. I do have users with UID starting at 999 and GID starting at 100 that were probably created before IPA. Now I understand I have to do something like "ipa idrange-add NET.IDA_low_id_range --base-id=1 --range-size=20000 --rid-base=200000000 --secondary-rid-base=300000000" and then maybe the ipa config-mod with "--add-sids" should work. But I do have questions before I try that: First: Since my existing range has no RID set, how do I know the rid base ranges won't conflict? And then: On which point and where during the replicate-to-new-system process do I have to do what? - I guess I could even add the idranges on the old servers before creating a replica? Would it work? Is it a good idea? - what about the "ipa config-mod –enable-sid –add-sid" : - is this available on the old CentOS 7 too and should I try to enable it there before creating a replica? - or is it only possible/necessary on the new replica, but then, what will be the state of my ipa master server cluster then? Most importantly, will the old ipa servers continue to work while I test the new replica with single clients, create a second new replica etc pp? In short: At what point and where do I need to run the "ipa addrange", and at what point and where do I need to run the "ipa config mod –enable-sid –add-sid". Many thanks for any help. Kind regards, Thomas

2 2

Help with Ghost Replica removal please.
by Nicholas Cross 02 Aug '24

02 Aug '24

I am on a long journey upgrading from a mixture of different versions of freeipa to the lastest and i am almost there, currently on 4.10. After removing some older replicas yesterday, a new replica had a fault and we had to restart dirsrv. When it came back up we saw we have ghost replicas across the whole estate 6x replicas in two locations. Issues are reported via `cipa` Digging into the tombstone records, i find there are not the usual tombstone replica records but more like the below. My question is, how do i remove these redundant records? As I believe this is what `cipa` is counting to report the errors. (marked with <<<<<<<<<<<<<<) The usual things do not work: # ipa-replica-manage -p $pass clean-ruv 15 Replica ID 15 not found $ cat remove_ruv.ldif dn: cn=clean 15,cn=cleanallruv,cn=tasks,cn=config changetype: add objectclass: top objectclass: extensibleObject replica-base-dn: dc=ad,dc=companyx,dc=fm replica-id: 15 cn: clean 15 ldapmodify -Y GSSAPI -f remove_ruv.ldif Thanks in advance. Nick $ ldapsearch -D "cn=Directory Manager" -w $pass -Q -o ldif-wrap=no -LLL -b "dc=ad,dc=companyx,dc=fm" '(&(objectclass=nstombstone)(nsUniqueId=ffffffff-ffffffff-ffffffff-ffffffff))' dn: cn=replica,cn=dc\3Dad\2Cdc\3Dcompanyx\2Cdc\3Dfm,cn=mapping tree,cn=config cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=replication manager,cn=config nsDS5ReplicaBindDNGroup: cn=replication managers,cn=sysaccounts,cn=etc,dc=ad,dc=companyx,dc=fm nsDS5ReplicaBindDnGroupCheckInterval: 60 nsDS5ReplicaId: 56 nsDS5ReplicaName: a6b5640c-ad3911ed-a50980fb-6203228c nsDS5ReplicaRoot: dc=ad,dc=companyx,dc=fm nsDS5ReplicaType: 3 nsState:: OAAAAAAAAABSPEJkAAAAAAAAAAAAAAAA7AAAAAAAAAAGAAAAAAAAAA== nsds5ReplicaBackoffMax: 300 nsds5ReplicaLegacyConsumer: off nsds5ReplicaReleaseTimeout: 60 objectClass: top objectClass: nsds5replica objectClass: extensibleobject nsds50ruv: {replicageneration} 5d9e2076000000040000 nsds50ruv: {replica 56 ldap://ipa006.ad.companyx.fm:389} 63ece66f000000380000 64423d4e000000380000 nsds50ruv: {replica 46 ldap://ipa005.ad.companyx.fm:389} 63dbcc200001002e0000 64423cf6000f002e0000 nsds50ruv: {replica 21 ldap://etcd0dc.ad.companyx.fm:389} 5f2d4bc1000000150000 64319ec3276200150000 nsds50ruv: {replica 48 ldap://ipa007.ad.companyx.fm:389} 63ea4e54000100300000 6442397e000a00300000 nsds50ruv: {replica 58 ldap://ipa001dc.ad.companyx.fm:389} 643d03280001003a0000 644232c00001003a0000 nsds50ruv: {replica 60 ldap://ipa002dc.ad.companyx.fm:389} 643d19680001003c0000 644232660004003c0000 nsds50ruv: {replica 62 ldap://ipa003dc.ad.companyx.fm:389} 643d491e0001003e0000 644233340000003e0000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa003dc.ad.companyx.fm;ipa003dc.ad.companyx.fm ;389;62;644238c9000000380000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa007.ad.companyx.fm;ipa007.ad.companyx.fm ;389;48;644238c9000000380000 nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-etcd2dc.ad.companyx.fm;etcd2dc.ad.companyx.fm;389;unavailable;64423cf6000f002e0000 <<<<<<<<<<<<<< nsds5agmtmaxcsn: dc=ad,dc=companyx,dc=fm; ipa006.ad.companyx.fm-to-ipa005.ad.companyx.fm;ipa005.ad.companyx.fm ;389;46;644238c9000000380000 nsruvReplicaLastModified: {replica 56 ldap://ipa006.ad.companyx.fm:389} 64423c62 nsruvReplicaLastModified: {replica 46 ldap://ipa005.ad.companyx.fm:389} 64423c0c nsruvReplicaLastModified: {replica 21 ldap://etcd0dc.ad.companyx.fm:389} 00000000 nsruvReplicaLastModified: {replica 48 ldap://ipa007.ad.companyx.fm:389} 64423894 nsruvReplicaLastModified: {replica 58 ldap://ipa001dc.ad.companyx.fm:389} 644231da nsruvReplicaLastModified: {replica 60 ldap://ipa002dc.ad.companyx.fm:389} 6442317a nsruvReplicaLastModified: {replica 62 ldap://ipa003dc.ad.companyx.fm:389} 64423249 nsruvReplicaLastModified: {replica 12} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 15} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 25} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 23} 644180f7 <<<<<<<<<<<<<< nsruvReplicaLastModified: {replica 40} 644180f7 <<<<<<<<<<<<<< nsds5ReplicaChangeCount: 734077 nsds5replicareapactive: 0

3 14

ipa: ERROR: Cannot find specified domain or server name
by Johnnie W Adams 01 Aug '24

01 Aug '24

Hi, folks, Everywhere I check, I see this error associated with firewall issues. To get around that, I put my box on the same network segment as the ad boxes. No firewall between them. But I am still getting this message when I try to create a trust: ipa: ERROR: Cannot find specified domain or server name The error in /var/log/httpd is: [wsgi:error] [pid 506950:tid 507279] [remote <ip address>:53320] ipa: INFO: [jsonserver_session] admin(a)NET.EXAMPLE.COM: trust_add/1(' adtest1.ad.test.example.com', trust_type='ad', realm_admin='me', realm_passwd='********', range_type='ipa-ad-trust', version='2.253'): NotFound Any thoughts? What exactly is being not found? Thanks, John A -- John Adams Senior Linux/Middleware Administrator | Information Technology Services +1-501-916-3010 | jxadams(a)ualr.edu | http://ualr.edu/itservices *UA Little Rock* Reminder: IT Services will never ask for your password over the phone or in an email. Always be suspicious of requests for personal information that come via email, even from known contacts. For more information or to report suspicious email, visit IT Security <http://ualr.edu/itservices/security/>.

3 9

viewing/editing existing schema attributes in web UI admin
by Alex I 01 Aug '24

01 Aug '24

Hi, I'm upgrading a mail system (postfix, dovecot, amavis etc) with openldap backend and really would like to switch to freeipa (use it as mail accounts backend DB among other tasks). Ldap schema-wise I only had to add a new amavisAccount class as it looks like I can make use of already existing mailRecipient class (add these classes to a user and a group set of classes). I can display/modify amavisAccount/mailRecipient attributes for a user with ipa user-show --all, ipa user-mod and with ldap browser/editor (jxplorer). But I can't get these classes attributes displayed/modified in Web UI. I'm on Almalinux 9 and installed appstream packages from alma (4.11.0-15.el9_4.alma.1). I do not know python,jquery,js/css and really banging against the wall here. I know about https://abbra.fedorapeople.org/freeipa-extensibility.html https://github.com/abbra/freeipa-userstatus-plugin/blob/master/plugin/Featu… but not really understand much there obviously. Here is a forum question very close to what I'm trying to achieve: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… Based on that I created mailalt.js: define([ 'freeipa/phases', 'freeipa/user'], function(phases, user_mod) { function get_item(array, attr, value) { for (var i=0,l=array.length; i<l; i++) { if (array[i][attr] === value) return array[i]; } return null; } var mail_alt_plugin = {}; mail_alt_plugin.add_mail_alt_pre_op = function() { var facet = get_item(user_mod.entity_spec.facets, '$type', 'details'); var section = get_item(facet.sections, 'name', 'contact'); section.fields.push({ $type: 'multivalued', name: 'mailAlternateAddress', flags: ['w_if_no_aci'], label: 'Alternative Mail' ], }); return true; }; phases.on('customization', mail_alt_plugin.add_mail_alt_pre_op); return mail_alt_plugin; }); then put it in /usr/share/ipa/ui/js/plugins/mailalt/ and executed ipa-server-upgrade But still no mailAlternateAddress field shown. Any advise here? Thank you

2 5

glibc and group merging
by Ronald Wimmer 30 Jul '24

30 Jul '24

Group merging works like expected as described by Alexander several years ago in https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… My question is if it is possible to specify the ipa user in /etc/groups without the domain suffix? (adding default_domain_suffix in the sssd section of sssd.conf did not help) someuser@someserver:~ $ getent initgroups splunk splunk 1246640006 someuser@someserver:~ $ getent initgroups splunk(a)linux.mydomain.at splunk(a)linux.mydomain.at 1246640006 190 Why would I want that? The respective line in /etc/groups could be the same across all our domains. Cheers, Ronald

1 1

Trouble installing because DNS zone already exists.
by B Vad 29 Jul '24

29 Jul '24

Hi, I'm prepping for the RedHat IDM exam, and want to install freeipa, with integrated DNS server. However, one of the requirements is having DNS running already so hosts are resolvable both ways, and have a SRV record pointing towards the NTP server. I set up an authoritative DNS server and add the hosts, requirements met. However, whenever I try to install with DNS enable active and --forwarders=myauthoritativednsserver I run into the following error: Checking DNS domain homelab.com., please wait ...DNS zone homelab.com. already exists in DNS and is handled by server(s): r0.homelab.com. Could someone please explain how to properly setup my lab to install freeipa with the dns server installed? I've been wrestling this problem for a few days now, and I seem to be missing something !

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2024