July 2024 - FreeIPA-users - Fedora mailing-lists

Trouble installing because DNS zone already exists.
by B Vad 27 Jul '24

27 Jul '24

Hi, I'm prepping for the RedHat IDM exam, and want to install freeipa, with integrated DNS server. However, one of the requirements is having DNS running already so hosts are resolvable both ways, and have a SRV record pointing towards the NTP server. I set up an authoritative DNS server and add the hosts, requirements met. However, whenever I try to install with DNS enable active and --forwarders=myauthoritativednsserver I run into the following error: Checking DNS domain homelab.com., please wait ...DNS zone homelab.com. already exists in DNS and is handled by server(s): r0.homelab.com. Could someone please explain how to properly setup my lab to install freeipa with the dns server installed? I've been wrestling this problem for a few days now, and I seem to be missing something !

1 0

Trouble installing because DNS zone already exists.
by B Vad 27 Jul '24

27 Jul '24

Hi, I'm prepping for the RedHat IDM exam, and want to install freeipa, with integrated DNS server. However, one of the requirements is having DNS running already so hosts are resolvable both ways, and have a SRV record pointing towards the NTP server. I set up an authoritative DNS server and add the hosts, requirements met. However, whenever I try to install with DNS enable active and --forwarders=myauthoritativednsserver I run into the following error: Checking DNS domain homelab.com., please wait ...DNS zone homelab.com. already exists in DNS and is handled by server(s): r0.homelab.com. Could someone please explain how to properly setup my lab to install freeipa with the dns server installed? I've been wrestling this problem for a few days now, and I seem to be missing something !

1 0

Trouble with (letsencrypt) certs after updating IPA
by Giulio Casella 26 Jul '24

26 Jul '24

Hi, I'm having trouble after this morning update: I had a setup (based on RHEL 9) with 3 IPA servers, with certificate generated by letsencrypt (https://github.com/freeipa/freeipa-letsencrypt) After updating I noticed the web UI was using self signed CA, so I run setup-le.sh. The certificates were correctly regenerated, and the browser was happy. But when I try to login it fails, and in httpd error log I find: [Thu Jul 25 18:20:53.773180 2024] [wsgi:error] [pid 15636:tid 15924] [remote 10.10.10.10:38566] ipa: INFO: 401 Unauthorized: HTTPSConnectionPool(host='dc1.example.com', port=443): Max retries exceeded with url: /ipa/session/cookie (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)'))) Trying to rerun setup-le.sh now the "ipa-certupdate" part fails with same error: cannot connect to 'any of the configured servers': https://dc1.example.com/ipa/json, https://dc3.example.com/ipa/json, https://dc2.example.com/ipa/json It seems some old certificate (ca or server) is still inside IPA. Other services (NFS, ssh to ipa clients, ...) seems to work. I hope it's not only the sss cache! Any ideas? TIA, gc

3 5

GSSAPI server authentication in python (WSGI)
by Aurelien Bompard 26 Jul '24

26 Jul '24

Hey folks! I'm part of Fedora Infrastructure and we maintain our FreeIPA-based auth stack (among many other things). We have mostly Python-based web applications, and while they use OpenID Connect (OIDC) for authentication, some of them are using GSSAPI authentication directly to authenticate clients (koji, fasjson, copr). Until now, we've put those apps behind apache's mod_auth_gssapi and used the env variable it sets to read the authenticated user. Unfortunately this is starting to not be sufficient, for the following two reasons: - we want to only authenticate parts of the app - running the apps behind apache in OpenShift adds another layer that is not very convenient in containers, and prevents us from using Python builder images with s2i since those only support gunicorn I'm considering writing/adapting a WSGI authentication layer that would handle GSSAPI. I've seen that somebody has already written one for ASGI (the async version of WSGI) here: https://github.com/washed-out/asgi-gssapi/ It's also based on an older WSGI implementation that was based on python-kerberos, now obsoleted by python-gssapi. So I'm considering reusing asgi-gssapi and making it do WSGI instead. Do you think it's a bad idea? Do you know of other libraries that do this? (I searched, but found nothing besides the 2 I mentionned). Most of the work will be done by python-gssapi, but there's always room for security flaws in this sort of thing, and I'm not a Kerberos/GSSAPI expert. Would somebody here be interested in this GSSAPI-WSGI layer? How about co-maintaining it? Thanks! Aurélien

2 2

Problems with ipa after recent upgrade ssh works web does not cant add new servers and fiew other problems
by Przemysław Orzechowski 26 Jul '24

26 Jul '24

Hi I'm using Oracle Linux8 on all IPA servers After IPA upgrade i noticed several problems 1) Nobody including admin can log into WEB UI (Your session has expired. Please log in again.) 2) Can't add new machines to IPA (JSON-RPC response: {"result": null, "error": {"code": 2100, "message": "Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)", "data": {"info": "SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)"}, "name": "ACIError"}, "id": null, "principal": "UNKNOWN", "version": "4.9.13"}) 3) certificate reneval (ipa-getcert) fails (ca-error: Server at https://dc02.dc.makolab.pl/ipa/json denied our request, giving up: 2100 (Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty)).) - this command was run directly on IPA server dc02 (reneval of certificate for rsyslog TLS) Replication between IPA servers seems to be working ok Ipa healthchek does not find any errors or critical only few warnings ipa-healthcheck --output-type human --all --severity WARNING WARNING: ipahealthcheck.ipa.certs.IPACertTracking.20220104115549: certmonger tracking request 20220104115549 found and is not expected on an IPA master. <- certificate for metricbit TLS WARNING: ipahealthcheck.ipa.certs.IPACertTracking.20220104120152: certmonger tracking request 20220104120152 found and is not expected on an IPA master. <- certificate for rsyslog TLS WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc02.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc02.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc03.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc03.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc04.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc04.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:tcp:dc05.dc.makolab.pl.: Expected URI record missing WARNING: ipahealthcheck.ipa.idns.IPADNSSystemRecordsCheck._kpasswd.dc.makolab.pl.:krb5srv:m:udp:dc05.dc.makolab.pl.: Expected URI record missing when running ipa ping on remote machine or directly ipa server i get error: kinit admin && ipa -d ping Password for admin(a)DC.MAKOLAB.PL: ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state' ipa: DEBUG: failed to find session_cookie in persistent storage for principal 'admin(a)DC.MAKOLAB.PL' ipa: DEBUG: trying https://dc02.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc02.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=WX9t37J4908GxZduLpoz%2fW6IvRmXHrv21rq%2bjWklhTT1Xdk4%2fkUiAzIjGwZuHKk9Tvbb5h5WEHLpzLgN5Rn6gBFp88%2fj%2bZUjKTwSfQtcc8eaO45GUR4juCXxkoNCc9QGlPsqfeLthgHVpCy2jdP3PNyndOGLAWc8cx7kwskzQZd7NQV45VQ2WUJ5LSe3P79vAa5wvP8GgUSVJpcNdtQk2A%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=WX9t37J4908GxZduLpoz%2fW6IvRmXHrv21rq%2bjWklhTT1Xdk4%2fkUiAzIjGwZuHKk9Tvbb5h5WEHLpzLgN5Rn6gBFp88%2fj%2bZUjKTwSfQtcc8eaO45GUR4juCXxkoNCc9QGlPsqfeLthgHVpCy2jdP3PNyndOGLAWc8cx7kwskzQZd7NQV45VQ2WUJ5LSe3P79vAa5wvP8GgUSVJpcNdtQk2A%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc02.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: DEBUG: trying https://dc05.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc05.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=QZfbEtCnuZSE9aKBHV%2fMhFu25SHZOdV%2b9hmiA8T2fMLWv4%2bGiIjTkmijQhBSMeMTW1usB1Ufod1k17ZtIYrF3swFZkwte7GeQVoGzSRnp66oQPlzGC6JzTrE8Sy0QvOqaIKZKDgBpKSYLltGMNkCCziKFsfsGCfulwQmDeHsa5coQ6jazBB6%2fJBhf7ZJlIKA9uHkFYQdHzkAPbkjG5T8Mw%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=QZfbEtCnuZSE9aKBHV%2fMhFu25SHZOdV%2b9hmiA8T2fMLWv4%2bGiIjTkmijQhBSMeMTW1usB1Ufod1k17ZtIYrF3swFZkwte7GeQVoGzSRnp66oQPlzGC6JzTrE8Sy0QvOqaIKZKDgBpKSYLltGMNkCCziKFsfsGCfulwQmDeHsa5coQ6jazBB6%2fJBhf7ZJlIKA9uHkFYQdHzkAPbkjG5T8Mw%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc05.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: DEBUG: trying https://dc03.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc03.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=qHTfoDQ%2bsTVui5w8dxcfx6Fx9GORKX%2fHFsEAc2yoI6g7eL4qsvVXh9uNZLfrop7nSTqrJs0toSjpGQfSkjloUY6%2f338%2fwVz1xazGV5aVAMujclsd%2bVrX%2bj92r%2bsf1%2fdtPU1VLsPBflqWuwOLOFLGnTEWQKVeGgBkf%2fvZ7f3vIa%2fP0OvYtTaORQE49tf%2bXUkQ%2bQiW5I11D%2f0hBLKnjqc2Qw%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=qHTfoDQ%2bsTVui5w8dxcfx6Fx9GORKX%2fHFsEAc2yoI6g7eL4qsvVXh9uNZLfrop7nSTqrJs0toSjpGQfSkjloUY6%2f338%2fwVz1xazGV5aVAMujclsd%2bVrX%2bj92r%2bsf1%2fdtPU1VLsPBflqWuwOLOFLGnTEWQKVeGgBkf%2fvZ7f3vIa%2fP0OvYtTaORQE49tf%2bXUkQ%2bQiW5I11D%2f0hBLKnjqc2Qw%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc03.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: DEBUG: trying https://dc04.dc.makolab.pl/ipa/json ipa: DEBUG: New HTTP connection (dc04.dc.makolab.pl) ipa: DEBUG: received Set-Cookie (<class 'list'>)'['ipa_session=MagBearerToken=fLBKVOskfDdrVsu%2fU7p5ZzYPDKKl2g3uCVZbUnioVPNNeH8Hrwpt4IHz4edHc%2bTrj0ERrqUK8egmfv8797SpAk27pE7%2bfDkHOPrndW9n4Uzkm4SvUa1QFnjxSwey3vdXA8L9H%2bQJaI7tDtPUbRw5nTfSzWi22bhH%2fLIsIqVcibzHjSzzRz1NB%2by6j5IIuUiTO1nokizbe1%2bV3TN7%2fWA2Dw%3d%3d;path=/ipa;httponly;secure;']' ipa: DEBUG: storing cookie 'ipa_session=MagBearerToken=fLBKVOskfDdrVsu%2fU7p5ZzYPDKKl2g3uCVZbUnioVPNNeH8Hrwpt4IHz4edHc%2bTrj0ERrqUK8egmfv8797SpAk27pE7%2bfDkHOPrndW9n4Uzkm4SvUa1QFnjxSwey3vdXA8L9H%2bQJaI7tDtPUbRw5nTfSzWi22bhH%2fLIsIqVcibzHjSzzRz1NB%2by6j5IIuUiTO1nokizbe1%2bV3TN7%2fWA2Dw%3d%3d;' for principal admin(a)DC.MAKOLAB.PL ipa: INFO: Connection to https://dc04.dc.makolab.pl/ipa/json failed with Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) ipa: ERROR: cannot connect to 'any of the configured servers': https://dc02.dc.makolab.pl/ipa/json, https://dc05.dc.makolab.pl/ipa/json, https://dc03.dc.makolab.pl/ipa/json, https://dc04.dc.makolab.pl/ipa/json Checked the admin user has ipaNTSecurityIdentifier: S-1-5-21-1851759508-3520056987-880742157-500 Other users also have ipaNTSecurityIdentifier defined in ldap klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 1 12/30/21 13:09:34 ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL 1 12/30/21 13:09:34 ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL kvno -k /etc/dirsrv/ds.keytab ldap/dc02.dc.makolab.pl ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL: kvno = 1, keytab entry valid Problems I spotted in logs: in /var/log/dirsrv/slapd-DOMAIN/error [25/Jul/2024:12:36:11.325055589 +0000] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/dc02.dc.makolab.pl(a)DC.MAKOLAB.PL] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328324 (Generic error (see e-text)) [25/Jul/2024:12:36:16.399028241 +0000] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=dc,dc=makolab,dc=pl [25/Jul/2024:12:36:16.401195077 +0000] - ERR - schema-compat-plugin - Finished plugin initialization. from httpd error_log [Fri Jul 26 10:58:46.588000 2024] [wsgi:error] [pid 11820:tid 140020710070016] [remote 172.16.129.240:59424] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) [Fri Jul 26 10:58:46.636457 2024] [wsgi:error] [pid 11821:tid 140020710070016] [remote 172.16.129.240:59424] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) I would like to ask for any help with this problems. Regards Przemyslaw Orzechowski

1 0

Creating user_add callback
by Anton PalkoBrosov 25 Jul '24

25 Jul '24

Hi, i am trying to make callback which will make API calls to external system when new user created. So i puts the script to "/usr/lib/python2.7/site-packages/ipaserver/plugins", give execute priveleges to file and restart freeipa server. Greating new user in GUI - so folder is not creating. In my script i just programmed simple action - creation of folder. Script: import os from ipalib.plugins.user import user_add from ipalib import api, plugable def verify_shell_cb(self, ldap, dn, entry_attrs, *keys, **options): folder_path = '/home/freeipa/suka' if not os.path.exists(folder_path): os.makedirs(folder_path) user_add.register_post_callback(verify_shell_cb) api.register(user_add)

2 5

Re: Azure AD / Azure AD Connect / FreeIPA sync
by Alban Meunier 24 Jul '24

24 Jul '24

On summer 2024, recent updates can be realy interesting in order to provide a better integration from freeIPA and Entra ID (former Azure AD) * Samba 4.18 + supports Entra connect cloud sync https://wiki.samba.org/index.php/Azure_AD_Connect_Cloud_sync. Is it a version used by freeIPA ? * Samba should have samba-winbinnd package to provide RPC support (refer to §1.1.1) https://docs.redhat.com/fr/documentation/red_hat_enterprise_linux/9/html/co… * freeIPA supports to authenticate users against Entra ID https://access.redhat.com/solutions/7073948 * many alternatives on the go to authenticate Entra ID users on Linux hosts : * https://www.puppeteers.net/blog/linux-azure-ad-authentication-options/ * https://learn.microsoft.com/en-gb/entra/identity/devices/howto-vm-sign-in-a… @Alexander Bokovoy : what is the roadmap for FreeIPA to provide integration features with Microsoft Entra as it becomes a must have in many corporate environments and education as well ?

1 0

Web-UI login says: "Login failed due to an unknown reason."
by Thomas Boroske 24 Jul '24

24 Jul '24

Hello all, I have a problem with logging in to the web interface (username/pw) of one of my IPA servers, ipa2. The installation is CA-less, without pkinit, and consists of master servers ipa1 and ipa2 Ipa1 works fine at this time, ipa2 fails with "Login failed due to an unknown reason." in the web ui. In the httpd error log: calledProcessError: Command '/usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_11164 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem' returned non-zero exit status 1 If I try to run /kinit -n - -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem for testing on ipa2, it asks me for a password (which I don't know). Doing the same on ipa1 will not ask for a password, but simply adds the WELLKNOWN/ANONYMOUS principal to the keyring: [root@charon run]# LANG=C klist -a Ticket cache: KEYRING:persistent:0:krb_ccache_vscxoCZ Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS Valid starting Expires Service principal 22.07.2024 17:21:34 23.07.2024 17:21:34 krbtgt/NET.IDA(a)NET.IDA Addresses: (none) So I guess this might be part of the problem. Note that "kinit <user>" with a password I know works fine on ipa2. What can I do to fix this? I should say I had the same problem 2 years ago or so, but with reversed roles (ipa1 not allowing login, ipa2 working fine). According to my notes from back then, a "systemctl restart sssd" fixed it that time. Unfortunately this does not seem to help this time. Many thanks for any ideas, Thomas Boroske

2 4

GSSAPI authentication failure
by Bryan Carroll 23 Jul '24

23 Jul '24

Hi all, After an upgrade from 4.10.0-8 to 4.11.0-15, I'm getting an authentication failure in the access log: [11/Jul/2024:17:32:01.528294151 -0500] conn=57224 op=1 RESULT err=49 tag=97 nentries=0 wtime=0.000076683 optime=0.265358256 etime=0.265415438 - SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context This is preventing anyone from logging in. Kvno was saying the keytab entry is invalid and wrong principal in request: root@pacific dirsrv $ klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 03/08/2023 23:34:09 ldap/pacific.caps.int(a)CAPS.INT 1 03/08/2023 23:34:09 ldap/pacific.caps.int(a)CAPS.INT root@pacific ~ $ kvno -k /etc/dirsrv/ds.keytab ldap/pacific.caps.int ldap/pacific.caps.int(a)CAPS.INT: kvno = 2, keytab entry invalid kvno: Wrong principal in request while decrypting ticket for ldap/pacific.caps.int(a)CAPS.INT So I got a new ticket with ktutil and the kvno still shows it is invalid: root@pacific dirsrv $ klist -kt /etc/dirsrv/ds.keytab Keytab name: FILE:/etc/dirsrv/ds.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 07/11/2024 18:54:19 ldap/pacific.caps.int(a)CAPS.INT root@pacific dirsrv $ kvno -k /etc/dirsrv/ds.keytab ldap/pacific.caps.int ldap/pacific.caps.int(a)CAPS.INT: kvno = 2, keytab entry invalid kvno: Wrong principal in request while decrypting ticket for ldap/pacific.caps.int(a)CAPS.INT I checked the database for the principal: root@pacific dirsrv $ kadmin.local Authenticating as principal capsipa/admin(a)CAPS.INT with password. kadmin.local: get_principal ldap/pacific.caps.int Principal: ldap/pacific.caps.int(a)CAPS.INT Expiration date: [never] Last password change: Mon Jul 08 10:21:07 CDT 2024 Password expiration date: [never] Maximum ticket life: 1 day 00:00:00 Maximum renewable life: 7 days 00:00:00 Last modified: Mon Jul 08 10:21:07 CDT 2024 (ldap/pacific.caps.int(a)CAPS.INT) Last successful authentication: [never] Last failed authentication: Mon Jul 08 23:54:29 CDT 2024 Failed password attempts: 4 Number of keys: 2 Key: vno 2, aes256-cts-hmac-sha1-96:special Key: vno 2, aes128-cts-hmac-sha1-96:special MKey: vno 1 Attributes: REQUIRES_PRE_AUTH Policy: [none] The ldap.conf contents: SASL_NOCANON on BASE dc=caps,dc=int TLS_CACERT /etc/ipa/ca.crt SASL_MECH GSSAPI URI ldaps://pacific.caps.int The krb5.conf contents: includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = CAPS.INT dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] CAPS.INT = { kdc = pacific.caps.int:88 master_kdc = pacific.caps.int:88 kpasswd_server = pacific.caps.int:464 admin_server = pacific.caps.int:749 default_domain = caps.int pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem } [domain_realm] .caps.int = CAPS.INT caps.int = CAPS.INT pacific.caps.int = CAPS.INT [dbmodules] CAPS.INT = { db_library = ipadb.so } [plugins] certauth = { module = ipakdb:kdb/ipadb.so enable_only = ipakdb } I'm not sure where to go from here: Thank you, Bryan Carroll

4 10

Make email field mandatory when creationg new user in GUI
by Anton PalkoBrosov 23 Jul '24

23 Jul '24

By default when creating new user in FreeipaGUI it automatically fills email with template username@doman I need to make email filed was mandatory in new user modal window, so it was unable to create new user without specifying email

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2024