July 2024 - FreeIPA-users - Fedora mailing-lists

User certificate for vpn logins
by Chris Kross 17 Jul '24

17 Jul '24

Hello to all! I'm trying a lot, to setup a Firewall vpn login with certificates generated by the FreeIPA server, but i´m stucked now. I have the user certificate generated by the FreeIPA and the firewall generate the CSR then imported on the FreeIPA server, and download the pem generated by the UI and imported again in the Firewall and the firewall match the sign certificate. But when we try to connect to the VPN using certificates, the debug shows: fnbamd_auth_cert_result-Result for ldap svr[0] 'fripa.domain.net' is DENY auth_cert_success-Matched user name 'CA-Ldaps', matched group name 'CA-Ldapgrp' fnbamd_comm_send_result-Sending result 1 (error 0, nid 672) for req 454599539 delete_group_list-Delete group CA-Ldapgrp ike 3:C2-HQ_DCI:50: certificate validation failed From the firewall we can test the Ldaps users and passwords and the test is OK. Thnks to all for any advice!

1 0

Creste ipa users via ldapmodify
by Francis Augusto Medeiros-Logeay 13 Jul '24

13 Jul '24

Hi, I am using FreeIPA with Keycloak. I’ve configure it so that I can create users in Keycloak and they are created on freeipa. It works, the users are created, but they are not displayed under “users” on FreeIPA’s admin console. I added a lot of Objectclasses to see if that was the problem, but doesn’t seem to be it. Is it a group membership I’m missing? Best, Francis __ Francis Augusto Medeiros Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel

1 0

freeipa role delegation before delete and upgrade
by John Michelle 12 Jul '24

12 Jul '24

Hello I ve 3 Freeipa Server, replicated in each other as a topology. [root@ipa001 ~] ipa-replica-manage list ipa03.domain.local: master ipa02.domain.local: master ipa01.domain.local: master this is the output of the command ipa find role : [root@ipa001 ~]# ipa server-role-find --server ipa001.domain.local ------------------------------ 6 rôles serveur correspondants ------------------------------ Nom du serveur: ipa01.domain.local Nom du rôle: CA server État du rôle: enabled Nom du serveur: ipa01.domain.local Nom du rôle: DNS server État du rôle: enabled Nom du serveur: ipa01.domain.local Nom du rôle: NTP server État du rôle: enabled Nom du serveur: ipa01.domain.local Nom du rôle: AD trust agent État du rôle: absent Nom du serveur: ipa01.domain.local Nom du rôle: KRA server État du rôle: absent Nom du serveur: ipa01.domain.local Nom du rôle: AD trust controller État du rôle: absent ---------------------------- Nombre d'entrées renvoyées 6 ---------------------------- [root@ipa01 ~]# ipa server-role-find --server ipa02.domain.local ------------------------------ 6 rôles serveur correspondants ------------------------------ Nom du serveur: ipa02.domain.local Nom du rôle: CA server État du rôle: enabled Nom du serveur: ipa02.domain.local Nom du rôle: DNS server État du rôle: enabled Nom du serveur: ipa02.domain.local Nom du rôle: NTP server État du rôle: absent Nom du serveur: ipa02.domain.local Nom du rôle: AD trust agent État du rôle: absent Nom du serveur: ipa02.domain.local Nom du rôle: KRA server État du rôle: absent Nom du serveur: ipa02.domain.local Nom du rôle: AD trust controller État du rôle: absent ---------------------------- Nombre d'entrées renvoyées 6 ---------------------------- [root@ipa01 ~]# ipa server-role-find --server ipa03.domain.local ------------------------------ 6 rôles serveur correspondants ------------------------------ Nom du serveur: ipa03.domain.local Nom du rôle: CA server État du rôle: configured Nom du serveur: ipa03.domain.local Nom du rôle: DNS server État du rôle: enabled Nom du serveur: ipa03.domain.local Nom du rôle: NTP server État du rôle: absent Nom du serveur: ipa03.domain.local Nom du rôle: AD trust agent État du rôle: absent Nom du serveur: ipa03.domain.local Nom du rôle: KRA server État du rôle: absent Nom du serveur: ipa03.domain.local Nom du rôle: AD trust controller État du rôle: absent ---------------------------- Nombre d'entrées renvoyées 6 ---------------------------- [root@ipa01 ~]# when i delete the ipa01 server, i will lose the ntp role. i want to delegate the ntp role to the 2 servers, but i don't know what NTP server is configured in the IPA01. also, i see that the CA server role is configured, Any idea to see that configuration and know why this role is not enabled ? can i see all configuration and know what options is selected to install replicas ? ( --no-forwarders, etc ) Thanks

3 9

dyndns and dns forwarders
by David Harvey 11 Jul '24

11 Jul '24

Dear list, I'm thinking of making our border devices our primary port of call for DNS , and setting them to forward to FreeIPA. I found an inconclusive thread saying that this might break dyndns for my otherwise happy IPA clients. Does dyndns working rely upon clients having IPA servers setups as their DNS server? I couldn't see an sssd option of "send updates here (only use this NIC)". I am hoping to avoid having to use the route of getting DHCP to update DNS instead! Thanks as always, David

2 2

browse FreeIPA automountmap
by Kris C 11 Jul '24

11 Jul '24

Hi all, I'm looking high and low for a way to create/configure an automountmap in FreeIPA that is browsable. i.e. Something that would look like this if we were doing it old school: /etc/auto.master: /games auto.games -browse --timeout 120 in /etc/auto.games: tron -fstype nfs gameserver:/tron cod -fstype nfs gameserver:/cod I can do all of this in FreeIPA but for the life of me can't figure out how to have the equivalent of the -browse option enabled for the auto.games map entry. Am I making any sense? Thanks, -K

2 1

browse FreeIPA automountmap
by Kris C 11 Jul '24

11 Jul '24

Hi all, I'm looking high and low for a way to create/configure an automountmap in FreeIPA that is browsable. i.e. Something that would look like this if we were doing it old school: /etc/auto.master: /games auto.games -browse --timeout 120 in /etc/auto.games: tron -fstype nfs gameserver:/tron cod -fstype nfs gameserver:/cod I can do all of this in FreeIPA but for the life of me can't figure out how to have the equivalent of the -browse option enabled for the auto.games map entry. Am I making any sense? Thanks, -K

1 0

browse FreeIPA automountmap
by Kris C 11 Jul '24

11 Jul '24

Hi all, I'm looking high and low for a way to create/configure an automountmap in FreeIPA that is browsable. i.e. Something that would look like this if we were doing it old school: /etc/auto.master: /games auto.games -browse --timeout 120 in /etc/auto.games: tron -fstype nfs gameserver:/tron cod -fstype nfs gameserver:/cod I can do all of this in FreeIPA but for the life of me can't figure out how to have the equivalent of the -browse option enabled for the auto.games map entry. Am I making any sense? Thanks, -K

1 0

beginner question: external dns resolving for lan hosts?
by M B 11 Jul '24

11 Jul '24

Hey everyone, actually getting started with FreeIPA. My goal is to use FreeIPA for internal lan dns, external dns resolving (or forwarding to my opnsense unbound to get external resolving). This shouldnt work only for the FreeIPA server itself, as is already does when using named unbound as forwarder with "forward-only" policy. What i'm trying to reach is to use FreeIPA as dns server of my other lan clients to get external dns resolved. In this example: debian 12 So i'm using in my debian ENI configuration file dns-nameservers with the ip of the ipa server - resolving of its own local zone is working fine - but not the external resolving. The debian cant resolve e.g. google.com. Maybe anyone can give me hint? BTW: Actually i dont want to use the freeipa-client as i'm actually not that deep into freeipa to handle that yet. Just wanna use the DNS and NTP of freeipa for my lan clients for now.

1 0

Thunderbird v. 115 with FreeIPA LDAP address book
by Antonello Ledda 11 Jul '24

11 Jul '24

Hi We're trying to set up the Thunderbird address book to get user data from FreeIPA LDAP service, but we cannot get the email address of the users, we've tried with Base DN string : cn=users,cn=accounts,dc=xxxxxx,dc=yyy , but the only field we were able to get is the username and the role in the organization . Is there some way to get all user data ? Thanks in advance Regards Antonello

4 6

demo1.freeipa.org
by veck zuo 10 Jul '24

10 Jul '24

I am deploying the freeIPA demo follwing below link. https://www.freeipa.org/page/Demo [root@localhost ~]# ping www.google.com PING www.google.com (142.250.196.68) 56(84) bytes of data. 64 bytes from maa03s46-in-f4.1e100.net (142.250.196.68): icmp_seq=1 ttl=128 time=347 ms 64 bytes from maa03s46-in-f4.1e100.net (142.250.196.68): icmp_seq=2 ttl=128 time=348 ms ^C --- www.google.com ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 346.995/347.316/347.637/0.321 ms [root@localhost ~]# [root@localhost ~]# ipa-client-install --domain demo1.freeipa.org -p admin -w Secret123 This program will set up IPA client. Version 4.9.13 Skip ipa.demo1.freeipa.org: LDAP server is not responding, unable to verify if this is an IPA server Skip ipa.demo1.freeipa.org: LDAP server is not responding, unable to verify if this is an IPA server Provide your IPA server name (ex: ipa.example.com) ^CThe ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

2 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2024