March 2025 - FreeIPA-users - Fedora mailing-lists

Enable Dynamic DNS (DDNS) updates on host after enrollment
by Ranbir 14 Mar '25

14 Mar '25

Hello, Would it be enough to add "dyndns_update = True" to the enrolled host's sssd.conf and restart sssd to enable DDNS updates on the enrolled host? Note: DDNS updates are already enabled on the server side. DDNS is also working with other hosts that were enrolled with the feature enabled from the get go. -- Ranbir

1 0

Errors in dirsrv log
by Ranbir 14 Mar '25

14 Mar '25

I'm seeing errors like the ones below on my ipa servers (excuse the wrapping): [11/Aug/2023:22:07:37.684144411 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d558000400130000 [11/Aug/2023:22:07:37.686865097 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d8d00004003e0000 [11/Aug/2023:22:07:37.689902756 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5dc51000700190000 [11/Aug/2023:22:07:37.693576614 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5ff800005002d0000 [11/Aug/2023:22:07:37.696088129 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d60301000400380000 [11/Aug/2023:22:07:37.698351038 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d606800007000d0000 I can't find anything about what they mean. What do these errors mean? How do I resolve the problem? -- Ranbir

3 5

Seeking Existing Solution for Automating Certificate Assignment from Dogtag to FreeIPA Users
by N. V. 14 Mar '25

14 Mar '25

Hi all, I’m reaching out to see if anyone has already implemented or is aware of an existing solution for automatically assigning certificates issued via Dogtag to FreeIPA user records. In our environment we occasionally issue certificates outside of the standard IPA certificate request workflow. The challenge we’re facing is mapping these externally issued certificates to the appropriate FreeIPA user - for instance based on the subject DN - without having to rely on manual intervention. Has anyone implemented an automated solution for this? Any pointers to plugins, scripts, or documentation that could help this assignment process would be greatly appreciated. Thanks in advance for your help and insights! Best regards, Nelson

2 1

FreeIPA@home
by Ronald Wimmer 13 Mar '25

13 Mar '25

The growing number of PCs, Notebooks, VMs, Raspberries and so on makes me want an IPA installation at home too. Anyone using IPA @home? If yes, how do you run it? (dedicated machine, VM, Container?) What about DNS? I do not quite like that IPA wont let me use a single label domain like "lan" but I guess I will get used to it. Any other tips? Cheers, Ronald

3 2

HTTP returns non-2xx status code
by Tania Hagan 13 Mar '25

13 Mar '25

Hi freeipa-users, We're currently using Freeipa version 4.11.0 on Rocky 9.4 with Apache/2.4.57 and every so often our HTTP fails with our monitoring returning non-2xx status code. Looking at the error log for httpd I see: [mpm_event:error] [pid 1800:tid 1800] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit. Researching this error, it appears to recommend adding to the httpd configuration https://forum.directadmin.com/threads/ah03490-scoreboard-is-full-note-at-ma…. Has anyone had to do this or can recommend a "freeipa" way to resolve this? (Reluctant to mess around with the httpd configuration as unsure on the effects of the client connections with freeipa) Many Thanks, Tania

2 4

Re: Upgrade from 4.12.2-1.el9 to 4.12.2-7.el9 on centos stream 9 failed
by Rob Crittenden 10 Mar '25

10 Mar '25

Russell and I did a bit of offline troubleshooting but unfortunately didn't find anything. I'm cc'ing a couple of the PKI developers. They would know know how to verify that the webapp(s) are registered properly and may be able to tell us why we're seeing 404's. rob Russell Long wrote: > With pki-tomcatd@pki-tomcat running, the ipa-cert-show gives a > connection error: > > [root@ipa-primary ~]# openssl x509 -serial -noout -in /etc/ipa/ca.crt > serial=01 > [root@ipa-primary ~]# ipa cert-show 01 > ipa: ERROR: Request failed with status 404: Non-2xx response from CA > REST API: 404. (404) > > --Russ > > On Wed, Feb 5, 2025 at 2:06 PM Rob Crittenden <rcritten(a)redhat.com > <mailto:rcritten@redhat.com>> wrote: > > Russell Long wrote: > > Here is the obfuscated sosreport. > > It looks like the CA restart that happened immediately before the first > 404 was successful. At least it doesn't report any errors beyond the > usual LDAP connection failures at startup. > > The startup looks to be basically done around 2025-02-03 14:37:56 > > The CA returned 404's at 2025-02-03T19:39:34Z in the upgrade log. > > We don't have the tomcat access logs in the sosreport so we can't see > the requests but they would likely also report 404 and no other details. > > If you manually start things can you communicate with the CA? > > # ipactl --skip-version-check > > Does the CA start? If not add --ignore-service-failures > > Once everything else is up and settled, if the CA start failed run: > systemctl restart pki-tomcatd@pki-tomcat > > And see if that is successful. I think it should succeed since it > appears to have done so in the recent past. > > If so try a basic cert command: > # openssl x509 -serial -noout -in /etc/ipa/ca.crt > # ipa cert-show <that serial number> > > Does it give you data or a connection error? > > rob > > > > > > > On Wed, Feb 5, 2025 at 2:33 AM Alexander Bokovoy > <abokovoy(a)redhat.com <mailto:abokovoy@redhat.com> > > <mailto:abokovoy@redhat.com <mailto:abokovoy@redhat.com>>> wrote: > > > > On Пан, 03 лют 2025, Russell Long via FreeIPA-users wrote: > > >Here is the log, sorry for the delay. Logs are redacted, but the > > only thing > > >changed was the domain names and DNs. > > > > The upgrade log chokes on the CA application not being > registered in > > tomcat container (the corresponding /ca/rest/... path is > giving 404 > > error). > > > > So we get back to the same point as before. An upgrade has been in > > progress but somehow was interrupted. Directory server was > having some > > of listeners disabled to avoid external communication during > the upgrade > > and those listeners weren't recovered due to an interruption. You > > recovered some of them but it looks like there is still > something that > > messes up. > > > > If you are saying all services are working fine, just the > upgrade kicks > > in every time 'ipactl restart' is run (which is part of > ipa.service > > machinery), it means the logged IPA data version is older than > what IPA > > sees in the RPM database. Temporarily, this can be fixed by > looking at > > /var/lib/ipa/sysupgrade/sysupgrade.state and changing > ipa.data_version > > value to be exact same as the RPM package version-release values. > > > > However, it would help to understand why an upgrade causes CA > apps to > > fail to register with the tomcat container. It looks like we > have at > > least three such cases on this list over past week or so, all > on CentOS > > 9 Stream, so there might be something? > > > > May be you can install sos report tool and collect a larger > amount of > > data altogether so that we can see a greater picture? > > > > # dnf install sos > > # sos report > --profile={identity,security,system,services,network} > > --clean -a > > > > This should produce logs with consistently obfuscated > hostnames and > > domains across all files. You can add more domains to > obfuscate with > > `--domains={domain1,domain2,..}` to `sos report` tool. > > > > > > > > > > > > > >On Wed, Jan 29, 2025 at 4:51 PM Rob Crittenden > <rcritten(a)redhat.com <mailto:rcritten@redhat.com> > > <mailto:rcritten@redhat.com <mailto:rcritten@redhat.com>>> wrote: > > > > > >> Russ Long via FreeIPA-users wrote: > > >> > Things are functional, however IPA still thinks it needs an > > upgrade, so > > >> any time the service restarts, it breaks again. > > >> > > > >> > > >> If you have time to run the upgrade again and send us a > compressed > > >> /var/log/ipaupgrade.log we can see if we can identify the > root cause. > > >> > > >> rob > > >> > > >> > > > > > > > > > > -- > > / Alexander Bokovoy > > Sr. Principal Software Engineer > > Security / Identity Management Engineering > > Red Hat Limited, Finland > > >

2 5

self-user keytab without password reset.
by alexey safonov 10 Mar '25

10 Mar '25

Hi guys, I might be missing something, but I can't find any instructions on how to allow users to retrieve keytab without password reset. And just wondering why this is disabled by default?

3 2

Proper Approach to Extending LDAP Schema for GPC Storage in FreeIPA
by Данила Скачедубов 10 Mar '25

10 Mar '25

3 5

freeIPA web console login, session has expired...
by aurfalien 10 Mar '25

10 Mar '25

... very very sorry for this, what looks to be an exhausted topic. After reading many other posts, I found this which looks to be my issue however I am running free IPA version 4.9.13. were as the post indicate 4.9.12. https://bugs.rockylinux.org/view.php?id=5644 Suffice it to say would this fix still apply; /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --netbios-name YOURNETBIOSDOMAIN --add-sids And I am running Rocky 8.

3 8

Cannot create users on platform migration: sambaSID failure
by Melissa Ferreira da Silva Boiko 07 Mar '25

07 Mar '25

Hi, I'm trying to upgrade an ancient master replica (the CA master) running FreeIPA 4.5 on CentOS 7.4. Upgrading the freeipa packages in-place (in a cloned VM) caused numerous problems so I'm trying to create a new master replica on a fresh Fedora 39, using the "Migrating to different platform or OS" procedure described on https://www.freeipa.org/page/Howto/Migration At first sight the new replica appears to work, but user creation fails, both on the web and command-line, with: ipa user-add --first=Testy --last=McTestface teste123 ipa: ERROR: missing attribute "sambaSID" required by object class "sambaSamAccount" Web searches seem to suggest this is due to a missing DNA plugin that should autogenerate the sambaSIDs, but I failed to find a guide on how to enable that plugin with current IPA (4.11). Should it be enabled automatically? Unless it's used for something internal to IPA I don't think we actually are even using AD integration or SMB shares, so removing Samba support altogether would also be an option, but I don't know what's the safe way of doing that to the schema either. Thanks for your help!

3 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2025