Unable to Login using LDAP User

[Damola Azeez]

I've installed FreeIPA on all host I manage and everything has been fine until today
when had to reboot the whole hosts. Every other host worked except one. checking the log
file of the server, i saw the below error 

"[sssd[ldap_child[44316]]]: Client 'host/xxx@XXX' not found in Kerberos
database"

I've tried uninstalling the IP client and reinstalling it but i still have the same
issue.

Host: oracle linux 6.9
IPA server: IPA, version: 4.9.6

[Sumit Bose]

Am Tue, May 10, 2022 at 02:17:18PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  I've installed FreeIPA on all host I manage and everything has
> been fine until today when had to reboot the whole hosts. Every other host worked except
> one. checking the log file of the server, i saw the below error 
>  
>  "[sssd[ldap_child[44316]]]: Client 'host/xxx@XXX' not found in Kerberos
> database"
>  
>  I've tried uninstalling the IP client and reinstalling it but i still have the same
> issue. 
Hi,

is there a chance that the client got a hostname assigned via DHCP which
is different from the name at the time the client joined the FreeIPA
domain?

It might be possible to fix this by taking the hostname part from the
'klist -k' output, it's between '/' and '@' in the principal
'host/fully.qualified.hostname(a)IPA.REALM' and add it to the [domain/...]
section in sssd.conf as

    ipa_hostname = fully.qualified.hostname

ans restart SSSD.

HTH

bye,
Sumit

>  
>  Host: oracle linux 6.9
>  IPA server: IPA, version: 4.9.6
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Thanks Sumit,

There isn't any hostname assignment via dhcp. I checked the sssd.conf file and its
exactly as you recommended. i found another line of error when i checked the log now

[sssd[ldap_child[70480]]]: Failed to initialize credentials using keytab
[MEMORY:/etc/krb5.keytab]: Client 'host/xxx@xxx' not found in Kerberos database.
Unable to create GSSAPI-encrypted LDAP connection.

[Sumit Bose]

Am Tue, May 10, 2022 at 03:02:21PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  Thanks Sumit,
>  
>  There isn't any hostname assignment via dhcp. I checked the sssd.conf file and its
> exactly as you recommended. i found another line of error when i checked the log now
Hi,

and if the hostname in the 'klist -k' output or how does the output
looks like?

bye,
Sumit

>  
>  [sssd[ldap_child[70480]]]: Failed to initialize credentials using keytab
> [MEMORY:/etc/krb5.keytab]: Client 'host/xxx@xxx' not found in Kerberos database.
> Unable to create GSSAPI-encrypted LDAP connection.
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Output of 'klist -k'

Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   1 host/epmtestapp.xxx@XXX
   1 host/epmtestapp.xxx@XXX


It matches whats found in sssd.conf

"ipa_hostname = epmtestapp.xxx"

[Sumit Bose]

Am Tue, May 10, 2022 at 03:57:19PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  Output of 'klist -k'
>  
>  Keytab name: FILE:/etc/krb5.keytab
>  KVNO Principal
>  ---- --------------------------------------------------------------------------
>     1 host/epmtestapp.xxx@XXX
>     1 host/epmtestapp.xxx@XXX
>  
>  
>  It matches whats found in sssd.conf
>  
>  "ipa_hostname = epmtestapp.xxx" 
Hi,

ok, can you check on the ipa server if

    ipa host-show epmtestapp

returns anything and the output contains 'Keytab: True'?

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Hi,

below is the output of ipa host-show epmtestapp


Host name: epmtestapp.xxx
  Platform: x86_64
  Operating system: 4.1.12-124.16.4.el6uek.x86_64
  Certificate: ---
  Subject: CN=epmtestapp.xxx,O=XXX
  Serial Number: 13
  Serial Number (hex): 0xD
  Issuer: CN=Certificate Authority,O=XXX
  Not Before: Tue May 10 13:28:34 2022 UTC
  Not After: Fri May 10 13:28:34 2024 UTC
  Fingerprint (SHA1): ---
  Fingerprint (SHA256): ---
  Principal name: host/epmtestapp.xxx@XXX
  Principal alias: host/epmtestapp.xxx@XXX
  SSH public key fingerprint: SHA256:--- (ssh-rsa), SHA256:--- (ssh-dss)
  Password: False
  Member of Sudo rule: dba team
  Keytab: True
  Managed by: epmtestapp.xxx

[Sumit Bose]

Am Wed, May 11, 2022 at 08:47:49AM -0000 schrieb Damola Azeez via FreeIPA-users:
>  Hi,
>  
>  below is the output of ipa host-show epmtestapp
>  
>  
>  Host name: epmtestapp.xxx
>    Platform: x86_64
>    Operating system: 4.1.12-124.16.4.el6uek.x86_64
>    Certificate: ---
>    Subject: CN=epmtestapp.xxx,O=XXX
>    Serial Number: 13
>    Serial Number (hex): 0xD
>    Issuer: CN=Certificate Authority,O=XXX
>    Not Before: Tue May 10 13:28:34 2022 UTC
>    Not After: Fri May 10 13:28:34 2024 UTC
>    Fingerprint (SHA1): ---
>    Fingerprint (SHA256): ---
>    Principal name: host/epmtestapp.xxx@XXX
>    Principal alias: host/epmtestapp.xxx@XXX
>    SSH public key fingerprint: SHA256:--- (ssh-rsa), SHA256:--- (ssh-dss)
>    Password: False
>    Member of Sudo rule: dba team
>    Keytab: True
>    Managed by: epmtestapp.xxx 
Hi,

this looks good. Please try on the client

    KRB5_TRACE=/dev/stdout kinit -k 'host/epmtestapp.xxx@XXX'

and send the output?

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Hi,

Output below

KRB5_TRACE=/dev/stdout kinit -k 'host/epmtestapp.xxx@XXX'
[90987] 1652261211.989907: Getting initial credentials for host/epmtestapp.xxx@XXX
[90987] 1652261211.990289: Looked up etypes in keytab: aes256-cts, aes128-cts
[90987] 1652261211.990325: Sending request (219 bytes) to XXX
[90987] 1652261211.990466: Initiating TCP connection to stream 192.168.101.160:88
[90987] 1652261211.990904: Sending TCP request to stream 192.168.101.160:88
[90987] 1652261211.992858: Received answer from stream 192.168.101.160:88
[90987] 1652261211.992904: Response was from master KDC
[90987] 1652261211.992933: Received error from KDC: -1765328359/Additional
pre-authentication required
[90987] 1652261211.992961: Processing preauth types: 16, 136, 19, 147, 151, 2, 133
[90987] 1652261211.992971: Selected etype info: etype aes256-cts, salt
"XXXhostepmtestapp.xxx", params ""
[90987] 1652261211.992979: Received cookie: MIT1
[90987] 1652261211.993021: Retrieving host/epmtestapp.xxx@XXX from FILE:/etc/krb5.keytab
(vno 0, enctype aes256-cts) with result: 0/Success
[90987] 1652261211.993046: AS key obtained for encrypted timestamp: aes256-cts/C287
[90987] 1652261211.993083: Encrypted timestamp (for 1652261211.993052): plain
301AA011180F32303232303531313039323635315AA10502030F271C, encrypted
08289D768F7FF06911527C7B951D405E1893E39B351717C87677C41E4F0B94647EDDB9F9D1573414F7AE95F7C817D3B9188128CC3F960FA1
[90987] 1652261211.993100: Preauth module encrypted_timestamp (2) (flags=1) returned:
0/Success
[90987] 1652261211.993106: Produced preauth for next request: 133, 2
[90987] 1652261211.993126: Sending request (454 bytes) to XXX
[90987] 1652261211.993171: Initiating TCP connection to stream 192.168.101.160:88
[90987] 1652261211.993340: Sending TCP request to stream 192.168.101.160:88
[90987] 1652261211.995463: Received answer from stream 192.168.101.160:88
[90987] 1652261211.995509: Response was from master KDC
[90987] 1652261211.995543: Processing preauth types: 19
[90987] 1652261211.995553: Selected etype info: etype aes256-cts, salt
"XXXhostepmtestapp.xxx", params ""
[90987] 1652261211.995561: Produced preauth for next request: (empty)
[90987] 1652261211.995572: AS key determined by preauth: aes256-cts/C287
[90987] 1652261211.995605: Decrypted AS reply; session key is: aes256-cts/D2C2
[90987] 1652261211.995630: FAST negotiation: available
[90987] 1652261211.995656: Initializing FILE:/tmp/krb5cc_0 with default princ
host/epmtestapp.xxx@XXX
[90987] 1652261211.995838: Removing host/epmtestapp.xxx@XXX -> krbtgt/XXX@XXX from
FILE:/tmp/krb5cc_0
[90987] 1652261211.995855: Storing host/epmtestapp.xxx@XXX -> krbtgt/XXX@XXX in
FILE:/tmp/krb5cc_0
[90987] 1652261211.995948: Storing config in FILE:/tmp/krb5cc_0 for krbtgt/XXX@XXX:
fast_avail: yes
[90987] 1652261211.995984: Removing host/epmtestapp.xxx@XXX ->
krb5_ccache_conf_data/fast_avail/krbtgt\/XXX\@XXX@X-CACHECONF: from FILE:/tmp/krb5cc_0
[90987] 1652261211.995997: Storing host/epmtestapp.xxx@XXX ->
krb5_ccache_conf_data/fast_avail/krbtgt\/XXX\@XXX@X-CACHECONF: in FILE:/tmp/krb5cc_0

[Sumit Bose]

Am Wed, May 11, 2022 at 12:14:56PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  Hi,
>  
>  Output below 
Hi,

thanks, so this is working as expected, SSSD's ldap_child basically does
the same. Can you add 'debug_level = 9' to the [domain/...] section of
sssd.conf, restart SSSD, try to lookup some users and then send
ldap_child.log?

bye,
Sumit

>  
>  KRB5_TRACE=/dev/stdout kinit -k 'host/epmtestapp.xxx@XXX'
>  [90987] 1652261211.989907: Getting initial credentials for host/epmtestapp.xxx@XXX
>  [90987] 1652261211.990289: Looked up etypes in keytab: aes256-cts, aes128-cts
>  [90987] 1652261211.990325: Sending request (219 bytes) to XXX
>  [90987] 1652261211.990466: Initiating TCP connection to stream 192.168.101.160:88
>  [90987] 1652261211.990904: Sending TCP request to stream 192.168.101.160:88
>  [90987] 1652261211.992858: Received answer from stream 192.168.101.160:88
>  [90987] 1652261211.992904: Response was from master KDC
>  [90987] 1652261211.992933: Received error from KDC: -1765328359/Additional
> pre-authentication required
>  [90987] 1652261211.992961: Processing preauth types: 16, 136, 19, 147, 151, 2, 133
>  [90987] 1652261211.992971: Selected etype info: etype aes256-cts, salt
> "XXXhostepmtestapp.xxx", params ""
>  [90987] 1652261211.992979: Received cookie: MIT1
>  [90987] 1652261211.993021: Retrieving host/epmtestapp.xxx@XXX from FILE:/etc/krb5.keytab
> (vno 0, enctype aes256-cts) with result: 0/Success
>  [90987] 1652261211.993046: AS key obtained for encrypted timestamp: aes256-cts/C287
>  [90987] 1652261211.993083: Encrypted timestamp (for 1652261211.993052): plain
> 301AA011180F32303232303531313039323635315AA10502030F271C, encrypted
> 08289D768F7FF06911527C7B951D405E1893E39B351717C87677C41E4F0B94647EDDB9F9D1573414F7AE95F7C817D3B9188128CC3F960FA1
>  [90987] 1652261211.993100: Preauth module encrypted_timestamp (2) (flags=1) returned:
> 0/Success
>  [90987] 1652261211.993106: Produced preauth for next request: 133, 2
>  [90987] 1652261211.993126: Sending request (454 bytes) to XXX
>  [90987] 1652261211.993171: Initiating TCP connection to stream 192.168.101.160:88
>  [90987] 1652261211.993340: Sending TCP request to stream 192.168.101.160:88
>  [90987] 1652261211.995463: Received answer from stream 192.168.101.160:88
>  [90987] 1652261211.995509: Response was from master KDC
>  [90987] 1652261211.995543: Processing preauth types: 19
>  [90987] 1652261211.995553: Selected etype info: etype aes256-cts, salt
> "XXXhostepmtestapp.xxx", params ""
>  [90987] 1652261211.995561: Produced preauth for next request: (empty)
>  [90987] 1652261211.995572: AS key determined by preauth: aes256-cts/C287
>  [90987] 1652261211.995605: Decrypted AS reply; session key is: aes256-cts/D2C2
>  [90987] 1652261211.995630: FAST negotiation: available
>  [90987] 1652261211.995656: Initializing FILE:/tmp/krb5cc_0 with default princ
> host/epmtestapp.xxx@XXX
>  [90987] 1652261211.995838: Removing host/epmtestapp.xxx@XXX -> krbtgt/XXX@XXX from
> FILE:/tmp/krb5cc_0
>  [90987] 1652261211.995855: Storing host/epmtestapp.xxx@XXX -> krbtgt/XXX@XXX in
> FILE:/tmp/krb5cc_0
>  [90987] 1652261211.995948: Storing config in FILE:/tmp/krb5cc_0 for krbtgt/XXX@XXX:
> fast_avail: yes
>  [90987] 1652261211.995984: Removing host/epmtestapp.xxx@XXX ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/XXX\@XXX@X-CACHECONF: from FILE:/tmp/krb5cc_0
>  [90987] 1652261211.995997: Storing host/epmtestapp.xxx@XXX ->
> krb5_ccache_conf_data/fast_avail/krbtgt\/XXX\@XXX@X-CACHECONF: in FILE:/tmp/krb5cc_0
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Hi,

The above should be done on the IPA client right?

[Sumit Bose]

Am Wed, May 11, 2022 at 02:19:23PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  Hi,
>  
>  The above should be done on the IPA client right? 
Hi,

yes.

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Hi Sumit, Thanks for the assistance.

Please find the ldap_child.log file in the link below

https://pastebin.com/pKp1tvCt

[Sumit Bose]

Am Wed, May 11, 2022 at 03:10:06PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  Hi Sumit, Thanks for the assistance.
>  
>  Please find the ldap_child.log file in the link below
>  
>  https://pastebin.com/pKp1tvCt 
Hi,

thanks for the log. It looks like the KDC with the IP address
192.168.101.160 knows about the client and can return a ticket, similar
as with manual 'kinit -k'.

There are other KDCs with IP addresses 192.168.100.231, 192.168.100.232
and 192.168.103.24 which are returning 'Client not found in Kerberos
database'. Do those IP addresses belong to other IPA servers?

Are all those 4 addresses listed when you call

    dig -t SRV _kerberos._tcp.xxx

where 'xxx' is the IPA dns domain which you have sanitized out?

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

From the dig -t SRV _kerberos._tcp.xxx output,

192.168.101.160 which is the IPA server didn't show. The other 3 IP addresses showed
up. Those 3 IP addresses act as the DNS server and AD server for the Windows environment.

[Sumit Bose]

Am Thu, May 12, 2022 at 09:58:40AM -0000 schrieb Damola Azeez via FreeIPA-users:
>  From the dig -t SRV _kerberos._tcp.xxx output,
>  
>  192.168.101.160 which is the IPA server didn't show. The other 3 IP addresses showed
> up. Those 3 IP addresses act as the DNS server and AD server for the Windows environment.
Hi,

does this mean you are using the same DNS domain and realm for the IPA
and AD environments?

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Damola Azeez]

Hi Sumit,

Yes, Same domain.

[Alexander Bokovoy]

On pe, 13 touko 2022, Damola Azeez via FreeIPA-users wrote:
> Hi Sumit,
>
> Yes, Same domain. 
So you have unsupported configuration which is clearly described in RHEL
IdM documentation as well as at https://www.freeipa.org/page/Deployment_Recommendations:

--------------------------------------------------------------------
Domain
FreeIPA should always have own primary domain, e.g. example.com or
ipa.example.com which should not be shared with other Kerberos based
identity management system as otherwise there will be collisions on
Kerberos system level. 
--------------------------------------------------------------------

This is a fundamental requirement.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Damola Azeez]

What if i use the host file for name resolution?

[Sumit Bose]

Am Mon, May 16, 2022 at 01:20:27PM -0000 schrieb Damola Azeez via FreeIPA-users:
>  What if i use the host file for name resolution? 
Hi,

this would not be sufficient. With careful manual configuration in
multiple configuration files you might be able to get some features
working. But this would still be fragile and the majority of the
features still won't work.

The way forward is to create a new DNS domain/Kerberos realm for the IPA
domain and setup a new IPA instance. If there are client which are
currently in the AD DNS domain which should be part of the IPA DNS
domain you should prepare a concept or design how those clients can be
migrated into a new domain and still offer the services to hosts from
the AD domain.

bye,
Sumit

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Bayo A]

Hello,

I have a similar issue with one of the clients configured in my environment.
I used the hosts file of the linux and unix servers for name resolution as I didn't
want to create an additional DNS server since there's a primary DNS on windows with AD
configured.
What steps can I use to resolve this?

Bayo

[Rob Crittenden]

Bayo A via FreeIPA-users wrote:
>  Hello,
>  
>  I have a similar issue with one of the clients configured in my environment.
>  I used the hosts file of the linux and unix servers for name resolution as I didn't
> want to create an additional DNS server since there's a primary DNS on windows with AD
> configured.
>  What steps can I use to resolve this? 
Steps to resolve what?

Do your IPA and AD realms use the same name? If so see previous replies.

rob

[Bayo A]

Hi Rob,

The error Client 'host/xxx@XXX' not found in Kerberos
database" which I'm also having in my environment.

My IPA and AD realms use the same name however I'm not using DNS in my implementation
as well. The records of both the client and IPA-server are contained in the host file of
the servers thus all name resolution is done locally without the need for a DNS server.

[Sumit Bose]

Am Tue, May 17, 2022 at 01:32:15PM -0000 schrieb Bayo A via FreeIPA-users:
>  Hi Rob,
>  
>  The error Client 'host/xxx@XXX' not found in Kerberos
>  database" which I'm also having in my environment.
>  
>  My IPA and AD realms use the same name however I'm not using DNS in my implementation
> as well. The records of both the client and IPA-server are contained in the host file of
> the servers thus all name resolution is done locally without the need for a DNS server.
Hi,

just skipping DNS host lookups is not sufficient. As Alexander already
said in this thread:

"""
So you have unsupported configuration which is clearly described in RHEL
IdM documentation as well as at
https://www.freeipa.org/page/Deployment_Recommendations:

--------------------------------------------------------------------
Domain
FreeIPA should always have own primary domain, e.g. example.com or
ipa.example.com which should not be shared with other Kerberos based
identity management system as otherwise there will be collisions on
Kerberos system level.
--------------------------------------------------------------------

This is a fundamental requirement.
"""

bye,
Sumit
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure