Keycloak with FreeIPA federation / expired Password

[Jonatan Zint]

Hello!

I have a simple setup running keycloak 9.0.0 setup with LDAP user federation to my FreeIPA instance (4.8).
Runs smooth so far, but everytime a user changes his password in keycloak it is marked expired in FreeIPA and gets prompted to change it once trying to login in FreeIPA.

The very same issue popped up in this mail thread: https://www.redhat.com/archives/freeipa-users/2017-January/msg00393.html
The answer does not seem to be valid for freeipa 4.8 though, as the described DN doesn't even exist anymore. Searching through the RedHat docs i can see several configuration guides for windows AD password sync but not a mention how to fix it for keycloak.... Any hint what I could try here?

Best regards,

Jonatan

[Rob Crittenden]

Jonatan Zint via FreeIPA-users wrote:
> Hello!
>
> I have a simple setup running keycloak 9.0.0 setup with LDAP user federation to my FreeIPA instance (4.8).
> Runs smooth so far, but everytime a user changes his password in keycloak it is marked expired in FreeIPA and gets prompted to change it once trying to login in FreeIPA.
>
> The very same issue popped up in this mail thread: https://www.redhat.com/archives/freeipa-users/2017-January/msg00393.html
> The answer does not seem to be valid for freeipa 4.8 though, as the described DN doesn't even exist anymore. Searching through the RedHat docs i can see several configuration guides for windows AD password sync but not a mention how to fix it for keycloak.... Any hint what I could try here?

The procedure hasn't changed. You need to bind as Directory Manager to
change (or see) this part of the tree.

rob

[Jonatan Zint]

Hey rob,

thanks for quick reply. Am I doing something utterly stupid? Usually I
use ADS for ldap adminstration, I confirmed i use cn=Directory Manager
for connection, and I am not able to find 
cn=ipa_pwd_extop,cn=plugins,cn=config .

Same with ldapsearch:

ldapsearch -x -D "cn=Directory Manager"
cn=ipa_pwd_extop,cn=plugins,cn=config -W
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <dc=alt,dc=coop> (default) with scope subtree
# filter: cn=ipa_pwd_extop,cn=plugins,cn=config
# requesting: ALL
#

# search result
search: 2
result: 0 Success

# numResponses: 1

Thanks a lot,

Jonatan

Am Montag, den 23.03.2020, 16:27 -0400 schrieb Rob Crittenden:
> Jonatan Zint via FreeIPA-users wrote:
> > Hello!
> >
> > I have a simple setup running keycloak 9.0.0 setup with LDAP user
> > federation to my FreeIPA instance (4.8).
> > Runs smooth so far, but everytime a user changes his password in
> > keycloak it is marked expired in FreeIPA and gets prompted to
> > change it once trying to login in FreeIPA.
> >
> > The very same issue popped up in this mail thread: 
> > https://www.redhat.com/archives/freeipa-users/2017-January/msg00393.html
> > The answer does not seem to be valid for freeipa 4.8 though, as the
> > described DN doesn't even exist anymore. Searching through the
> > RedHat docs i can see several configuration guides for windows AD
> > password sync but not a mention how to fix it for keycloak.... Any
> > hint what I could try here?
>
> The procedure hasn't changed. You need to bind as Directory Manager
> to
> change (or see) this part of the tree.
>
> rob

[Rob Crittenden]

Jonatan Zint via FreeIPA-users wrote:
> Hey rob,
>
> thanks for quick reply. Am I doing something utterly stupid? Usually I
> use ADS for ldap adminstration, I confirmed i use cn=Directory Manager
> for connection, and I am not able to find 
> cn=ipa_pwd_extop,cn=plugins,cn=config .
>
> Same with ldapsearch:
>
> ldapsearch -x -D "cn=Directory Manager"
> cn=ipa_pwd_extop,cn=plugins,cn=config -W
> Enter LDAP Password: 
> # extended LDIF
> #
> # LDAPv3
> # base <dc=alt,dc=coop> (default) with scope subtree
> # filter: cn=ipa_pwd_extop,cn=plugins,cn=config
> # requesting: ALL
> #
>
> # search result
> search: 2
> result: 0 Success
>
> # numResponses: 1
>
> Thanks a lot,

Add -b before cn=ipa_pwd_extop...

rob
> Jonatan
>
> Am Montag, den 23.03.2020, 16:27 -0400 schrieb Rob Crittenden:
> > Jonatan Zint via FreeIPA-users wrote:
> > > Hello!
> > >
> > > I have a simple setup running keycloak 9.0.0 setup with LDAP user
> > > federation to my FreeIPA instance (4.8).
> > > Runs smooth so far, but everytime a user changes his password in
> > > keycloak it is marked expired in FreeIPA and gets prompted to
> > > change it once trying to login in FreeIPA.
> > >
> > > The very same issue popped up in this mail thread: 
> > > https://www.redhat.com/archives/freeipa-users/2017-January/msg00393.html
> > > The answer does not seem to be valid for freeipa 4.8 though, as the
> > > described DN doesn't even exist anymore. Searching through the
> > > RedHat docs i can see several configuration guides for windows AD
> > > password sync but not a mention how to fix it for keycloak.... Any
> > > hint what I could try here?
> >
> > The procedure hasn't changed. You need to bind as Directory Manager
> > to
> > change (or see) this part of the tree.
> >
> > rob
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Jonatan Zint]

Hey,

m-( thanks a bunch that did the trick. Now everything works smoothly as
expected, thanks!

Is there some place this is documented? Besides the extensive Manual on
how to set it up with AD I did not find any documentation on this
procedure.

Anyways, thanks a lot for guiding me.

Jonatan

Am Montag, den 23.03.2020, 18:18 -0400 schrieb Rob Crittenden:
> Jonatan Zint via FreeIPA-users wrote:
> > Hey rob,
> >
> > thanks for quick reply. Am I doing something utterly stupid?
> > Usually I
> > use ADS for ldap adminstration, I confirmed i use cn=Directory
> > Manager
> > for connection, and I am not able to find 
> > cn=ipa_pwd_extop,cn=plugins,cn=config .
> >
> > Same with ldapsearch:
> >
> > ldapsearch -x -D "cn=Directory Manager"
> > cn=ipa_pwd_extop,cn=plugins,cn=config -W
> > Enter LDAP Password: 
> > # extended LDIF
> > #
> > # LDAPv3
> > # base <dc=alt,dc=coop> (default) with scope subtree
> > # filter: cn=ipa_pwd_extop,cn=plugins,cn=config
> > # requesting: ALL
> > #
> >
> > # search result
> > search: 2
> > result: 0 Success
> >
> > # numResponses: 1
> >
> > Thanks a lot,
>
> Add -b before cn=ipa_pwd_extop...
>
> rob
> > Jonatan
> >
> > Am Montag, den 23.03.2020, 16:27 -0400 schrieb Rob Crittenden:
> > > Jonatan Zint via FreeIPA-users wrote:
> > > > Hello!
> > > >
> > > > I have a simple setup running keycloak 9.0.0 setup with LDAP
> > > > user
> > > > federation to my FreeIPA instance (4.8).
> > > > Runs smooth so far, but everytime a user changes his password
> > > > in
> > > > keycloak it is marked expired in FreeIPA and gets prompted to
> > > > change it once trying to login in FreeIPA.
> > > >
> > > > The very same issue popped up in this mail thread: 
> > > > https://www.redhat.com/archives/freeipa-users/2017-January/msg00393.html
> > > > The answer does not seem to be valid for freeipa 4.8 though, as
> > > > the
> > > > described DN doesn't even exist anymore. Searching through the
> > > > RedHat docs i can see several configuration guides for windows
> > > > AD
> > > > password sync but not a mention how to fix it for keycloak....
> > > > Any
> > > > hint what I could try here?
> > >
> > > The procedure hasn't changed. You need to bind as Directory
> > > Manager
> > > to
> > > change (or see) this part of the tree.
> > >
> > > rob
> >
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to 
> > [e-mail]
> > Fedora Code of Conduct: 
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: 
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: 
> > https://lists.fedorahosted.org/archives/list/[e-mail]...