Using Vaults with AD User // Groups

[Rami Elias (TECH V)]

Freeipa Problem
we have a freeipa --> ad setup (one way trust)
our problem is we cant get external ad user // groups to work
what we did:
we added the trust:
Trust Settings
Realm name
domain.at
Domain NetBIOS name
DOMAIN
Domain Security Identifier
S-1-5-21-2435101603-3558199190-xxxxxxx
Trust direction
Trusting forest
Trust type
Active Directory domain
we have trusted domains:
domain.at
Enabled
DOMAIN
S-1-5-21-2435101603-3558199190-xxxxxxx
the global trust config looks like:
Domain
lx.domain.at
Security Identifier
S-1-5-21-3255425601-626398459-xxxxxx
NetBIOS name
LX
Domain GUID
671b2faa-5129-4a5c-a410-xxxxxxx
Fallback primary group
Default SMB Group
IPA AD trust agents
ipa-ihs-prod-c81.lx.domain.at
ipa-ihs-prod-c82.lx.domain.at
ipa-ihs-test-c81.lx.domain.at
ipa-ihs-test-c82.lx.domain.at
ipa-web-prod-c81.lx.domain.at
ipa-web-prod-c82.lx.domain.at
ipa-web-test-c81.lx.domain.at
ipa-web-test-c82.lx.domain.at
IPA AD trust controllers
ipa-ihs-prod-c81.lx.domain.at
ipa-ihs-prod-c82.lx.domain.at
ipa-ihs-test-c81.lx.domain.at
ipa-ihs-test-c82.lx.domain.at
ipa-web-prod-c81.lx.domain.at
ipa-web-prod-c82.lx.domain.at
ipa-web-test-c81.lx.domain.at
ipa-web-test-c82.lx.domain.at
we have those id ranges:
LX.DOMAIN.AT_id_range
224200000
200000
local domain range
DOMAIN.AT_id_range
800000000
200000
Active Directory domain range
we executed following commands for external group like described in
https://www.freeipa.org/page/Active_Directory_trust_setup#Allow_access_fo...
ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung_ext --external
ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung
u0-erdberg-verwaltung
224200005
u0-erdberg
ipa group-add-member u0-erdberg-verwaltung_ext --external
'DOMAIN\u0-erdberg-verwaltung'
ipa group-add-member u0-erdberg-verwaltung --groups u0-erdberg-verwaltung_ext
now i login to a freeipa managed host or an ipa server with
ssh -l ad_user(a)domain.at server.lx.domain.at
and check my groups i get:
224200005(u0-erdberg-verwaltung) which is the freeipa group
800089798(u0-erdberg-verwaltung(a)domain.at) which is the ad group
now i added roles to the ipa group and the ipa ext group:
User Group: u0-erdberg-verwaltung
Role name
helpdesk
Enrollment Administrator
vault_admin
Smart Proxy Host Manager
IT Specialist
Security Architect
IT Security Specialist
User Administrator
User Group: u0-erdberg-verwaltung_ext
Role name
IT Security Specialist
vault_admin
Smart Proxy Host Manager
User Administrator
Security Architect
IT Specialist
helpdesk
Enrollment Administrator
now the fail happens:
ipa vault-add test --type=standard
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at' .
    },
    "id": 0,
    "principal": "ad_user(a)DOMAIN.AT",
    "result": null,
    "version": "4.7.1"
}
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
[[e-mail](a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test --type=standard
ipa: INFO: Request: {
    "id": 0,
    "method": "ping",
    "params": [
        [],
        {}
    ]
}
ipa: INFO: Response: {
    "error": null,
    "id": 0,
    "principal": "ad_user(a)DOMAIN.AT",
    "result": {
        "messages": [
            {
                "code": 13001,
                "data": {
                    "server_version": "2.230"
                },
                "message": "API Version number was not sent, forward
compatibility not guaranteed. Assuming server's API version, 2.230",
                "name": "VersionMissing",
                "type": "warning"
            }
        ],
        "summary": "IPA server version 4.7.1. API version 2.230"
    },
    "version": "4.7.1"
}
ipa: INFO: Request: {
    "id": 0,
    "method": "vault_add_internal/1",
    "params": [
        [
            "test"
        ],
        {
            "ipavaulttype": "standard",
            "version": "2.230"
        }
    ]
}
ipa: INFO: Response: {
    "error": {
        "code": 2100,
        "data": {
            "info": "Insufficient 'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
        },
        "message": "Insufficient access: Insufficient 'add'
privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
        "name": "ACIError"
    },
    "id": 0,
    "principal": "ad_user(a)DOMAIN.AT",
    "result": null,
    "version": "4.7.1"
}
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
[[e-mail](a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test --type=standard
ipa: INFO: Request: {
    "id": 0,
    "method": "ping",
    "params": [
        [],
        {}
    ]
}
ipa: INFO: Response: {
    "error": null,
    "id": 0,
    "principal": "ad_user(a)DOMAIN.AT",
    "result": {
        "messages": [
            {
                "code": 13001,
                "data": {
                    "server_version": "2.230"
                },
                "message": "API Version number was not sent, forward
compatibility not guaranteed. Assuming server's API version, 2.230",
                "name": "VersionMissing",
                "type": "warning"
            }
        ],
        "summary": "IPA server version 4.7.1. API version 2.230"
    },
    "version": "4.7.1"
}
ipa: INFO: Request: {
    "id": 0,
    "method": "vault_add_internal/1",
    "params": [
        [
            "test"
        ],
        {
            "ipavaulttype": "standard",
            "version": "2.230"
        }
    ]
}
ipa: INFO: Response: {
    "error": {
        "code": 2100,
        "data": {
            "info": "Insufficient 'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
        },
        "message": "Insufficient access: Insufficient 'add'
privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
        "name": "ACIError"
    },
    "id": 0,
    "principal": "ad_user(a)DOMAIN.AT",
    "result": null,
    "version": "4.7.1"
}
ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
--
ÖAMTC I BAUMGASSE 129 I 1030 WIEN
Elias Rami | Devops Engineer
M [phone]
elias.rami(a)oeamtc.at | www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108

________________________________

Schenken Sie ein gutes Gefühl!
Jetzt online ÖAMTC Wertgutschein kaufen,
z.B. für Schutzbrief, Autobahnvignette, Reisen, Fahrtechnik, uvm.
www.oeamtc-gutschein.at<https://www.oeamtc-gutschein.at>


________________________________
Wichtiger Hinweis/Important Information:

Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail
sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt
firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in
vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten
Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen
verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder
Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt
dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen
Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail
von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet.

This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via
e-mail are not legally binding but require written confirmation including the signatures
of the required number of managing directors under statutory provisions. We are not liable
for the accuracy and sufficiency of the provided information/data, for any transmission
error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no
confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the
addressee or his representative, please notify the sender immediately and delete this
e-mail from your system. Any disclosure or use is prohibited.

________________________________

[Alexander Bokovoy]

Hi Rami,

On to, 19 joulu 2019, Rami Elias (TECH V) via FreeIPA-users wrote:
> Freeipa Problem
> we have a freeipa --> ad setup (one way trust)
> our problem is we cant get external ad user // groups to work 
(your mail client did terrible formatting)

The issue you have is that external groups in IPA aren't used for ACI
handling in LDAP. So any access to vaults is not granted even by
assigning roles to the group that has external member.

If you are using RHEL 8.x, you should do

 yum module install idm:DL1/adtrust

this will bring ipa-idoverride-memberof package which provide a plugin
to add ID overrides from the Default trust view as members of IPA groups
for the purpose of LDAP ACI checks. See the following documentation
section for details:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...


> what we did:
> we added the trust:
> Trust Settings
> Realm name
> domain.at
> Domain NetBIOS name
> DOMAIN
> Domain Security Identifier
> S-1-5-21-2435101603-3558199190-xxxxxxx
> Trust direction
> Trusting forest
> Trust type
> Active Directory domain
> we have trusted domains:
> domain.at
> Enabled
> DOMAIN
> S-1-5-21-2435101603-3558199190-xxxxxxx
> the global trust config looks like:
> Domain
> lx.domain.at
> Security Identifier
> S-1-5-21-3255425601-626398459-xxxxxx
> NetBIOS name
> LX
> Domain GUID
> 671b2faa-5129-4a5c-a410-xxxxxxx
> Fallback primary group
> Default SMB Group
> IPA AD trust agents
> ipa-ihs-prod-c81.lx.domain.at
> ipa-ihs-prod-c82.lx.domain.at
> ipa-ihs-test-c81.lx.domain.at
> ipa-ihs-test-c82.lx.domain.at
> ipa-web-prod-c81.lx.domain.at
> ipa-web-prod-c82.lx.domain.at
> ipa-web-test-c81.lx.domain.at
> ipa-web-test-c82.lx.domain.at
> IPA AD trust controllers
> ipa-ihs-prod-c81.lx.domain.at
> ipa-ihs-prod-c82.lx.domain.at
> ipa-ihs-test-c81.lx.domain.at
> ipa-ihs-test-c82.lx.domain.at
> ipa-web-prod-c81.lx.domain.at
> ipa-web-prod-c82.lx.domain.at
> ipa-web-test-c81.lx.domain.at
> ipa-web-test-c82.lx.domain.at
> we have those id ranges:
> LX.DOMAIN.AT_id_range
> 224200000
> 200000
> local domain range
> DOMAIN.AT_id_range
> 800000000
> 200000
> Active Directory domain range
> we executed following commands for external group like described in
> https://www.freeipa.org/page/Active_Directory_trust_setup#Allow_access_fo...
> ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung_ext --external
> ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung
> u0-erdberg-verwaltung
> 224200005
> u0-erdberg
> ipa group-add-member u0-erdberg-verwaltung_ext --external
> 'DOMAIN\u0-erdberg-verwaltung'
> ipa group-add-member u0-erdberg-verwaltung --groups u0-erdberg-verwaltung_ext
> now i login to a freeipa managed host or an ipa server with
> ssh -l ad_user(a)domain.at server.lx.domain.at
> and check my groups i get:
> 224200005(u0-erdberg-verwaltung) which is the freeipa group
> 800089798(u0-erdberg-verwaltung(a)domain.at) which is the ad group
> now i added roles to the ipa group and the ipa ext group:
> User Group: u0-erdberg-verwaltung
> Role name
> helpdesk
> Enrollment Administrator
> vault_admin
> Smart Proxy Host Manager
> IT Specialist
> Security Architect
> IT Security Specialist
> User Administrator
> User Group: u0-erdberg-verwaltung_ext
> Role name
> IT Security Specialist
> vault_admin
> Smart Proxy Host Manager
> User Administrator
> Security Architect
> IT Specialist
> helpdesk
> Enrollment Administrator
> now the fail happens:
> ipa vault-add test --type=standard
> ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at' .
>     },
>     "id": 0,
>     "principal": "ad_user(a)DOMAIN.AT",
>     "result": null,
>     "version": "4.7.1"
> }
> ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
> [[e-mail](a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test --type=standard
> ipa: INFO: Request: {
>     "id": 0,
>     "method": "ping",
>     "params": [
>         [],
>         {}
>     ]
> }
> ipa: INFO: Response: {
>     "error": null,
>     "id": 0,
>     "principal": "ad_user(a)DOMAIN.AT",
>     "result": {
>         "messages": [
>             {
>                 "code": 13001,
>                 "data": {
>                     "server_version": "2.230"
>                 },
>                 "message": "API Version number was not sent, forward
> compatibility not guaranteed. Assuming server's API version, 2.230",
>                 "name": "VersionMissing",
>                 "type": "warning"
>             }
>         ],
>         "summary": "IPA server version 4.7.1. API version 2.230"
>     },
>     "version": "4.7.1"
> }
> ipa: INFO: Request: {
>     "id": 0,
>     "method": "vault_add_internal/1",
>     "params": [
>         [
>             "test"
>         ],
>         {
>             "ipavaulttype": "standard",
>             "version": "2.230"
>         }
>     ]
> }
> ipa: INFO: Response: {
>     "error": {
>         "code": 2100,
>         "data": {
>             "info": "Insufficient 'add' privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
>         },
>         "message": "Insufficient access: Insufficient 'add'
> privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
>         "name": "ACIError"
>     },
>     "id": 0,
>     "principal": "ad_user(a)DOMAIN.AT",
>     "result": null,
>     "version": "4.7.1"
> }
> ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
> [[e-mail](a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test --type=standard
> ipa: INFO: Request: {
>     "id": 0,
>     "method": "ping",
>     "params": [
>         [],
>         {}
>     ]
> }
> ipa: INFO: Response: {
>     "error": null,
>     "id": 0,
>     "principal": "ad_user(a)DOMAIN.AT",
>     "result": {
>         "messages": [
>             {
>                 "code": 13001,
>                 "data": {
>                     "server_version": "2.230"
>                 },
>                 "message": "API Version number was not sent, forward
> compatibility not guaranteed. Assuming server's API version, 2.230",
>                 "name": "VersionMissing",
>                 "type": "warning"
>             }
>         ],
>         "summary": "IPA server version 4.7.1. API version 2.230"
>     },
>     "version": "4.7.1"
> }
> ipa: INFO: Request: {
>     "id": 0,
>     "method": "vault_add_internal/1",
>     "params": [
>         [
>             "test"
>         ],
>         {
>             "ipavaulttype": "standard",
>             "version": "2.230"
>         }
>     ]
> }
> ipa: INFO: Response: {
>     "error": {
>         "code": 2100,
>         "data": {
>             "info": "Insufficient 'add' privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
>         },
>         "message": "Insufficient access: Insufficient 'add'
> privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
>         "name": "ACIError"
>     },
>     "id": 0,
>     "principal": "ad_user(a)DOMAIN.AT",
>     "result": null,
>     "version": "4.7.1"
> }
> ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add the entry
> 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
> --
> ÖAMTC I BAUMGASSE 129 I 1030 WIEN
> Elias Rami | Devops Engineer
> M [phone]
> elias.rami(a)oeamtc.at | www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108
>
> ________________________________
>
> Schenken Sie ein gutes Gefühl!
> Jetzt online ÖAMTC Wertgutschein kaufen,
> z.B. für Schutzbrief, Autobahnvignette, Reisen, Fahrtechnik, uvm.
> www.oeamtc-gutschein.at<https://www.oeamtc-gutschein.at>
>
>
> ________________________________
> Wichtiger Hinweis/Important Information:
>
> Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail
> sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt
> firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in
> vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten
> Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen
> verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder
> Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt
> dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen
> Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail
> von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet.
>
> This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via
> e-mail are not legally binding but require written confirmation including the signatures
> of the required number of managing directors under statutory provisions. We are not liable
> for the accuracy and sufficiency of the provided information/data, for any transmission
> error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no
> confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the
> addressee or his representative, please notify the sender immediately and delete this
> e-mail from your system. Any disclosure or use is prohibited.
>
> ________________________________
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]... 
-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Rami Elias (TECH V)]

Hello,

thank you for your fast investigation;

we are on centos 8 and we have the following packages:


- name: install freeipa packages
  dnf:
   name:
      - ipa-server
      - ipa-server-dns
      - ipa-server-trust-ad
      - ipa-idoverride-memberof-plugin
   state: installed

yes, im sorry for that idiotic formatting, my mail client somehow removed the newlines i
was just able to see it after i already sent it ..


we got it working by the link you provided:
ipa group-add-member u0-erdberg-verwaltung --idoverrideusers=ad_user(a)ad.example.com

so really thank you for your help, just one LAST question:

is this somehow possible on group basis? (id override group?) we dont want to have to
manage all of our ad users we want to manage some groups in which are assigned to the
users?

best regards,

--
ÖAMTC I BAUMGASSE 129 I 1030 WIEN
Elias Rami | Devops Engineer
M [phone]
elias.rami(a)oeamtc.at | www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108


On 2019-12-19 17:11:29+01:00 Alexander Bokovoy wrote:

Hi Rami,

On to, 19 joulu 2019, Rami Elias (TECH V) via FreeIPA-users wrote:
&amp;gt;Freeipa Problem
&amp;gt;we have a freeipa --&amp;gt; ad setup (one way trust)
&amp;gt;our problem is we cant get external ad user // groups to work

(your mail client did terrible formatting)

The issue you have is that external groups in IPA aren't used for ACI
handling in LDAP. So any access to vaults is not granted even by
assigning roles to the group that has external member.

If you are using RHEL 8.x, you should do

 yum module install idm:DL1/adtrust

this will bring ipa-idoverride-memberof package which provide a plugin
to add ID overrides from the Default trust view as members of IPA groups
for the purpose of LDAP ACI checks. See the following documentation
section for details:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...


&amp;gt;what we did:
&amp;gt;we added the trust:
&amp;gt;Trust Settings
&amp;gt;Realm name
&amp;gt;domain.at
&amp;gt;Domain NetBIOS name
&amp;gt;DOMAIN
&amp;gt;Domain Security Identifier
&amp;gt;S-1-5-21-2435101603-3558199190-xxxxxxx
&amp;gt;Trust direction
&amp;gt;Trusting forest
&amp;gt;Trust type
&amp;gt;Active Directory domain
&amp;gt;we have trusted domains:
&amp;gt;domain.at
&amp;gt;Enabled
&amp;gt;DOMAIN
&amp;gt;S-1-5-21-2435101603-3558199190-xxxxxxx
&amp;gt;the global trust config looks like:
&amp;gt;Domain
&amp;gt;lx.domain.at
&amp;gt;Security Identifier
&amp;gt;S-1-5-21-3255425601-626398459-xxxxxx
&amp;gt;NetBIOS name
&amp;gt;LX
&amp;gt;Domain GUID
&amp;gt;671b2faa-5129-4a5c-a410-xxxxxxx
&amp;gt;Fallback primary group
&amp;gt;Default SMB Group
&amp;gt;IPA AD trust agents
&amp;gt;ipa-ihs-prod-c81.lx.domain.at
&amp;gt;ipa-ihs-prod-c82.lx.domain.at
&amp;gt;ipa-ihs-test-c81.lx.domain.at
&amp;gt;ipa-ihs-test-c82.lx.domain.at
&amp;gt;ipa-web-prod-c81.lx.domain.at
&amp;gt;ipa-web-prod-c82.lx.domain.at
&amp;gt;ipa-web-test-c81.lx.domain.at
&amp;gt;ipa-web-test-c82.lx.domain.at
&amp;gt;IPA AD trust controllers
&amp;gt;ipa-ihs-prod-c81.lx.domain.at
&amp;gt;ipa-ihs-prod-c82.lx.domain.at
&amp;gt;ipa-ihs-test-c81.lx.domain.at
&amp;gt;ipa-ihs-test-c82.lx.domain.at
&amp;gt;ipa-web-prod-c81.lx.domain.at
&amp;gt;ipa-web-prod-c82.lx.domain.at
&amp;gt;ipa-web-test-c81.lx.domain.at
&amp;gt;ipa-web-test-c82.lx.domain.at
&amp;gt;we have those id ranges:
&amp;gt;LX.DOMAIN.AT_id_range
&amp;gt;224200000
&amp;gt;200000
&amp;gt;local domain range
&amp;gt;DOMAIN.AT_id_range
&amp;gt;800000000
&amp;gt;200000
&amp;gt;Active Directory domain range
&amp;gt;we executed following commands for external group like described in
https://www.freeipa.org/page/Active_Directory_trust_setup#Allow_access_fo...
&amp;gt;ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung_ext
--external
&amp;gt;ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung
&amp;gt;u0-erdberg-verwaltung
&amp;gt;224200005
&amp;gt;u0-erdberg
&amp;gt;ipa group-add-member u0-erdberg-verwaltung_ext --external
'DOMAIN\u0-erdberg-verwaltung'
&amp;gt;ipa group-add-member u0-erdberg-verwaltung --groups
u0-erdberg-verwaltung_ext
&amp;gt;now i login to a freeipa managed host or an ipa server with
&amp;gt;ssh -l ad_user(a)domain.at server.lx.domain.at
&amp;gt;and check my groups i get:
&amp;gt;224200005(u0-erdberg-verwaltung) which is the freeipa group
&amp;amp;gt;800089798(u0-erdberg-verwaltung(a)domain.at) which is the ad group
&amp;gt;now i added roles to the ipa group and the ipa ext group:
&amp;gt;User Group: u0-erdberg-verwaltung
&amp;gt;Role name
&amp;gt;helpdesk
&amp;gt;Enrollment Administrator
&amp;gt;vault_admin
&amp;gt;Smart Proxy Host Manager
&amp;gt;IT Specialist
&amp;gt;Security Architect
&amp;gt;IT Security Specialist
&amp;gt;User Administrator
&amp;gt;User Group: u0-erdberg-verwaltung_ext
&amp;gt;Role name
&amp;gt;IT Security Specialist
&amp;gt;vault_admin
&amp;gt;Smart Proxy Host Manager
&amp;gt;User Administrator
&amp;gt;Security Architect
&amp;gt;IT Specialist
&amp;gt;helpdesk
&amp;gt;Enrollment Administrator
&amp;gt;now the fail happens:
&amp;gt;ipa vault-add test --type=standard
&amp;gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at' .
&amp;gt;    },
&amp;gt;    "id": 0,
&amp;gt;    "principal": &quot;ad_user(a)DOMAIN.AT&quot;,
&amp;gt;    "result": null,
&amp;gt;    "version": "4.7.1"
&amp;gt;}
&amp;gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
&amp;amp;gt;[[e-mail](a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test
--type=standard
&amp;gt;ipa: INFO: Request: {
&amp;gt;    "id": 0,
&amp;gt;    "method": "ping",
&amp;gt;    "params": [
&amp;gt;        [],
&amp;gt;        {}
&amp;gt;    ]
&amp;gt;}
&amp;gt;ipa: INFO: Response: {
&amp;gt;    "error": null,
&amp;gt;    "id": 0,
&amp;gt;    "principal": &quot;ad_user(a)DOMAIN.AT&quot;,
&amp;gt;    "result": {
&amp;gt;        "messages": [
&amp;gt;            {
&amp;gt;                "code": 13001,
&amp;gt;                "data": {
&amp;gt;                    "server_version": "2.230"
&amp;gt;                },
&amp;gt;                "message": "API Version number was not sent,
forward compatibility not guaranteed. Assuming server's API version, 2.230",
&amp;gt;                "name": "VersionMissing",
&amp;gt;                "type": "warning"
&amp;gt;            }
&amp;gt;        ],
&amp;gt;        "summary": "IPA server version 4.7.1. API version
2.230"
&amp;gt;    },
&amp;gt;    "version": "4.7.1"
&amp;gt;}
&amp;gt;ipa: INFO: Request: {
&amp;gt;    "id": 0,
&amp;gt;    "method": "vault_add_internal/1",
&amp;gt;    "params": [
&amp;gt;        [
&amp;gt;            "test"
&amp;gt;        ],
&amp;gt;        {
&amp;gt;            "ipavaulttype": "standard",
&amp;gt;            "version": "2.230"
&amp;gt;        }
&amp;gt;    ]
&amp;gt;}
&amp;gt;ipa: INFO: Response: {
&amp;gt;    "error": {
&amp;gt;        "code": 2100,
&amp;gt;        "data": {
&amp;gt;            "info": "Insufficient 'add' privilege to
add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
&amp;gt;        },
&amp;gt;        "message": "Insufficient access: Insufficient
'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
&amp;gt;        "name": "ACIError"
&amp;gt;    },
&amp;gt;    "id": 0,
&amp;gt;    "principal": &quot;ad_user(a)DOMAIN.AT&quot;,
&amp;gt;    "result": null,
&amp;gt;    "version": "4.7.1"
&amp;gt;}
&amp;gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
&amp;amp;gt;[[e-mail](a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test
--type=standard
&amp;gt;ipa: INFO: Request: {
&amp;gt;    "id": 0,
&amp;gt;    "method": "ping",
&amp;gt;    "params": [
&amp;gt;        [],
&amp;gt;        {}
&amp;gt;    ]
&amp;gt;}
&amp;gt;ipa: INFO: Response: {
&amp;gt;    "error": null,
&amp;gt;    "id": 0,
&amp;gt;    "principal": &quot;ad_user(a)DOMAIN.AT&quot;,
&amp;gt;    "result": {
&amp;gt;        "messages": [
&amp;gt;            {
&amp;gt;                "code": 13001,
&amp;gt;                "data": {
&amp;gt;                    "server_version": "2.230"
&amp;gt;                },
&amp;gt;                "message": "API Version number was not sent,
forward compatibility not guaranteed. Assuming server's API version, 2.230",
&amp;gt;                "name": "VersionMissing",
&amp;gt;                "type": "warning"
&amp;gt;            }
&amp;gt;        ],
&amp;gt;        "summary": "IPA server version 4.7.1. API version
2.230"
&amp;gt;    },
&amp;gt;    "version": "4.7.1"
&amp;gt;}
&amp;gt;ipa: INFO: Request: {
&amp;gt;    "id": 0,
&amp;gt;    "method": "vault_add_internal/1",
&amp;gt;    "params": [
&amp;gt;        [
&amp;gt;            "test"
&amp;gt;        ],
&amp;gt;        {
&amp;gt;            "ipavaulttype": "standard",
&amp;gt;            "version": "2.230"
&amp;gt;        }
&amp;gt;    ]
&amp;gt;}
&amp;gt;ipa: INFO: Response: {
&amp;gt;    "error": {
&amp;gt;        "code": 2100,
&amp;gt;        "data": {
&amp;gt;            "info": "Insufficient 'add' privilege to
add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
&amp;gt;        },
&amp;gt;        "message": "Insufficient access: Insufficient
'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
&amp;gt;        "name": "ACIError"
&amp;gt;    },
&amp;gt;    "id": 0,
&amp;gt;    "principal": &quot;ad_user(a)DOMAIN.AT&quot;,
&amp;gt;    "result": null,
&amp;gt;    "version": "4.7.1"
&amp;gt;}
&amp;gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
&amp;gt;--
&amp;gt;ÖAMTC I BAUMGASSE 129 I 1030 WIEN
&amp;gt;Elias Rami | Devops Engineer
&amp;gt;M [phone]
&amp;amp;gt;elias.rami(a)oeamtc.at | www.oeamtc.at&lt;http:
www.oeamtc.at=""&gt;&lt;/http:&gt; | ÖAMTC ZVR 7300335108
&amp;gt;
&amp;gt;

________________________________

Schenken Sie ein gutes Gefühl!
Jetzt online ÖAMTC Wertgutschein kaufen,
z.B. für Schutzbrief, Autobahnvignette, Reisen, Fahrtechnik, uvm.
www.oeamtc-gutschein.at<https://www.oeamtc-gutschein.at>


________________________________
Wichtiger Hinweis/Important Information:

Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail
sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt
firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in
vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten
Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen
verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder
Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt
dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen
Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail
von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet.

This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via
e-mail are not legally binding but require written confirmation including the signatures
of the required number of managing directors under statutory provisions. We are not liable
for the accuracy and sufficiency of the provided information/data, for any transmission
error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no
confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the
addressee or his representative, please notify the sender immediately and delete this
e-mail from your system. Any disclosure or use is prohibited.

________________________________

________________________________
&amp;gt;
&amp;gt;Schenken Sie ein gutes Gefühl!
&amp;gt;Jetzt online ÖAMTC Wertgutschein kaufen,
&amp;gt;z.B. für Schutzbrief, Autobahnvignette, Reisen, Fahrtechnik, uvm.
&amp;gt;www.oeamtc-gutschein.at&lt;https:
www.oeamtc-gutschein.at=""&gt;
&amp;gt;
&amp;gt;
&amp;gt;________________________________
&amp;gt;Wichtiger Hinweis/Important Information:
&amp;gt;
&amp;gt;Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen
via E-Mail sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung
samt firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in
vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten
Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen
verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder
Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt
dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen
Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail
von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet.
&amp;gt;
&amp;gt;This e-mail and any attachment (“e-mail”) serves information purposes only.
Statements via e-mail are not legally binding but require written confirmation including
the signatures of the required number of managing directors under statutory provisions. We
are not liable for the accuracy and sufficiency of the provided information/data, for any
transmission error, misdirection, loss or delay of an e-mail. Electronic reading receipts
are no confirmation for receipt of an e-mail. This e-mail is confidential. If you are not
the addressee or his representative, please notify the sender immediately and delete this
e-mail from your system. Any disclosure or use is prohibited.
&amp;gt;
&amp;gt;________________________________
&amp;gt;_______________________________________________
&amp;gt;FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
&amp;gt;To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
&amp;gt;Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
&amp;gt;List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
&amp;gt;List Archives:
https://lists.fedorahosted.org/archives/list/[e-mail]...

--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

&lt;/https:&gt;

[Alexander Bokovoy]

On to, 19 joulu 2019, Rami Elias (TECH V) via FreeIPA-users wrote:
> Hello,
>
> thank you for your fast investigation;
>
> we are on centos 8 and we have the following packages:
>
>
> - name: install freeipa packages
>   dnf:
>    name:
>       - ipa-server
>       - ipa-server-dns
>       - ipa-server-trust-ad
>       - ipa-idoverride-memberof-plugin
>    state: installed
>
> yes, im sorry for that idiotic formatting, my mail client somehow
> removed the newlines i was just able to see it after i already sent it
> ..
>
>
> we got it working by the link you provided:
> ipa group-add-member u0-erdberg-verwaltung --idoverrideusers=ad_user(a)ad.example.com
>
> so really thank you for your help, just one LAST question:
>
> is this somehow possible on group basis? (id override group?) we dont
> want to have to manage all of our ad users we want to manage some
> groups in which are assigned to the users? 
No, using group overrides is not possible at the moment. It is way more
complex to add that supported on ACI enforcement side, sorry. Pretty
much the same level of complexity as handling external group members.


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland