Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
by Alexander Bokovoy
On Пан, 20 ліс 2023, Kroon PC, Peter wrote:
>Hi all,
>
>I went for option B and deleted some offending groups and users, and adjusted the gidNumber of those that remained. Running `/usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids` produces the following logs:
>[20/Nov/2023:14:39:00.414065260 +0100] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ...
>[20/Nov/2023:14:39:00.472454841 +0100] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [0].
>
>which to me means good news.
>
>However, `kinit admin`, confirming success with `klist`, and then trying `ipa user-show admin` gives:
>ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible (Credential cache is empty)
>
>krb5kdc.log:
>Nov 20 14:56:04 freeipa.example.com krb5kdc[427](info): TGS_REQ (4 etypes {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) 192.168.12.57: S4U2PROXY_NO_HEADER_PAC: authtime 0, etypes {rep=UNSUPPORTED:(0)} HTTP/freeipa.example.com(a)EXAMPLE.COM for ldap/freeipa.example.com(a)EXAMPLE.COM, TGT has been revoked
>
>Further advise would be most welcome while I try to figure out how to have outlook behave nicely with inline responses...
admin already has the SID assigned manually, so theoretically it should
already have a ticket with PAC issued.
I suspect you have some misconfiguration that disables PAC issuance at
all. Can you check your kdc.conf that it doesn't have 'disable_pac' set
in it? It is in /var/kerberos/krb5kdc/kdc.conf
Alternatively, it might be something with the default configuration:
# ipa -e in_server=True config-show --raw |grep ipakrbauthzdata
This should return
ipakrbauthzdata: MS-PAC
ipakrbauthzdata: nfs:NONE
>
>Peter
>
>
>________________________________________
>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>Verzonden: donderdag 9 november 2023 14:32
>Aan: Kroon PC, Peter
>CC: Rob Crittenden; FreeIPA users list
>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>
>On Чцв, 09 ліс 2023, Kroon PC, Peter wrote:
>>Hi all,
>>
>>to confirm, both uidNumber and gidNumber must be within the ID range
>>right? I have 1 user and 22 groups that got assigned numbers outside
>>the range. Would it be possible to constrain these at an ldap level?
>
>Correct, they must be within the range.
>You can use approach outlined in the following discussion from 2017 to
>create the range:
>https://listman.redhat.com/archives/freeipa-users/2017-February/026913.html
>
>>
>>Peter
>>
>>________________________________________
>>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>>Verzonden: dinsdag 7 november 2023 09:34
>>Aan: Kroon PC, Peter
>>CC: Rob Crittenden; FreeIPA users list
>>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>>
>>On Пан, 06 ліс 2023, Kroon PC, Peter wrote:
>>>Hi all,
>>>
>>>thanks for the response, and my apologies for my slow reply -- life happened.
>>>I put my responses inline. It seems that the ldapupdate file you provided generated a SID config.
>>
>>Thanks. It is hard to read your inline responses as they went without
>>proper quoting but I think I understood what you wanted to show.
>>
>>You still need to add an ID range that covers your actual POSIX IDs. Without
>>that we wouldn't able to generate SIDs either.
>>
>>After an ID range is added, `ipa config-mod --enable-sid --add-sids`
>>should fix the rest.
>>
>>
>>>
>>>Peter
>>>
>>>
>>>________________________________________
>>>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>>>Verzonden: donderdag 26 oktober 2023 16:59
>>>Aan: Kroon PC, Peter
>>>CC: Rob Crittenden; FreeIPA users list
>>>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>>>
>>>On Чцв, 26 кас 2023, Kroon PC, Peter wrote:
>>>>Hi Alexander and Rob,
>>>>
>>>>many thanks for your prompt responses :)
>>>>I made a new lxc machine and restored a backup so at least I have a working environment again. I kept the borken one for further investigation which I'll use to provide more information.
>>>>I'm not super comfortable using mailing lists, and I'm not sure whether my mail client (outlook) will mangle my inline responses.
>>>>
>>>>Peter
>>>>
>>>>________________________________________
>>>>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>>>>Verzonden: woensdag 25 oktober 2023 20:49
>>>>Aan: Rob Crittenden
>>>>CC: FreeIPA users list; Kroon PC, Peter
>>>>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>>>>
>>>>On ���, 25 ��� 2023, Rob Crittenden wrote:
>>>>>Alexander Bokovoy via FreeIPA-users wrote:
>>>>>> On ���, 25 ��� 2023, Kroon PC, Peter via FreeIPA-users wrote:
>>>>>>> Hi all,
>>>>>>>
>>>>>>> After upgrading to Rocky linux 9.2 I'm running into issues with my IPA
>>>>>>> server (4.10.1-9.el9_2). In particular, my IPA CLI seems FUBARred:
>>>>>>>
>>>>>>> $ kinit admin
>>>>>>> Password for admin(a)EXAMPLE.COM:
>>>>>>> $ ipa show-user admin
>>>>>>> ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI
>>>>>>> Error: No credentials were supplied, or the credentials were
>>>>>>> unavailable or inaccessible (Credential cache is empty)
>>>>>>>
>>>>>>> /var/log/krb5kdc.log:
>>>>>>> okt 24 16:17:48 freeipa.example.com krb5kdc[10493]: TGS_REQ (4 etypes
>>>>>>> {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20),
>>>>>>> aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)})
>>>>>>> 192.168.12.57: S4U2PROXY_NO_HEADER_PAC: authtime 0, etypes
>>>>>>> {rep=UNSUPPORTED:(0)} HTTP/freeipa.example.com(a)EXAMPLE.COM for
>>>>>>> ldap/freeipa.example.com(a)EXAMPLE.COM, TGT has been revoked
>>>>>>>
>>>>>>> As the log shows, the KDC states there is no PAC, and therefore revokes
>>>>>>> the TGT (note, I had to RTFS to decipher the S4U2PROXY_NO_HEADER_PAC).
>>>>>>> Because of this, the web gui also doesn't work.
>>>>>>
>>>>>> That is correct description of the reason why it does not work.
>>>>>>
>>>>>>>
>>>>>>> $ ldapsearch -Y GSSAPI -b cn=users,cn=accounts,dc=example,dc=nl
>>>>>>> "ipaNTSecurityIdentifier=*" uid ipaNTSecurityIdentifier
>>>>>>> SASL/GSSAPI authentication started
>>>>>>> SASL username: admin(a)EXAMPLE.COM
>>>>>>> SASL SSF: 256
>>>>>>> SASL data security layer installed.
>>>>>>> # extended LDIF
>>>>>>> #
>>>>>>> # LDAPv3
>>>>>>> # base <cn=users,cn=accounts,dc=example,dc=com> with scope subtree
>>>>>>> # filter: ipaNTSecurityIdentifier=*
>>>>>>> # requesting: uid ipaNTSecurityIdentifier
>>>>>>> #
>>>>>>>
>>>>>>> # admin, users, accounts, example.com
>>>>>>> dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com
>>>>>>> uid: admin
>>>>>>> ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440-500
>>>>>>>
>>>>>>> # search result
>>>>>>> search: 4
>>>>>>> result: 0 Success
>>>>>>>
>>>>>>> # numResponses: 2
>>>>>>> # numEntries: 1
>>>>>>>
>>>>>>> Out of the ~200 or so users only the admin user has a
>>>>>>> ipaNTSecurityIdentifier, but I don't know if it's correct...
>>>>>>> I can't run `ipa config-mod --enable-sid --add-sids`, since my ipa CLI
>>>>>>> is broken. I do still have LDAP access fortunately.
>>>>>>
>>>>>> You can run it, see below. If you'd run, do you have any error messages in
>>>>>> the dirsrv errors log related to sidgen plugin?
>>>>>>
>>>>>>>
>>>>>>> I tried to set `disable_pac = true` in /var/kerberos/krb5kdc/kdc.conf,
>>>>>>> but that results in the exact same error. Setting ipaKrbAuthzData=None
>>>>>>> in cn=ipaConfig also has no effect.
>>>>>>
>>>>>> No, one cannot disable PAC globally in FreeIPA. S4U operations
>>>>>> require PAC presence since last year, so for any real Kerberos service
>>>>>> that uses S4U (like IPA API or web UI) one cannot disable PAC
>>>>>> enforcement.
>>>>
>>>>This is useful information :)
>>>>
>>>>>>
>>>>>> Look at your ID range and SID configuration. You can avoid admin issue
>>>>>> currently by running 'ipa' tool on IPA server as root with '-e
>>>>>> in_server=true' option. This will force the tool to simulate direct
>>>>>> access (as if it is running within httpd) and talk directly to LDAPI
>>>>>> socket.
>>>>>>
>>>>>> Something like below:
>>>>>>
>>>>>> # KRB5CACHE=/dev/null ipa -e in_server=true trustconfig-show
>>>>>> ipa: WARNING: API Version number was not sent, forward compatibility not
>>>>>> guaranteed. Assuming server's API version, 2.253
>>>>>> Domain: ipa1.test
>>>>>> Security Identifier: S-1-5-21-790702333-3825749031-3739951824
>>>>>> NetBIOS name: IPA1
>>>>>> Domain GUID: 529fcbe9-3e34-436d-a541-6ffa88e7dac1
>>>>>> Fallback primary group: Default SMB Group
>>>>>> IPA AD trust agents: master1.ipa1.test
>>>>>> IPA AD trust controllers: master1.ipa1.test
>>>>
>>>>KRB5CACHE=/dev/null ipa -e in_server=true trustconfig-show
>>>>ipa: ERROR: : trust configuration not found
>>>
>>>Ok, let's try differently. Can you provide output of
>>>
>>># ldapsearch -Y EXTERNAL -H ldapi://%2Frun%2Fslapd-EXAMPLE-COM.socket \
>>> -b cn=ad,cn=etc,dc=example,dc=com
>>>
>>>(replace EXAMPLE-COM and dc=example,dc=com by your domain data)
>>>
>>>dn: cn=ad,cn=etc,dc=example,dc=com
>>>objectClass: nsContainer
>>>objectClass: top
>>>cn: cn
>>>cn: ad
>>>>
>>>>
>>>>>>
>>>>>> # KRB5CACHE=/dev/null ipa -e in_server=true idrange-find
>>>>>> ipa: WARNING: API Version number was not sent, forward compatibility not
>>>>>> guaranteed. Assuming server's API version, 2.253
>>>>>> ----------------
>>>>>> 5 ranges matched
>>>>>> ----------------
>>>>>> Range name: IPA1.TEST_id_range
>>>>>> First Posix ID of the range: 1055600000
>>>>>> Number of IDs in the range: 200000
>>>>>> First RID of the corresponding RID range: 1000
>>>>>> First RID of the secondary RID range: 100000000
>>>>>> Range type: local domain range
>>>>>>
>>>>>> ... [ skip ] ...
>>>>>>
>>>>>>
>>>>
>>>>ipa: WARNING: API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.251
>>>>----------------
>>>>2 ranges matched
>>>>----------------
>>>> Range name: EXAMPLE.COM_id_range
>>>> First Posix ID of the range: 1000
>>>> Number of IDs in the range: 4000
>>>> Range type: local domain range
>>>
>>>This one is definitely not configured to handle SIDs. Also, see my
>>>comment at the bottom of this email.
>>>
>>>>
>>>> Range name: EXAMPLE.COM_subid_range
>>>> First Posix ID of the range: 2147483648
>>>> Number of IDs in the range: 2147352576
>>>> First RID of the corresponding RID range: 2147479648
>>>> Domain SID of the trusted domain: S-1-5-21-738065-838566-2966017632
>>>> Range type: Active Directory domain range
>>>>----------------------------
>>>>Number of entries returned 2
>>>>----------------------------
>>>>
>>>>>
>>>>>In my testing you can't run config-mod without a principal, and running
>>>>>in-server does not have a principal.
>>>>>
>>>>># KRB5CACHE=/dev/null ipa -e in_server=true config-mod --add-sids
>>>>>--enable-sid
>>>>>[snip]
>>>>> File "/usr/lib/python3.11/site-packages/ipaserver/plugins/config.py",
>>>>>line 701, in pre_callback
>>>>> self._enable_sid(ldap, options)
>>>>> File "/usr/lib/python3.11/site-packages/ipaserver/plugins/config.py",
>>>>>line 512, in _enable_sid
>>>>> if not principal_has_privilege(self.api, context.principal, privilege):
>>>>> ^^^^^^^^^^^^^^^^^
>>>>>AttributeError: '_thread._local' object has no attribute 'principal'
>>>>>ipa: ERROR: an internal error has occurred
>>>>
>>>>Thank you, Rob. I did not check that part.
>>>>
>>>>On IPA master one can run the oddjobd-activated script directly:
>>>>
>>>># /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids
>>>>
>>>>$ /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids
>>>>Configuring SID generation
>>>> [1/8]: creating samba domain object
>>>> [error] TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>>('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>>The ipa-enable-sid command failed. See /var/log/ipaserver-enable-sid.log for more information
>>>>
>>>>Python traceback from the log:
>>>>2023-10-26T13:24:21Z DEBUG Traceback (most recent call last):
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation
>>>> run_step(full_msg, method)
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step
>>>> method()
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 485, in __create_samba_domain_object
>>>> api.Backend.ldap2.add_entry(entry)
>>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1893, in add_entry
>>>> super(LDAPCache, self).add_entry(entry)
>>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1659, in add_entry
>>>> self.conn.add_s(str(entry.dn), list(attrs.items()))
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s
>>>> return self.add_ext_s(dn,modlist,None,None)
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 221, in add_ext_s
>>>> msgid = self.add_ext(dn,modlist,serverctrls,clientctrls)
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 218, in add_ext
>>>> return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call
>>>> result = func(*args,**kwargs)
>>>>TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>>
>>>>2023-10-26T13:24:21Z DEBUG [error] TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>>2023-10-26T13:24:21Z DEBUG Destroyed connection context.ldap2_140617190554016
>>>>2023-10-26T13:24:21Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute
>>>> return_value = self.run()
>>>> File "/usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid", line 68, in run
>>>> smb.create_instance()
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 913, in create_instance
>>>> self.start_creation(show_service_name=False)
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation
>>>> run_step(full_msg, method)
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step
>>>> method()
>>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 485, in __create_samba_domain_object
>>>> api.Backend.ldap2.add_entry(entry)
>>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1893, in add_entry
>>>> super(LDAPCache, self).add_entry(entry)
>>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1659, in add_entry
>>>> self.conn.add_s(str(entry.dn), list(attrs.items()))
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s
>>>> return self.add_ext_s(dn,modlist,None,None)
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 221, in add_ext_s
>>>> msgid = self.add_ext(dn,modlist,serverctrls,clientctrls)
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 218, in add_ext
>>>> return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
>>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call
>>>> result = func(*args,**kwargs)
>>>>
>>>>2023-10-26T13:24:21Z DEBUG The ipa-enable-sid command failed, exception: TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>>
>>>>
>>>>I still need to see ID range and trustconfig-show output to understand
>>>>the state of this deployment. Also, dirsrv errors log would be helpful
>>>>if there was an attempt to run sidgen in past.
>>>>
>>>>I went through the dirsrv logs, and found the following:
>>>>[24/Oct/2023:10:25:34.071341978 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ...
>>>>[24/Oct/2023:10:25:34.300104111 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [52021] into an unused SID.
>>>>[24/Oct/2023:10:25:34.300266490 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry.
>>>>[24/Oct/2023:10:25:34.303536359 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32].
>>>
>>>You have a range that defines UID/GID space of [1000...5000] but IDs are
>>>outside this range. This is pretty much wrong regardless of whether we
>>>enforce SIDs or not ;)
>>>
>>>You need to create a separate ID range that would cover your existing
>>>IDs. Before that, we need to create a configuration to be used for SID
>>>generation -- if the ldapsearch above would show us that the entry in
>>>cn=ad,cn=etc,$SUFFIX does not exist.
>>>
>>>Since ipa-enable-sid has failed, probably the entry indeed does not exist and
>>>it would be easier to construct it with ipa-ldap-updater tool:
>>>
>>>----
>>>dn: cn=${DOMAIN},cn=ad,cn=etc,${SUFFIX}
>>>default:objectClass: ipaNTDomainAttrs
>>>default:objectClass: nsContainer
>>>default:objectClass: top
>>>default:cn: ${DOMAIN}
>>>default:ipaNTFlatName: NETBIOSNAME
>>>default:ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440
>>>default:ipaNTDomainGUID: 529fcbe9-3e34-3122-a541-6786236014c1
>>>default:ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,${SUFFIX}
>>>----
>>>
>>>Change 'NETBIOSNAME' above to some name. By default that would be a
>>>first part of your Kerberos realm, e.g. for IPA1.TEST that would be
>>>IPA.
>>>
>>>The SID value (S-1-5-21-...) is the one that your admin user has,
>>>without the last part (relative identifier, RID, which is -500 for
>>>administrator case).
>>>
>>>Save this to a file named '90-somefile.update' and run as root
>>>
>>># ipa-ldap-updater ./90-somefile.update
>>>
>>>
>>>Alright, it said "update successful". The ldapsearch above now produces:
>>># ad, etc, example.com
>>>dn: cn=ad,cn=etc,dc=example,dc=com
>>>objectClass: nsContainer
>>>objectClass: top
>>>cn: cn
>>>cn: ad
>>>
>>># example.com, ad, etc, example.com
>>>dn: cn=example.com,cn=ad,cn=etc,dc=example,dc=com
>>>objectClass: ipaNTDomainAttrs
>>>objectClass: nsContainer
>>>objectClass: top
>>>cn: example.com
>>>ipaNTFlatName: MYNETBIOSNAME
>>>ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440
>>>ipaNTDomainGUID: 529fcbe9-3e34-3122-a541-6786236014c1
>>>ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,dc=example,dc=com
>>>
>>>--
>>>/ Alexander Bokovoy
>>>Sr. Principal Software Engineer
>>>Security / Identity Management Engineering
>>>Red Hat Limited, Finland
>>>
>>
>>
>>
>>--
>>/ Alexander Bokovoy
>>Sr. Principal Software Engineer
>>Security / Identity Management Engineering
>>Red Hat Limited, Finland
>>
>
>
>
>
>--
>/ Alexander Bokovoy
>Sr. Principal Software Engineer
>Security / Identity Management Engineering
>Red Hat Limited, Finland
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
6 months, 1 week
Can you automount the home folders on San Storage via free ipa?
by Alper AYKUT
Hello, I can automatically add home folders in nfs environment to users
via automount and autofs. We have a plan to buy a SAN Powervault Me series
storage from Dell company in the near future.
Our 4 Servers will not have local disks except for the operating system,
these disks will be connected with 32gb fiber channel on SAN Powervault
SAN. The home folder will be on San Storage and users connecting to the
server will automatically connect to their home directories on the Storage.
How can I do this ? As I did in Free ipa via nfs. There was no problem in
connection with nfs with automount and autofs.
But now there is no nfs in the environment and the disks will be connected
with fiber channel. I need your help and valuable guidance on this issue.
thankyou for support.
Alper
6 months, 2 weeks
Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
by Alexander Bokovoy
On Чцв, 09 ліс 2023, Kroon PC, Peter wrote:
>Hi all,
>
>to confirm, both uidNumber and gidNumber must be within the ID range
>right? I have 1 user and 22 groups that got assigned numbers outside
>the range. Would it be possible to constrain these at an ldap level?
Correct, they must be within the range.
You can use approach outlined in the following discussion from 2017 to
create the range:
https://listman.redhat.com/archives/freeipa-users/2017-February/026913.html
>
>Peter
>
>________________________________________
>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>Verzonden: dinsdag 7 november 2023 09:34
>Aan: Kroon PC, Peter
>CC: Rob Crittenden; FreeIPA users list
>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>
>On Пан, 06 ліс 2023, Kroon PC, Peter wrote:
>>Hi all,
>>
>>thanks for the response, and my apologies for my slow reply -- life happened.
>>I put my responses inline. It seems that the ldapupdate file you provided generated a SID config.
>
>Thanks. It is hard to read your inline responses as they went without
>proper quoting but I think I understood what you wanted to show.
>
>You still need to add an ID range that covers your actual POSIX IDs. Without
>that we wouldn't able to generate SIDs either.
>
>After an ID range is added, `ipa config-mod --enable-sid --add-sids`
>should fix the rest.
>
>
>>
>>Peter
>>
>>
>>________________________________________
>>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>>Verzonden: donderdag 26 oktober 2023 16:59
>>Aan: Kroon PC, Peter
>>CC: Rob Crittenden; FreeIPA users list
>>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>>
>>On Чцв, 26 кас 2023, Kroon PC, Peter wrote:
>>>Hi Alexander and Rob,
>>>
>>>many thanks for your prompt responses :)
>>>I made a new lxc machine and restored a backup so at least I have a working environment again. I kept the borken one for further investigation which I'll use to provide more information.
>>>I'm not super comfortable using mailing lists, and I'm not sure whether my mail client (outlook) will mangle my inline responses.
>>>
>>>Peter
>>>
>>>________________________________________
>>>Van: Alexander Bokovoy <abokovoy(a)redhat.com>
>>>Verzonden: woensdag 25 oktober 2023 20:49
>>>Aan: Rob Crittenden
>>>CC: FreeIPA users list; Kroon PC, Peter
>>>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
>>>
>>>On ���, 25 ��� 2023, Rob Crittenden wrote:
>>>>Alexander Bokovoy via FreeIPA-users wrote:
>>>>> On ���, 25 ��� 2023, Kroon PC, Peter via FreeIPA-users wrote:
>>>>>> Hi all,
>>>>>>
>>>>>> After upgrading to Rocky linux 9.2 I'm running into issues with my IPA
>>>>>> server (4.10.1-9.el9_2). In particular, my IPA CLI seems FUBARred:
>>>>>>
>>>>>> $ kinit admin
>>>>>> Password for admin(a)EXAMPLE.COM:
>>>>>> $ ipa show-user admin
>>>>>> ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI
>>>>>> Error: No credentials were supplied, or the credentials were
>>>>>> unavailable or inaccessible (Credential cache is empty)
>>>>>>
>>>>>> /var/log/krb5kdc.log:
>>>>>> okt 24 16:17:48 freeipa.example.com krb5kdc[10493]: TGS_REQ (4 etypes
>>>>>> {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20),
>>>>>> aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)})
>>>>>> 192.168.12.57: S4U2PROXY_NO_HEADER_PAC: authtime 0, etypes
>>>>>> {rep=UNSUPPORTED:(0)} HTTP/freeipa.example.com(a)EXAMPLE.COM for
>>>>>> ldap/freeipa.example.com(a)EXAMPLE.COM, TGT has been revoked
>>>>>>
>>>>>> As the log shows, the KDC states there is no PAC, and therefore revokes
>>>>>> the TGT (note, I had to RTFS to decipher the S4U2PROXY_NO_HEADER_PAC).
>>>>>> Because of this, the web gui also doesn't work.
>>>>>
>>>>> That is correct description of the reason why it does not work.
>>>>>
>>>>>>
>>>>>> $ ldapsearch -Y GSSAPI -b cn=users,cn=accounts,dc=example,dc=nl
>>>>>> "ipaNTSecurityIdentifier=*" uid ipaNTSecurityIdentifier
>>>>>> SASL/GSSAPI authentication started
>>>>>> SASL username: admin(a)EXAMPLE.COM
>>>>>> SASL SSF: 256
>>>>>> SASL data security layer installed.
>>>>>> # extended LDIF
>>>>>> #
>>>>>> # LDAPv3
>>>>>> # base <cn=users,cn=accounts,dc=example,dc=com> with scope subtree
>>>>>> # filter: ipaNTSecurityIdentifier=*
>>>>>> # requesting: uid ipaNTSecurityIdentifier
>>>>>> #
>>>>>>
>>>>>> # admin, users, accounts, example.com
>>>>>> dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com
>>>>>> uid: admin
>>>>>> ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440-500
>>>>>>
>>>>>> # search result
>>>>>> search: 4
>>>>>> result: 0 Success
>>>>>>
>>>>>> # numResponses: 2
>>>>>> # numEntries: 1
>>>>>>
>>>>>> Out of the ~200 or so users only the admin user has a
>>>>>> ipaNTSecurityIdentifier, but I don't know if it's correct...
>>>>>> I can't run `ipa config-mod --enable-sid --add-sids`, since my ipa CLI
>>>>>> is broken. I do still have LDAP access fortunately.
>>>>>
>>>>> You can run it, see below. If you'd run, do you have any error messages in
>>>>> the dirsrv errors log related to sidgen plugin?
>>>>>
>>>>>>
>>>>>> I tried to set `disable_pac = true` in /var/kerberos/krb5kdc/kdc.conf,
>>>>>> but that results in the exact same error. Setting ipaKrbAuthzData=None
>>>>>> in cn=ipaConfig also has no effect.
>>>>>
>>>>> No, one cannot disable PAC globally in FreeIPA. S4U operations
>>>>> require PAC presence since last year, so for any real Kerberos service
>>>>> that uses S4U (like IPA API or web UI) one cannot disable PAC
>>>>> enforcement.
>>>
>>>This is useful information :)
>>>
>>>>>
>>>>> Look at your ID range and SID configuration. You can avoid admin issue
>>>>> currently by running 'ipa' tool on IPA server as root with '-e
>>>>> in_server=true' option. This will force the tool to simulate direct
>>>>> access (as if it is running within httpd) and talk directly to LDAPI
>>>>> socket.
>>>>>
>>>>> Something like below:
>>>>>
>>>>> # KRB5CACHE=/dev/null ipa -e in_server=true trustconfig-show
>>>>> ipa: WARNING: API Version number was not sent, forward compatibility not
>>>>> guaranteed. Assuming server's API version, 2.253
>>>>> Domain: ipa1.test
>>>>> Security Identifier: S-1-5-21-790702333-3825749031-3739951824
>>>>> NetBIOS name: IPA1
>>>>> Domain GUID: 529fcbe9-3e34-436d-a541-6ffa88e7dac1
>>>>> Fallback primary group: Default SMB Group
>>>>> IPA AD trust agents: master1.ipa1.test
>>>>> IPA AD trust controllers: master1.ipa1.test
>>>
>>>KRB5CACHE=/dev/null ipa -e in_server=true trustconfig-show
>>>ipa: ERROR: : trust configuration not found
>>
>>Ok, let's try differently. Can you provide output of
>>
>># ldapsearch -Y EXTERNAL -H ldapi://%2Frun%2Fslapd-EXAMPLE-COM.socket \
>> -b cn=ad,cn=etc,dc=example,dc=com
>>
>>(replace EXAMPLE-COM and dc=example,dc=com by your domain data)
>>
>>dn: cn=ad,cn=etc,dc=example,dc=com
>>objectClass: nsContainer
>>objectClass: top
>>cn: cn
>>cn: ad
>>>
>>>
>>>>>
>>>>> # KRB5CACHE=/dev/null ipa -e in_server=true idrange-find
>>>>> ipa: WARNING: API Version number was not sent, forward compatibility not
>>>>> guaranteed. Assuming server's API version, 2.253
>>>>> ----------------
>>>>> 5 ranges matched
>>>>> ----------------
>>>>> Range name: IPA1.TEST_id_range
>>>>> First Posix ID of the range: 1055600000
>>>>> Number of IDs in the range: 200000
>>>>> First RID of the corresponding RID range: 1000
>>>>> First RID of the secondary RID range: 100000000
>>>>> Range type: local domain range
>>>>>
>>>>> ... [ skip ] ...
>>>>>
>>>>>
>>>
>>>ipa: WARNING: API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.251
>>>----------------
>>>2 ranges matched
>>>----------------
>>> Range name: EXAMPLE.COM_id_range
>>> First Posix ID of the range: 1000
>>> Number of IDs in the range: 4000
>>> Range type: local domain range
>>
>>This one is definitely not configured to handle SIDs. Also, see my
>>comment at the bottom of this email.
>>
>>>
>>> Range name: EXAMPLE.COM_subid_range
>>> First Posix ID of the range: 2147483648
>>> Number of IDs in the range: 2147352576
>>> First RID of the corresponding RID range: 2147479648
>>> Domain SID of the trusted domain: S-1-5-21-738065-838566-2966017632
>>> Range type: Active Directory domain range
>>>----------------------------
>>>Number of entries returned 2
>>>----------------------------
>>>
>>>>
>>>>In my testing you can't run config-mod without a principal, and running
>>>>in-server does not have a principal.
>>>>
>>>># KRB5CACHE=/dev/null ipa -e in_server=true config-mod --add-sids
>>>>--enable-sid
>>>>[snip]
>>>> File "/usr/lib/python3.11/site-packages/ipaserver/plugins/config.py",
>>>>line 701, in pre_callback
>>>> self._enable_sid(ldap, options)
>>>> File "/usr/lib/python3.11/site-packages/ipaserver/plugins/config.py",
>>>>line 512, in _enable_sid
>>>> if not principal_has_privilege(self.api, context.principal, privilege):
>>>> ^^^^^^^^^^^^^^^^^
>>>>AttributeError: '_thread._local' object has no attribute 'principal'
>>>>ipa: ERROR: an internal error has occurred
>>>
>>>Thank you, Rob. I did not check that part.
>>>
>>>On IPA master one can run the oddjobd-activated script directly:
>>>
>>># /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids
>>>
>>>$ /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids
>>>Configuring SID generation
>>> [1/8]: creating samba domain object
>>> [error] TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>The ipa-enable-sid command failed. See /var/log/ipaserver-enable-sid.log for more information
>>>
>>>Python traceback from the log:
>>>2023-10-26T13:24:21Z DEBUG Traceback (most recent call last):
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation
>>> run_step(full_msg, method)
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step
>>> method()
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 485, in __create_samba_domain_object
>>> api.Backend.ldap2.add_entry(entry)
>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1893, in add_entry
>>> super(LDAPCache, self).add_entry(entry)
>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1659, in add_entry
>>> self.conn.add_s(str(entry.dn), list(attrs.items()))
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s
>>> return self.add_ext_s(dn,modlist,None,None)
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 221, in add_ext_s
>>> msgid = self.add_ext(dn,modlist,serverctrls,clientctrls)
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 218, in add_ext
>>> return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call
>>> result = func(*args,**kwargs)
>>>TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>
>>>2023-10-26T13:24:21Z DEBUG [error] TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>2023-10-26T13:24:21Z DEBUG Destroyed connection context.ldap2_140617190554016
>>>2023-10-26T13:24:21Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute
>>> return_value = self.run()
>>> File "/usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid", line 68, in run
>>> smb.create_instance()
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 913, in create_instance
>>> self.start_creation(show_service_name=False)
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation
>>> run_step(full_msg, method)
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step
>>> method()
>>> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 485, in __create_samba_domain_object
>>> api.Backend.ldap2.add_entry(entry)
>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1893, in add_entry
>>> super(LDAPCache, self).add_entry(entry)
>>> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1659, in add_entry
>>> self.conn.add_s(str(entry.dn), list(attrs.items()))
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s
>>> return self.add_ext_s(dn,modlist,None,None)
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 221, in add_ext_s
>>> msgid = self.add_ext(dn,modlist,serverctrls,clientctrls)
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 218, in add_ext
>>> return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
>>> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call
>>> result = func(*args,**kwargs)
>>>
>>>2023-10-26T13:24:21Z DEBUG The ipa-enable-sid command failed, exception: TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None)
>>>
>>>
>>>I still need to see ID range and trustconfig-show output to understand
>>>the state of this deployment. Also, dirsrv errors log would be helpful
>>>if there was an attempt to run sidgen in past.
>>>
>>>I went through the dirsrv logs, and found the following:
>>>[24/Oct/2023:10:25:34.071341978 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ...
>>>[24/Oct/2023:10:25:34.300104111 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [52021] into an unused SID.
>>>[24/Oct/2023:10:25:34.300266490 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry.
>>>[24/Oct/2023:10:25:34.303536359 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32].
>>
>>You have a range that defines UID/GID space of [1000...5000] but IDs are
>>outside this range. This is pretty much wrong regardless of whether we
>>enforce SIDs or not ;)
>>
>>You need to create a separate ID range that would cover your existing
>>IDs. Before that, we need to create a configuration to be used for SID
>>generation -- if the ldapsearch above would show us that the entry in
>>cn=ad,cn=etc,$SUFFIX does not exist.
>>
>>Since ipa-enable-sid has failed, probably the entry indeed does not exist and
>>it would be easier to construct it with ipa-ldap-updater tool:
>>
>>----
>>dn: cn=${DOMAIN},cn=ad,cn=etc,${SUFFIX}
>>default:objectClass: ipaNTDomainAttrs
>>default:objectClass: nsContainer
>>default:objectClass: top
>>default:cn: ${DOMAIN}
>>default:ipaNTFlatName: NETBIOSNAME
>>default:ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440
>>default:ipaNTDomainGUID: 529fcbe9-3e34-3122-a541-6786236014c1
>>default:ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,${SUFFIX}
>>----
>>
>>Change 'NETBIOSNAME' above to some name. By default that would be a
>>first part of your Kerberos realm, e.g. for IPA1.TEST that would be
>>IPA.
>>
>>The SID value (S-1-5-21-...) is the one that your admin user has,
>>without the last part (relative identifier, RID, which is -500 for
>>administrator case).
>>
>>Save this to a file named '90-somefile.update' and run as root
>>
>># ipa-ldap-updater ./90-somefile.update
>>
>>
>>Alright, it said "update successful". The ldapsearch above now produces:
>># ad, etc, example.com
>>dn: cn=ad,cn=etc,dc=example,dc=com
>>objectClass: nsContainer
>>objectClass: top
>>cn: cn
>>cn: ad
>>
>># example.com, ad, etc, example.com
>>dn: cn=example.com,cn=ad,cn=etc,dc=example,dc=com
>>objectClass: ipaNTDomainAttrs
>>objectClass: nsContainer
>>objectClass: top
>>cn: example.com
>>ipaNTFlatName: MYNETBIOSNAME
>>ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440
>>ipaNTDomainGUID: 529fcbe9-3e34-3122-a541-6786236014c1
>>ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,dc=example,dc=com
>>
>>--
>>/ Alexander Bokovoy
>>Sr. Principal Software Engineer
>>Security / Identity Management Engineering
>>Red Hat Limited, Finland
>>
>
>
>
>--
>/ Alexander Bokovoy
>Sr. Principal Software Engineer
>Security / Identity Management Engineering
>Red Hat Limited, Finland
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
6 months, 2 weeks
Freeipa, ipatokenotpkey read write. Please don't pass by
by Alexander
Have a nice day, everyone
Help please, I want to make a permission with the ability to read/write the
ipatokenotpkey attribute. I can read this attribute as an admin via the API
without any problems. I tried adding this permission in different ways
through the freeipa web interface, I tried different types (user, record,
otp configuration) but nothing led to a result, the attribute is also not
available..
6 months, 2 weeks
Good way to add a password changer for non-ipausers
by Francis Augusto Medeiros-Logeay
Hi,
I have a few user objects that aren’t on the cn=users.
How can I add an option on my plugin to allow them to change password?
I see that adding this:
Password('newpass',
cli_name='newpassword',
label=_('New password'),
flags=['virtual_attribute'],
required=False)
)
On my python plugin (and the corresponding attribute on the ui) renders a read-only field. How can I make it writable?
Best,
Francis
6 months, 2 weeks
Permissions not working in plugin
by Francis Augusto Medeiros-Logeay
Hi,
I wrote the following code to assign read permissions to an object I created:
@register()
class domain(LDAPObject):
"""
Global postfix configuration (e.g virtual domains)
"""
object_name = _('postfix configuration')
default_attributes = [
'cn','domainQuota','status','isBackupMx','maxAliases'
]
container_dn = DN(('cn', 'postfixadmin'), ('cn', 'mailserver'), ('cn', 'etc'))
permission_filter_objectclasses = ["postfixDomain"]
object_class = ['postfixDomain']
search_attributes = [ 'cn','domainQuota','status' ]
label = _('Domains')
label_singular = _('Domain')
managed_permissions = {
'System: Read Domain': {
'ipapermbindruletype': 'all',
'ipapermtarget': DN(('cn', 'postfixadmin'),('cn', 'mailserver'), ('cn', 'etc'),api.env.basedn),
#'replaces_global_anonymous_aci': True,
'ipapermright': {'read', 'search', 'compare'},
'ipapermdefaultattr': {
'cn', 'objectclass' ,'status','isBackupMx','domainQuota','maxAliases'
},
'default_privileges': {'Postfixadmin Readers'}
}
}
It is followed by the following code on an update file:
dn: cn=Postfixadmin Readers,cn=privileges,cn=pbac,$SUFFIX
default: objectClass: groupofnames
default: objectClass: nestedgroup
default: objectClass: top
default: cn: Postfixadmin Readers
default: description: Reading of mail accounts and attributes
add: member: cn=sysaccounts,cn=etc,cn=accounts,$SUFFIX
plugin: update_managed_permissions
It seems to be correct, as:
[root@ipa /]# ipa permission-show
Permission name: System: Read Domain
Permission name: System: Read Domain
Granted rights: read, search, compare
Effective attributes: cn, createtimestamp, domainquota, entryusn, isbackupmx, maxaliases, modifytimestamp, objectclass,
postfixdomain, status
Default attributes: postfixdomain, cn, isbackupmx, status, domainquota, objectclass, maxaliases
Bind rule type: all
Subtree: cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test
Target DN: cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test
Type: domain
Permission flags: SYSTEM, V2, MANAGED
Granted to Privilege: Postfixadmin Readers
[root@ipa /]# ipa privilege-show
Privilege name: Postfixadmin Readers
Privilege name: Postfixadmin Readers
Description: Reading of mail accounts and attributes
Permissions: System: Read Alias Data, System: Read Mailbox data, System: Read Domain
But the attributes ‘status’ and ‘isBackupMx’ are not showing when searching with a system account:
root@dbb25e3571bd:/etc/postfix/ldap# ldapsearch -D uid=system,cn=sysaccounts,cn=etc,dc=ipa,dc=test -W -b cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test -H ldap://172.17.0.2 cn=domain.test
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test> with scope subtree
# filter: cn=domain.test
# requesting: ALL
#
# med-lo.eu, postfixadmin, mailserver, etc, ipa.test
dn: cn=domain.test.eu,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test
cn: domain.test
objectClass: postfixDomain
objectClass: nsContainer
objectClass: top
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
When searching with an admin user:
[root@ipa /]# ldapsearch -b dc=ipa,dc=test cn=domain.test
SASL/GSSAPI authentication started
SASL username: admin(a)IPA.TEST
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=ipa,dc=test> with scope subtree
# filter: cn=domain.test
# requesting: ALL
#
# med-lo.eu, postfixadmin, mailserver, etc, ipa.test
dn: cn=med-lo.eu,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test
cn: domain.test
isBackupMx: FALSE
objectClass: postfixDomain
objectClass: nsContainer
objectClass: top
status: TRUE
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
I have the exact same code for other objects, and I get to see the attributes that are part of an objectclass for that object. But this one, somehow, is not working.
Any tips?
Best,
Francis
6 months, 2 weeks
Error when updating schema
by Francis Augusto Medeiros-Logeay
Hi,
I’m updating the schema to create a few new object classes for my plugin. It worked well on test, now I want to install it on my production servers (I have a few replicas).
I am getting the following error when issuing a isa-ldap-updater command:
Error caught updating nsDS5ReplicatedAttributeList: Server is unwilling to perform: Entry and attributes are managed by topology plugin.No direct modifications allowed.
Error caught updating nsDS5ReplicatedAttributeListTotal: Server is unwilling to perform: Entry and attributes are managed by topology plugin.No direct modifications allowed.
Error caught updating nsDS5ReplicatedAttributeList: Server is unwilling to perform: Entry and attributes are managed by topology plugin.No direct modifications allowed.
Error caught updating nsDS5ReplicatedAttributeListTotal: Server is unwilling to perform: Entry and attributes are managed by topology plugin.No direct modifications allowed.
How can I fix this?
Best,
Francis
6 months, 2 weeks
Freeipa server installation with keys stored in TPM
by John Phillips
As most servers, physical and virtual are now equipped with a TPM, are there any plans to leverage this to store keys for FreeIPA?
We have a use-case where freeipa is a sub-ca and the root-ca will sign our cert. Ideally we would like to store the private keys in TPM - specifically AWS NitroTPM
I know that HSM has recently been supported - is it feasible to leverage a similar process to support TPMs?
6 months, 2 weeks
FreeIPA users can't run processes within scope units on Fedora 39
by Sam Morris
I've just installed a Fedora 39 system and joined it to my IPA domain.
I've found that when an IPA user connects with SSH, they can't launch
podman rootless containers, nor can they create scope units.
Local users are unaffected, hence I thought I'd post here in the hope
that someone else can reproduce the error and/or can suggest additional
troubleshooting steps.
Here's what systemd logs when I try run 'systemd-run --user --scope echo
hello':
Nov 15 08:52:15 systemd[6789]: run-r340eeb2a10484700937e131eaa242301.scope: Couldn't move process 127204 to requested cgroup '/user.slice/user-1673000001.slice/user(a)1673000001.service/app.slice/run-r340eeb2a10484700937e131eaa242301.scope' (directly or via the system bus): Input/output error
Nov 15 08:52:15 systemd[6789]: run-r340eeb2a10484700937e131eaa242301.scope: Failed to add PIDs to scope's control group: Permission denied
Nov 15 08:52:15 systemd[6789]: run-r340eeb2a10484700937e131eaa242301.scope: Failed with result 'resources'.
Nov 15 08:52:15 systemd[6789]: Failed to start run-r340eeb2a10484700937e131eaa242301.scope - /usr/bin/echo hello.
Full details are at
<https://bugzilla.redhat.com/show_bug.cgi?id=2249514>.
--
Sam Morris <https://robots.org.uk/>
PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9
6 months, 2 weeks