Joining realm failed: libcurl failed to execute the HTTP POST transaction
by Bryan Fang
Hi Folks,
I'm blocked by the issue for several day, I am trying to enroll one machine to IPA server
ipa-client-install --mkhomedir --domain=domain1.com --server=ipa.domain.com --realm=DOMAIN.COM --force-ntpd --hostname=ipa.domain1.com
the error message is:
Joining realm failed: libcurl failed to execute the HTTP POST transaction, explaining: SSL certificate problem: unable to get local issuer certificate
Then I checked /etc/pki/tls/certs/ca-bundle.crt, the root CA and ipa server crt are existing in ca-bundle.crt, would you please let me know how to fix the issue? thanks in advance!
Best regards,
Bryan
1 year, 3 months
Adding replica fails at "Failed to add fallback group."
by Jernej Jakob
Hi. I'm having problems adding a replica. I think it's related to id
ranges not being set correctly on the existing server.
Some context that isn't strictly related to the error but I think is
relevant.
Initially there used to be 2 servers, ipa1 and ipa2, both CentOS 7,
fully up to date. Some time last year replication fell and I tried to
fix it but was unable to. Since the error was in the ipa2-to-ipa1
direction I tried to reinit ipa1 but that failed and left ipa1 in a
deconfigured, non-working state (I could give you more details but I
don't think it's necessary at this time). I thus uninstalled ipa1 and
went to try to salvage the still working ipa2 server. After making both
a backup of the VM and a full ipa-backup, I went through the process of
adding a new replica, which I decided to install on Rocky Linux 8 in
order to start the upgrade process at the same time (with a goal to get
to Rocky 9 later).
First I hit the "SASL encrypted packet length exceeds maximum allowed
limit" error which I solved by increasing nsslapd-maxsasliosize and
nsslapd-sasl-max-buffer-size on ipa2 and setting those values in
ipa-replica-install --dirsrv-config-file.
After that I hit this "Failed to add fallback group." error. I found
two existing threads on this mailing list, one from 2017 and one from
just a couple days ago, and a Red Hat KB page that I can't view. [1]
I understand the fix may be to modify/set ID ranges but I'm not exactly
sure how so I'm asking for your help.
Below are logs of the error and current state of range settings.
### ipa-replica-install error on ipa3
full log is here: https://0x0.st/oFDg.txt
Configuring SID generation
[1/7]: creating samba domain object
[2/7]: adding admin(group) SIDs
[3/7]: adding RID bases
[4/7]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
[5/7]: activating sidgen task
[6/7]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
[7/7]: adding fallback group
Failed to load default-smb-group.ldif: CalledProcessError(Command ['/usr/bin/ldapmodify', '-v', '-f', '/tmp/tmpbg9tdvpw', '-H', 'ld
api://%2Frun%2Fslapd-ABAK-SI.socket', '-Y', 'EXTERNAL'] returned non-zero exit status 1: 'ldap_initialize( ldapi://%2Frun%2Fslapd-A
BAK-SI.socket/??base )\nSASL/EXTERNAL authentication started\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=aut
h\nSASL SSF: 0\nldap_add: Operations error (1)\n\tadditional info: Allocation of a new value for range cn=posix ids,cn=distributed
numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed.\n')
Failed to add fallback group.
### range settings
[jernej@ipa2 ~]$ sudo ipa-replica-manage dnarange-show
ipa2.abak.si: No range set
ipa3.abak.si: No range set
[jernej@ipa2 ~]$ ipa idrange-find
----------------
2 ranges matched
----------------
Range name: ABAK.SI_id_range
First Posix ID of the range: 792600000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range type: local domain range
Range name: ABAK.SI_subid_range
First Posix ID of the range: 2147483648
Number of IDs in the range: 2147352576
First RID of the corresponding RID range: 2147283648
Domain SID of the trusted domain: S-1-5-21-738065-838566-3187085368
Range type: Active Directory domain range
----------------------------
Number of entries returned 2
----------------------------
[jernej@ipa2 ~]$ sudo ipa-replica-manage list
ipa3.abak.si: master
ipa2.abak.si: master
[jernej@ipa2 ~]$ sudo ipa-replica-manage dnanextrange-show
Directory Manager password:
ipa2.abak.si: No on-deck range set
ipa3.abak.si: No on-deck range set
[jernej@ipa2 ~]$ ldapsearch -x -D 'cn=Directory Manager' -W -b 'cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn
=config'
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# Posix IDs, Distributed Numeric Assignment Plugin, plugins, config
dn: cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config
cn: Posix IDs
dnaExcludeScope: cn=provisioning,dc=abak,dc=si
dnaFilter: (|(objectClass=posixAccount)(objectClass=posixGroup)(objectClass=ip
aIDobject))
dnaMagicRegen: -1
dnaMaxValue: 1100
dnaNextValue: 1101
dnaScope: dc=abak,dc=si
dnaSharedCfgDN: cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=abak,dc=si
dnaThreshold: 500
dnaType: uidNumber
dnaType: gidNumber
objectClass: top
objectClass: extensibleObject
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
[1]: https://access.redhat.com/solutions/6958018
1 year, 3 months
Migration to new server - recommended steps/best practices
by Andreas Bulling
Dear all,
I am running FreeIPA 4.8.1-2ubuntu1 on Ubuntu 19.10. A replica server
with the same FreeIPA and Ubuntu versions is running as well.
Given that Ubuntu doesn't seem to have any more current FreeIPA packages
available any more, I would like to migrate my master server (later also
the replica) to Rocky Linux release 9.1 that offers FreeIPA
4.10.0-8.el9_1.x86_x86
I have gone through the documentation that I could find on migrating a
server - some outdated/not maintained anymore, some requiring a command
ipa-replica-prepare that I don't seem to have on any of my systems.
What is the recommended/preferred/safe way of migrating my above server
setup? Could you point me to a resource where these are explained and/or
could you provide the necessary steps here?
Thank you so much in advance,
Andreas
1 year, 3 months
email field empty when editing user, but shown in Active user overview
by Djerk Geurts
FreeIPA VERSION: 4.10.1, API_VERSION: 2.251
Recently noticed that when I go to edit a user I can't see the configured email field. But the email does show up under the Active Users overview. Has anyone else noticed this, is this a known bug? Or could something else be going on?
Thanks,
1 year, 4 months
Is there a web-UI or GUI application for IPA Password Vault?
by Djerk Geurts
Hi,
Looking into whether KRA can be used for users who would rather not use a CLI for credential management. Is there a UI that can be used by users with KRA/Password Vault?
There's no AD trust, user machines are Windows and thus won't have valid Kerberos tickets. The IPA deployment is solely used for account management on the Linux server estate. Effectively I'm exploring if I can migrate away from sharing a password vault file on some cloud storage to using KRA for storage.
Thanks,
1 year, 4 months