Unable to create an Active Directory Trust
by PAESSENS Daniel (BCS/PSD)
Hello,
When performing a trust between IPA & AD I get the following error:
CIFS server communication error: code "-1073741771", message "The object name already exists." (both may be "None")
For testing purpose did I remove the trust and want to re-add him like before.
Regards,
Daniel
________________________________
**** DISCLAIMER****
http://www.bics.com/maildisclaimer/
6 years, 7 months
FreeIPA failover not working
by Michael Gusek
Hi,
we are testing a FreeIPA trust to an Active Directory. Trust itself
works, we are happy. Now we tested a failure on FreeIPA site. We have
two instances, both with same roles. If we poweroff first installed
server, and clean sssd caches with restart of sssd on client side , sssd
service can’t establish a connection to second instance.
ipa-lx-test-01.ipa.example.com is the first installed FreeIPA with
ipa-server-4.4.0-14.el7.centos.7.x86_64 on latest CentOS7
ipa-lx-test-02.ipa.example.com is the second installed FreeIPA with
ipa-server-4.4.0-14.el7.centos.7.x86_64 on latest CentOS7
ipa-lx-test-debian9.ipa.example.com is a latest Debian 9.1 with sssd
1.15.0-3
For deeper inspection full log is attached. In logs we found something
like this:
|(Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[set_server_common_status] (0x0100): Marking server
'ipa-lx-test-01.ipa.example.com' as 'name resolved' (Wed Aug 23 16:07:06
2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x1000):
Saving the first resolved server (Wed Aug 23 16:07:06 2017)
[sssd[be[ipa.example.com]]] [be_resolve_server_process] (0x0200): Found
address for server ipa-lx-test-01.ipa.example.com: [x.x.x.x] TTL 1200
(Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[ipa_resolve_callback] (0x0400): Constructed uri
'ldap://ipa-lx-test-01.ipa.example.com' (Wed Aug 23 16:07:06 2017)
[sssd[be[ipa.example.com]]] [unique_filename_destructor] (0x2000):
Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_2zXOse] (Wed Aug 23
16:07:06 2017) [sssd[be[ipa.example.com]]] [unlink_dbg] (0x2000): File
already removed: [/var/lib/sss/pubconf/.krb5info_dummy_2zXOse] (Wed Aug
23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x4000): Using file descriptor [19] for
the connection. (Wed Aug 23 16:07:06 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for
connecting (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[sssd_async_connect_done] (0x0020): connect failed [113][Keine Route zum
Zielrechner]. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_done] (0x0020): sdap_async_sys_connect request
failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [sssd_async_socket_state_destructor]
(0x0400): closing socket [19] (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [sss_ldap_init_sys_connect_done] (0x0020):
sssd_async_socket_init request failed: [113]: Keine Route zum
Zielrechner. (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[sdap_sys_connect_done] (0x0020): sdap_async_connect_call request
failed: [113]: Keine Route zum Zielrechner. (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [sdap_handle_release] (0x2000): Trace:
sh[0x558252c36770], connected[0], ops[(nil)], ldap[(nil)],
destructor_lock[0], release_memory[0] (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [_be_fo_set_port_status] (0x8000): Setting
status: PORT_NOT_WORKING. Called from:
../src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done:
1572 (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[fo_set_port_status] (0x0100): Marking port 389 of server
'ipa-lx-test-01.ipa.example.com' as 'not working' (Wed Aug 23 16:07:09
2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0400): Marking
port 389 of duplicate server 'ipa-lx-test-01.ipa.example.com' as 'not
working' |
Thats true, ‘Keine Route zum Zielrechner’ means ‘no route to host’,
first instance is poweroff. Well looking forward in logfile
|(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Wed
Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]] [get_server_status]
(0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name not
resolved' (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[get_port_status] (0x1000): Port status of port 389 for server
'ipa-lx-test-02.ipa.example.com' is 'neutral' (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [fo_resolve_service_activate_timeout]
(0x2000): Resolve timeout set to 6 seconds (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [resolve_srv_send] (0x0200): The status of
SRV lookup is resolved (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [get_server_status] (0x1000): Status of
server 'ipa-lx-test-02.ipa.example.com' is 'name not resolved' (Wed Aug
23 16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_is_address]
(0x4000): [ipa-lx-test-02.ipa.example.com] does not look like an IP
address (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_step] (0x2000): Querying files (Wed Aug 23
16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record
of 'ipa-lx-test-02.ipa.example.com' in files (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking
server 'ipa-lx-test-02.ipa.example.com' as 'resolving name' (Wed Aug 23
16:07:09 2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_step]
(0x2000): Querying files (Wed Aug 23 16:07:09 2017)
[sssd[be[ipa.example.com]]] [resolv_gethostbyname_files_send] (0x0100):
Trying to resolve AAAA record of 'ipa-lx-test-02.ipa.example.com' in
files (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_next] (0x0200): No more address families to retry
(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_step] (0x2000): Querying DNS (Wed Aug 23 16:07:09
2017) [sssd[be[ipa.example.com]]] [resolv_gethostbyname_dns_query]
(0x0100): Trying to resolve A record of 'ipa-lx-test-02.ipa.example.com'
in DNS (Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[schedule_request_timeout] (0x2000): Scheduling a timeout of 6 seconds
(Wed Aug 23 16:07:09 2017) [sssd[be[ipa.example.com]]]
[schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher (Wed
Aug 23 16:07:10 2017) [sssd[be[ipa.example.com]]] [check_fd_timeouts]
(0x4000): Checking for DNS timeouts (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [check_fd_timeouts] (0x4000): Checking for
DNS timeouts (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[resolv_gethostbyname_dns_parse] (0x1000): Parsing an A reply (Wed Aug
23 16:07:11 2017) [sssd[be[ipa.example.com]]] [request_watch_destructor]
(0x0400): Deleting request watch (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [set_server_common_status] (0x0100): Marking
server 'ipa-lx-test-02.ipa.example.com' as 'name resolved' (Wed Aug 23
16:07:11 2017) [sssd[be[ipa.example.com]]] [be_resolve_server_process]
(0x0200): Found address for server ipa-lx-test-02.ipa.example.com:
[x.x.x.x] TTL 1200 (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [ipa_resolve_callback] (0x0400): Constructed
uri 'ldap://ipa-lx-test-02.ipa.example.com' (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [unique_filename_destructor] (0x2000):
Unlinking [/var/lib/sss/pubconf/.krb5info_dummy_U1QQrA] (Wed Aug 23
16:07:11 2017) [sssd[be[ipa.example.com]]] [unlink_dbg] (0x2000): File
already removed: [/var/lib/sss/pubconf/.krb5info_dummy_U1QQrA] (Wed Aug
23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x4000): Using file descriptor [19] for
the connection. (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sssd_async_socket_init_send] (0x0400): Setting 6 seconds timeout for
connecting (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_ldap_connect_callback_add] (0x1000): New LDAP connection to
[ldap://ipa-lx-test-02.ipa.example.com:389/??base] with fd [19]. (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_get_rootdse_send] (0x4000): Getting rootdse (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_print_server] (0x2000):
Searching x.x.x.x:389 (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x0400):
calling ldap_search_ext with [(objectclass=*)][]. (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [*] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [altServer] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [namingContexts] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedControl] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedExtension] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedFeatures] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedLDAPVersion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [supportedSASLMechanisms] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [domainControllerFunctionality] (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [defaultNamingContext] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [lastUSN] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x1000):
Requesting attrs: [highestCommittedUSN] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_ext_step] (0x2000):
ldap_search_ext called, msgid = 1 (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_op_add] (0x2000): New operation 1
timeout 6 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1],
ops[0x558252c36640], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_ENTRY] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_entry] (0x1000): OriginalDN: [].
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_parse_range] (0x2000): No sub-attributes for [objectClass] (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [sdap_parse_range]
(0x2000): No sub-attributes for [vendorName] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [vendorVersion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [dataversion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [netscapemdsuffix] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [changeLog] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [firstchangenumber] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [lastchangenumber] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [ipatopologypluginversion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [ipatopologyismanaged] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [ipaDomainLevel] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [namingContexts] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedControl] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedExtension] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedFeatures] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedLDAPVersion] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [supportedSASLMechanisms] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [defaultNamingContext] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_parse_range] (0x2000): No
sub-attributes for [lastUSN] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace:
sh[0x558252c35750], connected[1], ops[0x558252c36640],
ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_message] (0x4000): Message
type: [LDAP_RES_SEARCH_RESULT] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_generic_op_finished] (0x0400):
Search result: Success(0), no errmsg set (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_op_destructor] (0x2000): Operation 1
finished (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_get_rootdse_done] (0x2000): Got rootdse (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_rootdse_done] (0x2000): Skipping
auto-detection of match rule (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [get_naming_context] (0x0200): Using value
from [defaultNamingContext] as naming context. (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_set_search_base] (0x0100):
Setting option [ldap_sudo_search_base] to [dc=ipa,dc=example,dc=com].
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[common_parse_search_base] (0x0100): Search base added:
[SUDO][dc=ipa,dc=example,dc=com][SUBTREE][] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_get_server_opts_from_rootdse]
(0x4000): USN value: 41151 (int: 41151) (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_kinit_send] (0x0400): Attempting kinit
(default, host/ipa-lx-test-debian9.ipa.example.com, ipa.example.com,
86400) (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_kinit_next_kdc] (0x1000): Resolving next KDC for service IPA (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[fo_resolve_service_send] (0x0100): Trying to resolve service 'IPA' (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_server_status]
(0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name
resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[fo_resolve_service_activate_timeout] (0x2000): Resolve timeout set to 6
seconds (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[resolve_srv_send] (0x0200): The status of SRV lookup is resolved (Wed
Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]] [get_server_status]
(0x1000): Status of server 'ipa-lx-test-02.ipa.example.com' is 'name
resolved' (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[be_resolve_server_process] (0x1000): Saving the first resolved server
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[be_resolve_server_process] (0x0200): Found address for server
ipa-lx-test-02.ipa.example.com: [x.x.x.x] TTL 1200 (Wed Aug 23 16:07:11
2017) [sssd[be[ipa.example.com]]] [sdap_kinit_kdc_resolved] (0x1000):
KDC resolved, attempting to get TGT... (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [create_tgt_req_send_buffer] (0x0400):
buffer size: 81 (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[child_handler_setup] (0x2000): Setting up signal handler up for pid
[2104] (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[child_handler_setup] (0x2000): Signal handler set up for pid [2104]
(Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[set_tgt_child_timeout] (0x0400): Setting 6 seconds timeout for tgt
child (Wed Aug 23 16:07:11 2017) [sssd[be[ipa.example.com]]]
[sdap_process_result] (0x2000): Trace: sh[0x558252c35750], connected[1],
ops[(nil)], ldap[0x558252c130c0] (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [sdap_process_result] (0x2000): Trace: end
of ldap_result list (Wed Aug 23 16:07:11 2017)
[sssd[be[ipa.example.com]]] [write_pipe_handler] (0x0400): All data has
been sent! (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]]
[get_tgt_timeout_handler] (0x4000): timeout for sending SIGTERM to tgt
child [2104] reached. (Wed Aug 23 16:07:17 2017)
[sssd[be[ipa.example.com]]] [get_tgt_timeout_handler] (0x0400): Setting
2 seconds timeout for sending SIGKILL to tgt child (Wed Aug 23 16:07:17
2017) [sssd[be[ipa.example.com]]] [read_pipe_handler] (0x0400): EOF
received, client finished (Wed Aug 23 16:07:17 2017)
[sssd[be[ipa.example.com]]] [child_sig_handler] (0x1000): Waiting for
child [2104]. (Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]]
[child_sig_handler] (0x0020): child [2104] failed with status [7]. (Wed
Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]] [child_callback]
(0x0020): LDAP child was terminated due to timeout (Wed Aug 23 16:07:17
2017) [sssd[be[ipa.example.com]]] [sdap_kinit_done] (0x0080):
Communication with KDC timed out, trying the next one (Wed Aug 23
16:07:17 2017) [sssd[be[ipa.example.com]]] [_be_fo_set_port_status]
(0x8000): Setting status: PORT_NOT_WORKING. Called from:
../src/providers/ldap/sdap_async_connection.c: sdap_kinit_done: 1207
(Wed Aug 23 16:07:17 2017) [sssd[be[ipa.example.com]]]
[fo_set_port_status] (0x0100): Marking port 389 of server
'ipa-lx-test-02.ipa.example.com' as 'not working' (Wed Aug 23 16:07:17
2017) [sssd[be[ipa.example.com]]] [fo_set_port_status] (0x0400): Marking
port 389 of duplicate server 'ipa-lx-test-02.ipa.example.com' as 'not
working' |
Ok, second server was found, but we ran in an timeout getting a TGT. If
i manually try to get a kerberos ticket it works, but with a long delay.
ipa-lx-test-debian9.ipa.example.com’s sssd.conf:
|[domain/ipa.example.com] cache_credentials = True
krb5_store_password_if_offline = True ipa_domain = ipa.example.com
id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname
= ipa-lx-test-debian9.ipa.example.com chpass_provider = ipa
ipa_dyndns_update = True ipa_server = _srv_,
ipa-lx-test-01.ipa.example.com ldap_tls_cacert = /etc/ipa/ca.crt
#subdomain_homedir = /home/%u fallback_homedir = /home/%u default_shell
= /bin/bash shell_fallback = /bin/bash debug_level = 10 [sssd] services
= nss, sudo, pam, ssh config_file_version = 2 domains = nbg.webtrekk.com
default_domain_suffix = example.com full_name_format = %1$s debug_level
= 10 [nss] debug_level = 10 [pam] [sudo] [autofs] [ssh] debug_level = 10
[pac] [ifp] |
So some need is help.
Michael
6 years, 7 months
Re: problem installing 3rd party(trusted cert)
by Florence Blanc-Renaud
On 08/30/2017 08:26 PM, Rob Morin wrote:
> I ran this command firstly:
>
> The G2 root CA from Geotrust website..........
>
> [root@auth-1 certs]# ipa-cacert-manage -p 7t7FR.08 -n httpcrt -t C,,
> install root_ca.crt
> Installing CA certificate, please wait
> CA certificate successfully installed
> The ipa-cacert-manage command was successful
>
>
> Then, I ran....
>
> [root@auth-1 certs]# ipa-certupdate
> trying https://auth-1.domain.com/ipa/session/json
> Forwarding 'ca_is_enabled' to json server
> 'https://auth-1.domain.com/ipa/session/json'
> Forwarding 'ca_find/1' to json server
> 'https://auth-1.domain.com/ipa/session/json'
> Systemwide CA database updated.
> Systemwide CA database updated.
> The ipa-certupdate command was successful
>
>
> Then i ran this command with intermediate cert..........
>
> [root@auth-1 certs]# ipa-cacert-manage -p 7t7FR.08 -n httpcrt_bundle -t
> C,, install star_domain_com_bundle.crt
> Installing CA certificate, please wait
> Not a valid CA certificate: (SEC_ERROR_UNKNOWN_ISSUER) Peer's
> Certificate issuer is not recognized. (visit
> http://www.freeipa.org/page/Troubleshooting for troubleshooting guide)
> The ipa-cacert-manage command failed.
>
> The intermediate cert only has one cert in it....
>
> SO i have 4 files;
> Intermediate cert: star_domain_bundle.crt
> Real cert : star_domain.crt
> Key : star_domain.key
>
> I did try various combinations
>
> cat star_domain_bundle.crt star_domain.crt >star_domain_combined.crt
> cat star_domain.crt star_domain_bundle.crt > star_domain_combined.crt
> cat root_ca.crt star_domain.crt star_domain_bundle.crt >
> star_domain_combined.crt
> cat star_domain.crt star_domain_bundle.crt root_ca.crt star >
> star_domain_combined.crt
> and so on...
>
> Then i tried adding each one of those with the same command mentioned
> above, no go
>
> What do i do now?
> Thanks!
>
>
Hi
(putting the mailing back in the recipients lsit)
can you run ipa-cacert-manage install with the -v option and post the
output? We will be able to see which certificates are already trusted
and can be downloaded from LDAP.
Also, which IPA version are you using? Is your machine in SElinux
enforcing mode?
Flo
>
>
>
> On Mon, Aug 28, 2017 at 10:30 AM, Florence Blanc-Renaud <flo(a)redhat.com
> <mailto:flo@redhat.com>> wrote:
>
> On 08/28/2017 04:00 PM, Rob Morin via FreeIPA-users wrote:
>
> Hello all...
>
> So i have a wildcard cert from geotrust.
> I am running freeipa V4.4 fresh install no users yet
> I downloaded and installed their GeoTrust Primary Certification
> Authority root cert from here -->
> https://www.geotrust.com/resources/root-certificates/
> <https://www.geotrust.com/resources/root-certificates/>
> I ran this command to import it...
>
> ipa-cacert-manage -p password -n httpcrt -t C,, install root_ca.crt
>
> I get back this ;
>
> Installing CA certificate, please wait
> CA certificate successfully installed
> The ipa-cacert-manage command was successful
> Then i go to install just the http cert for freeipa as dictated
> by company policy
>
> Then I run this...
>
> ipa-certupdate
>
> Then i go to add the cert like this...
>
> ipa-server-certinstall -w star_domain_com.key star_domain_com.crt
> Directory Manager password:
> Enter private key unlock password:
>
> I get this back....
>
> The full certificate chain is not present in
> star_domain_com.key, star_domain_com.crt
> The ipa-server-certinstall command failed.
>
> So I combined the bundle and cert into one file, still a no go ,
> i tried bot ways cert first then bundle, and bundle first then
> cert, still a no go.
> Any ideas?
>
> Thanks..
> _______________________________________________
> FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>
> Hi,
>
> is your http cert directly signed by the CA root_ca.crt, or does the
> cert chain contain additional certificates? In the latter case, you
> need to add each intermediate certificate with ipa-cacert-manage +
> ipa-certupdate before running ipa-server-certinstall.
>
> HTH,
> Flo
>
>
>
>
> --
>
> --
>
> Rob Morin
> Montreal, Canada
>
> The Lounge Sound - Music to drink by - Vegas Style!
>
> http://www.theloungesound.ca
>
> "You're not drunk until you can't lie on the floor without holding on"
> Dean Martin
>
>
6 years, 7 months
Re: Freeipa Certficates issues
by Florence Blanc-Renaud
On 08/29/2017 06:43 PM, Julien Honore wrote:
> Hi Florence,
>
> Thank you for the reply.
>
> When I execute the command sudo kinit -kt /etc/krb5.keytab
> the result is :
> kinit: Clients credentials have been revoked while getting initial credentials
>
> When I try the command ipa-getkeytab, I don't have the same option.
>
Hi,
(putting mailing list back in the recipients list)
you are right, the --retrieve option was added only in IPA 4.x.
If you run ipa-getkeytab without the -r option, it will request a new
host keytab (all other keytabs previously obtained will be invalidated).
So this should unblock certmonger, but if you were using the host keytab
in other places you will need to overwrite them with the new keytab.
Flo
> Thank you.
>
> Julien Honore.
>
> ----- Original Message -----
> From: "Florence Blanc-Renaud" <flo(a)redhat.com>
> To: "freeipa-users" <freeipa-users(a)lists.fedorahosted.org>
> Cc: "Julien Honore" <jhonore(a)bmad.tech>
> Sent: Tuesday, 29 August, 2017 12:14:10
> Subject: Re: [Freeipa-users] Freeipa Certficates issues
>
> On 08/29/2017 04:09 PM, Julien Honore via FreeIPA-users wrote:
>>
>> Hi,
>>
>> I have an issue with my freeipa server.
>>
>> The certificates expired and I can't resubmit.
>>
>> I put the date before the expiration of the certs.
>>
>> The result of ipa-getcert list :
>>
>>
>> Number of certificates and requests being tracked: 8.
>> Request ID '20150805183502':
>> status: MONITORING
>> ca-error: Error setting up ccache for "host" service on client using
>> default keytab: Clients credentials have been revoked.
>> stuck: no
>> key pair storage:
>> type=NSSDB,location='/etc/dirsrv/slapd-VIT-LAN',nickname='Server-Cert',token='NSS
>> Certificate DB',pinfile='/etc/dirsrv/slapd-VIT-LAN/pwdfile.txt'
>> certificate:
>> type=NSSDB,location='/etc/dirsrv/slapd-VIT-LAN',nickname='Server-Cert',token='NSS
>> Certificate DB'
>> CA: IPA
>> issuer: CN=Certificate Authority,O=VIT.LAN
>> subject: CN=auth0.vit.lan,O=VIT.LAN
>> expires:2017-08-05 18 <callto:2017-08-05 18>:35:02 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command:
>> post-save command:
>> track: yes
>> auto-renew: yes
>> Request ID '20150805183539':
>> status: MONITORING
>> ca-error: Error setting up ccache for "host" service on client using
>> default keytab: Clients credentials have been revoked.
>> stuck: no
>> key pair storage:
>> type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS
>> Certificate DB',pinfile='/etc/dirsrv/slapd-PKI-IPA/pwdfile.txt'
>> certificate:
>> type=NSSDB,location='/etc/dirsrv/slapd-PKI-IPA',nickname='Server-Cert',token='NSS
>> Certificate DB'
>> CA: IPA
>> issuer: CN=Certificate Authority,O=VIT.LAN
>> subject: CN=auth0.vit.lan,O=VIT.LAN
>> expires:2017-08-05 18 <callto:2017-08-05 18>:35:39 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command:
>> post-save command:
>> track: yes
>> auto-renew: yes
>> Request ID '20150805183647':
>> status: MONITORING
>> ca-error: Error setting up ccache for "host" service on client using
>> default keytab: Clients credentials have been revoked.
>> stuck: no
>> key pair storage:
>> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
>> Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
>> certificate:
>> type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS
>> Certificate DB'
>> CA: IPA
>> issuer: CN=Certificate Authority,O=VIT.LAN
>> subject: CN=auth0.vit.lan,O=VIT.LAN
>> expires:2017-08-05 18 <callto:2017-08-05 18>:36:47 UTC
>> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
>> eku: id-kp-serverAuth,id-kp-clientAuth
>> pre-save command:
>> post-save command:
>> track: yes
>> auto-renew: yes
>>
>> If someone can help me with this issue ? It will be very helpful
>>
>> Directory Service: RUNNING
>> KDC Service: RUNNING
>> KPASSWD Service: RUNNING
>> MEMCACHE Service: RUNNING
>> HTTP Service: RUNNING
>> CA Service: RUNNING
>> ADTRUST Service: RUNNING
>> EXTID Service: RUNNING
>>
>> FreeIpa V3.
>>
>> Thank you
>>
>> Julien Honore
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>>
> Hi,
>
> I have very little experience with IPA v3, but let's try anyway... If
> things didn't change too much, certmonger's IPA helper is using
> /etc/krb5.keytab to connect to IPA server. Can you check if this keytab
> is still valid using
> $ sudo kinit -kt /etc/krb5.keytab
>
> If the operation fails, this is probably the root cause of your issue.
> The utility ipa-getkeytab will allow you to get the host keytab (with
> the --retrieve option and --principal=host/$HOSTNAME@$DOMAINNAME).
>
> HTH,
> Flo
>
6 years, 7 months
using external passwords
by Charles Hedrick
We have a department that would like to use IPA, but would like users to use their University passwords.
I conjecture that we can do that by generating users with random passwords, but setting the default authentication as RADIUS, and using a RADIUS server that authenticates with the University using LDAP.
Does this sound workable?
6 years, 7 months