I'm having problems with kinit and a 2FA enabled account.
When I run kinit by itself, it says 'kinit: Generic preauthentication
failure while getting initial credentials'.
I saw on the wiki where that problem is solved by doing one of two
things. You can login with the admin account (or some other non-2FA
account). When I do that, it asks for the OTP, but then I get a similar
Ticket cache: FILE:/tmp/krb5cc_760400007
Default principal: admin(a)IDM.XXX.NET
Valid starting Expires Service principal
02/06/2018 15:58:04 02/07/2018 15:57:52 krbtgt/IDM.XXX.NET(a)IDM.XXX.NET
$ kinit -T FILE:/tmp/krb5cc_760400007 jratliff
Enter OTP Token Value:
kinit: Preauthentication failed while getting initial credentials
The same thing happens when I try to do the anonymous authentication.
I put the output of KRB5_TRACE here https://pastebin.com/jpPDVUXi
This happens on the CentOS 7.4 IdM server (Running 4.5 IPA) and a Debian
9 IdM client machine.
Thanks for any assistance.
I just got FreeIPA added as a client and then I tried to promote it as a replica. I got the following error:
Done configuring kadmin.
Configuring directory server (dirsrv)
[1/3]: configuring TLS for DS instance
[error] RuntimeError: Certificate issuance failed (CA_REJECTED)
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Certificate issuance failed (CA_REJECTED)
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
I'm trying to setup freeipa with OTP. I created a TOTP under my user in
freeipa and updated my user to use 2FA (password + OTP).
When I try to do sudo, it only asks for my password and it fails every
time (presumably because it isn't getting the OTP first).
I didn't see anything useful in the sss_sudo logs, even after adding
debug_level = 6 in the config.
What can I do to further troubleshoot this?
I m reading this :
It need create a service ac under
BUt which file ldif I should point to ? or just ignore use anther
ldapmodify -f <path/to/ldif> or ldapmodify -x -D ..??
userPassword: <The service account password>
ldapmodify -f <path/to/ldif> -D 'cn=Directory Manager' -W -H ldap://host.ipa
ldapwhoami -Z -D 'krbprincipalname=radius/
I recently upgraded to version 4.5 of FreeIPA. I only upgraded the server, not the clients. Do my clients now have to use pkinit? Or is it optional? How can I check what is being used? I’m concerned that if the environment now is so certificate centric, I will someday be locked out because some certificate has expired.
I have freeipa with AD trust.
I want to setup Nextcloud with ipa and ad users.
Ldap in cn=compat,dc=dom,dc=lan doesnt have memberOf atribute.
I setup ipsilon (https://ipsilon-project.org/) for SSO and SAML autentification.
Autentification with login and password works
But i have local domain for ipsilon and nextcloud and kerberos DOM.LAN and internet domain domain.ru
So, when I go to nextcloud with my kerberos tiket, i get 500 internal error.
Maybe anybody knows how correct this mistake?
С уважением, Николай.
I'm sorry for a dumb question, but i cant find documentation on ldif file syntax, that can be used for unattended installation like ipa-server-install --dirsrv-config-file params.ldif. Can someone point me to this doc or share the example of this file?
Anyone has exp to use freeipa 4.0 above as radius server ? e.g want wifi
use radius everyone carry ldap password.
How to implement ? need special plugin ? seem it need new
attribute can generate harsh password and syn with LDAP together ?
Thx and Regards
We are trying to deploy FreeIPA in our environment, this will be a mix of local servers and server to manage auth in EC2. We have a vpn tunnel setup and are able to communicate across it. Ina Amazon Linux 2 instance I was able to get FreeIPA installed as a client and am now trying to promote it to a replica. However I am getting the following error:
[ec2-user@freeipa-host ~]$ sudo ipa-replica-install --setup-ca --ssh-trust-dns --mkhomedir --setup-kra
Password for admin(a)domain.NET:
ipa : ERROR Reverse DNS resolution of address 10.10.52.158 (infra-freeipa1-aws.gatewayblend.net) failed. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.)
Doing some digging on Google I found this
In this instance DNS was NOT setup on the FreeIPA machine in AWS and fqdn were setup in /etc/hosts and /etc/hostname.
1) is the the preferred method?
2) Could I still install DNS on the server in AWS to ONLY manage an internal zone?