Re: Peer certificate cannot be authenticated with given CA certificates
by Petr Beňas
Hi German,
thanks for having a look into this.
There is no customer case in the RedHat portal. We're using the upstream
FreeIPA from CentOS.
Attaching the /var/log/pki/pki-tomcat/ca/debug log. The timestamp of the
resubmission was Sat Nov 10 12:03:23 CET 2018 (time set back prior the
expiration). I don't see anything interesting from that time, though the
getcert list suggests it tried to talk to the ipa07 from which the debug
log was collected.
ca-error: Error 60 connecting to
https://ipa07.example.com:8443/ca/agent/ca/profileReview: Peer certificate
cannot be authenticated with given CA certificates.
Did not perform a full restore from backup since it would require a
re-initialization from single replica, which possesses a risk of losing
more CA replicas. However I confirmed the contents of
/etc/pki/pki-tomcat/alias are identical to other replicas, where no manual
changes were made. Can't restore the deleted CSR from o=ipaca, since I
don't have a backup of it. We have full backups (/usr/sbin/ipa-backup) of
other replica, so theoretically it should be possible to get if from there,
but we're getting the same error regardless the CSR removal. I've also
checked that cn=EXAMPLE.COM IPA
CA,cn=certificates,cn=ipa,cn=etc,dc=example,dc=com contains the latest CA
cert.
This is the output of requested commands. Same output also on a different
replica.
[root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert
cert-pki-ca" -u O
certutil: certificate is valid
[root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "subsystemCert
cert-pki-ca" -u C
certutil: certificate is valid
[root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "Server-Cert
cert-pki-ca" -u V
certutil: certificate is valid
[root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n
"auditSigningCert cert-pki-ca" -u J
certutil: certificate is valid
[root@ipa07:/] certutil -V -d /etc/pki/pki-tomcat/alias -n "caSigningCert
cert-pki-ca" -u L
certutil: certificate is valid
Thanks
Petr
On Tue, Jan 8, 2019 at 5:13 PM German Parente <gparente(a)redhat.com> wrote:
> Hi Petr,
>
> I was asked to take a look at this issue. I wanted to know if, in
> parallel, there is a customer case open in redhat portal.
>
> If not, could you provide the /var/log/pki-tomcat/ca/debug log file and
> the timestamp of resubmission ?
>
> I would not change manually the cert db's under /etc/pki/pki-tomcat/alias
> not delete or recreate any object under o=ipaca, as possible. If you have
> backups, please restore to original ones.
>
> I know about issues with certificate encoding. In general, the error I use
> to see is a little bit different like "error -8179:Peer's Certificate
> issuer is not recognized".
>
> It could be interesting to check your certificates in cert db once date
> has been set back by doing:
>
> certutil -V -d /etc/pki/pki-tomcat/alias -n "ocspSigningCert cert-pki-ca" -u O
>
> certutil -V -d /etc/pki/pki-tomcat/alias -n "subsystemCert cert-pki-ca" -u C
>
> certutil -V -d /etc/pki/pki-tomcat/alias -n "Server-Cert cert-pki-ca" -u V
>
> certutil -V -d /etc/pki/pki-tomcat/alias -n "auditSigningCert cert-pki-ca" -u J
>
> certutil -V -d /etc/pki/pki-tomcat/alias -n "caSigningCert cert-pki-ca" -u L
>
> that is more or less where our selftests are doing for PKI component.
>
> Thanks and regards,
>
> German.
>
>
>
>
> On Fri, Jan 4, 2019 at 1:44 PM Petr Benas via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org> wrote:
>
>> Hello,
>>
>> we have an issue with resubmitting several certificates.
>>
>> We suspect the reason might be the encoding mismatch between the
>> certificate and the CA certificate.
>>
>> Our environment was upgraded during the years from some 3.x version to
>> current 4.5.4. So the very first CA certificate was encoded in
>> PRINTABLESTRING.
>>
>> Issuer:
>> organizationName = PRINTABLESTRING:EXAMPLE.COM
>> commonName = PRINTABLESTRING:Certificate
>> Authority
>> Validity
>> Not Before: Dec 1 14:14:37 2014 GMT
>> Not After : Dec 1 14:14:37 2034 GMT
>> Subject:
>> organizationName = PRINTABLESTRING:EXAMPLE.COM
>> commonName = PRINTABLESTRING:Certificate
>> Authority
>>
>> When we renew-ed (due to SHA1) we got to PRINTABLESTRING X UTF8STRING and
>> after we renewed again, so now we have:
>>
>> Issuer:
>> organizationName = UTF8STRING:EXAMPLE.COM
>> commonName = UTF8STRING:Certificate Authority
>> Validity
>> Not Before: Oct 9 07:34:24 2017 GMT
>> Not After : Oct 9 07:34:24 2037 GMT
>> Subject:
>> organizationName = UTF8STRING:EXAMPLE.COM
>> commonName = UTF8STRING:Certificate Authority
>>
>> And most certificated were renewed fine.
>>
>> However, recently we noticed that several certificated can't be
>> resubmitted, all of them seem to be like this:
>>
>> Issuer:
>> organizationName = PRINTABLESTRING:EXAMPLE.COM
>> commonName = PRINTABLESTRING:Certificate
>> Authority
>> Validity
>> Not Before: Nov 24 12:17:12 2016 GMT
>> Not After : Nov 14 12:17:12 2018 GMT
>> Subject:
>> organizationName = UTF8STRING:EXAMPLE.COM
>> commonName = UTF8STRING:ipa07.example.com
>>
>> The error when resubmitting is:
>> Peer certificate cannot be authenticated with given CA certificates. The
>> tcpdump from 8443 says Unknown CA.
>>
>> Is the assumption that the encoding mismatch is blocking the submitting
>> certificate correct?
>> One of the certificate which we also can't renew is the 'IPA RA'
>> (/var/lib/ipa/ra-agent.pem)
>>
>> What we tried:
>> Add all versions of CA certificate to /etc/pki/pki-tomcat/alias
>> trust store (also add them one-by-one)
>> Setting date back before the expiration.
>> Advises from:
>> https://rcritten.wordpress.com/2017/09/20/peer-certificate-cannot-be-auth...
>> Deleting the related CSR from o=ipaca, supposing that newly
>> generated csr will be fine.
>>
>> Any suggestions what else we could try?
>>
>> Thanks
>> Petr
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>
>
5 years, 3 months
Recommendation for adding client with 2 NICs (laptop with LAN & WLAN)
by 74cmonty
Hi,
adding a client in WebUI is simple.
However, what do you recommend when adding a client with 2 NICs, e.g. laptop?
These devices have typically different NICs for LAN and WLAN.
And consequently there are 2 MAC addresses and 2 IPs.
But there's only 1 hostname (FQHN).
Any advise is appreciated.
THX & happy new year!
5 years, 3 months
pki tomcat issue: Unable to communicate with CMS 500
by Stijn De Weirdt
hi all,
we are running centos76 with ipa-server-4.6.4-10.el7 (one master and one
replica; the upgrade went fine on both) and we have a problem with pki
tomcat. (we are not sure since when this occurs, but it might be from
after the update)
ipactl status is ok on both master and replica, pki-tomcatd is running
(ports 8080, 8443, 8005 and 8009 are listening)
running 'ipa host-disable' fails with
> Certificate operation cannot be completed: Unable to communicate with CMS (500)
and the only hints i can find are in the
/var/log/pki/pki-tomcat/localhost.2019-01-08.log file (the .../ca/debug
has nothing relevant).
i pasted the backtrace below.
any help only how to further investiagte or debug are welcome.
stijn
> SEVERE: Servlet.service() for servlet [Resteasy] in context with path [/ca] threw exception
> org.jboss.resteasy.spi.UnhandledException: Response is committed, can't handle exception
> at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:148)
> at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:432)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:376)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
> at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
> at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
> at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:175)
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:297)
> at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55)
> at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191)
> at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187)
> at java.security.AccessController.doPrivileged(Native Method)
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186)
> at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
> at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
> at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
> at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:260)
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237)
> at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55)
> at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:191)
> at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:187)
> at java.security.AccessController.doPrivileged(Native Method)
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:186)
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:506)
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
> at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
> at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190)
> at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
> at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: org.jboss.resteasy.plugins.providers.jaxb.JAXBMarshalException: javax.xml.bind.MarshalException
> - with linked exception:
> [org.apache.catalina.connector.ClientAbortException: java.net.SocketException: Broken pipe (Write failed)]
> at org.jboss.resteasy.plugins.providers.jaxb.AbstractJAXBProvider.writeTo(AbstractJAXBProvider.java:128)
> at org.jboss.resteasy.core.interception.AbstractWriterInterceptorContext.writeTo(AbstractWriterInterceptorContext.java:129)
> at org.jboss.resteasy.core.interception.ServerWriterInterceptorContext.writeTo(ServerWriterInterceptorContext.java:62)
> at org.jboss.resteasy.core.interception.AbstractWriterInterceptorContext.proceed(AbstractWriterInterceptorContext.java:118)
> at org.jboss.resteasy.plugins.interceptors.encoding.GZIPEncodingInterceptor.aroundWriteTo(GZIPEncodingInterceptor.java:100)
> at org.jboss.resteasy.core.interception.AbstractWriterInterceptorContext.proceed(AbstractWriterInterceptorContext.java:122)
> at org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:99)
> at org.jboss.resteasy.core.SynchronousDispatcher.writeResponse(SynchronousDispatcher.java:427)
> ... 54 more
> Caused by: javax.xml.bind.MarshalException
> - with linked exception:
> [org.apache.catalina.connector.ClientAbortException: java.net.SocketException: Broken pipe (Write failed)]
> at com.sun.xml.internal.bind.v2.runtime.MarshallerImpl.write(MarshallerImpl.java:313)
> at com.sun.xml.internal.bind.v2.runtime.MarshallerImpl.marshal(MarshallerImpl.java:236)
> at javax.xml.bind.helpers.AbstractMarshallerImpl.marshal(AbstractMarshallerImpl.java:95)
> at org.jboss.resteasy.plugins.providers.jaxb.AbstractJAXBProvider.writeTo(AbstractJAXBProvider.java:124)
> ... 61 more
> Caused by: org.apache.catalina.connector.ClientAbortException: java.net.SocketException: Broken pipe (Write failed)
> at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:410)
> at org.apache.tomcat.util.buf.ByteChunk.flushBuffer(ByteChunk.java:480)
> at org.apache.tomcat.util.buf.ByteChunk.append(ByteChunk.java:366)
> at org.apache.catalina.connector.OutputBuffer.writeBytes(OutputBuffer.java:435)
> at org.apache.catalina.connector.OutputBuffer.write(OutputBuffer.java:423)
> at org.apache.catalina.connector.CoyoteOutputStream.write(CoyoteOutputStream.java:91)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletResponseWrapper$DeferredOutputStream.write(HttpServletResponseWrapper.java:46)
> at org.jboss.resteasy.util.CommitHeaderOutputStream.write(CommitHeaderOutputStream.java:71)
> at com.sun.xml.internal.bind.v2.runtime.output.UTF8XmlOutput.write(UTF8XmlOutput.java:396)
> at com.sun.xml.internal.bind.v2.runtime.output.Encoded.write(Encoded.java:152)
> at com.sun.xml.internal.bind.v2.runtime.output.UTF8XmlOutput.doText(UTF8XmlOutput.java:308)
> at com.sun.xml.internal.bind.v2.runtime.output.UTF8XmlOutput.text(UTF8XmlOutput.java:290)
> at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.leafElement(XMLSerializer.java:313)
> at com.sun.xml.internal.bind.v2.model.impl.RuntimeBuiltinLeafInfoImpl$StringImplImpl.writeLeafElement(RuntimeBuiltinLeafInfoImpl.java:1036)
> at com.sun.xml.internal.bind.v2.model.impl.RuntimeBuiltinLeafInfoImpl$StringImplImpl.writeLeafElement(RuntimeBuiltinLeafInfoImpl.java:1015)
> at com.sun.xml.internal.bind.v2.runtime.reflect.TransducedAccessor$CompositeTransducedAccessorImpl.writeLeafElement(TransducedAccessor.java:239)
> at com.sun.xml.internal.bind.v2.runtime.property.SingleElementLeafProperty.serializeBody(SingleElementLeafProperty.java:115)
> at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeBody(ClassBeanInfoImpl.java:345)
> at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.childAsXsiType(XMLSerializer.java:681)
> at com.sun.xml.internal.bind.v2.runtime.property.ArrayElementNodeProperty.serializeItem(ArrayElementNodeProperty.java:54)
> at com.sun.xml.internal.bind.v2.runtime.property.ArrayElementProperty.serializeListBody(ArrayElementProperty.java:157)
> at com.sun.xml.internal.bind.v2.runtime.property.ArrayERProperty.serializeBody(ArrayERProperty.java:144)
> at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeBody(ClassBeanInfoImpl.java:350)
> at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeBody(ClassBeanInfoImpl.java:336)
> at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.childAsSoleContent(XMLSerializer.java:578)
> at com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl.serializeRoot(ClassBeanInfoImpl.java:326)
> at com.sun.xml.internal.bind.v2.runtime.XMLSerializer.childAsRoot(XMLSerializer.java:479)
> at com.sun.xml.internal.bind.v2.runtime.MarshallerImpl.write(MarshallerImpl.java:308)
> ... 64 more
> Caused by: java.net.SocketException: Broken pipe (Write failed)
> at java.net.SocketOutputStream.socketWrite0(Native Method)
> at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:111)
> at java.net.SocketOutputStream.write(SocketOutputStream.java:155)
> at org.apache.coyote.ajp.AjpProcessor.output(AjpProcessor.java:298)
> at org.apache.coyote.ajp.AbstractAjpProcessor$SocketOutputBuffer.doWrite(AbstractAjpProcessor.java:1275)
> at org.apache.coyote.Response.doWrite(Response.java:499)
> at org.apache.catalina.connector.OutputBuffer.realWriteBytes(OutputBuffer.java:405)
> ... 91 more
5 years, 3 months
Cert issue on master IPA server
by Mitchell Smith
Hi List,
I am running in to an issue joining a new replica to our IPA environment.
It’s worth noting that we have had issues with expired certs on our master server for a while but I thought we had resolved them, and when I connect to ports 443 and 636 on the master server I get certs back expiring in 2020.
So I have run IPA-client-install and the client joins successfully.
I can ‘kinit admin’ and kerberos auth appears to work.
When I run ipa-replica-install it hangs on step 27 restarting directory server.
When I check syslog I see that dirsrv has failed to restart, and the following message.
Jan 8 02:20:11 ds02 certmonger[8516]: 2019-01-08 02:20:11 [8516] Server at https://ds01.prod.xyz.internal/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://ds01.prod.xyz.internal:443/ca/eeca/ca/profileSubmitSSLClient': (SSL_ERROR_EXPIRED_CERT_ALERT) SSL peer rejected your certificate as expired.).
Where ds02 is the new replica I am installing and ds01 is the original master.
Running FreeIPA 4.3.1.
Any suggestions on how to move past this point would be greatly appreciated.
Thanks in advance.
5 years, 3 months
Samba server on Ubuntu not working
by Kees Bakker
Hey,
Is there any chance that the combination FreeIPA + Samba + Ubuntu
is going to work in the near future? So far I haven't been able to.
The main purpose is to give Windows users access to disk space
on our (Ubuntu) servers. And with their IPA credentials.
I know that Alexander knows a whole lot about Samba and FreeIPA.
But not so much about the combination with Ubuntu, I think (except that
Heimdal versus MIT Kerberos plays a role). Timo may know
more about the Ubuntu part, but I don't think he has the whole
setup with FreeIPA+Samba.
In 2016 (yes, that long ago) Alexander wrote [1]
"Let me comment as FreeIPA and Samba upstream developer.
Ubuntu's Samba build is done with Heimdal and you cannot build
ipasam.so against Heimdal, only MIT Kerberos. So you cannot use
Ubuntu-provided Samba build this way even if you'd recompile
FreeIPA with patches we have upstream to deal with
libpdb -> libsamba-pdb library name change.
So until Samba in Debian and Ubuntu is built against Heimdal Kerberos
(this is due to Debian/Ubuntu packaging Samba AD, not just Samba) it
is unlikely to have FreeIPA trust to AD working in Ubuntu. We are fairly
close with completing port of Samba AD to MIT Kerberos upstream, this
should happen in Samba 4.5-4.6 timeframe. Once that is done, we can
expect FreeIPA with trust to AD working on Debian-based platforms as
well."
It's 2019 now.
I've tried Ubuntu 18.04 (with Samba 4.7.6), but I still can't get it to work.
Possibly because MIT KDC is not enabled in Ubuntu's samba [2]. The
following test shows empty.
# smbd -b | grep HAVE_LIBKADM5SRV_MIT
Argh, what are my options?
[1] https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1552249/comments/2
[2] https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC
--
Kees Bakker
5 years, 3 months
How to restrict access by only users of a specific AD group
by Dmitrii M
Hi,
I have a FreeIPA server as server.ipa.linux.dom, domain name is ipa.linux.dom with a configured one-way trust with Windows Server 2016 Active Directory domain as windows.dom. I can log in to linux clients by ssh using AD accounts like ssh aduser@window.dom(a)hostname. It works just fine thanks to the groups created with --external option. kinit <ipauser> and kinit <aduser(a)windows.dom> also work.
Now my next phase is to configure some applications so AD users should be able to authenticate in those apps. And also I need to restrict such access by only users who are members of specific AD groups.
I started doing this for Apache using its mod_ldap module. Below is a config that I am trying to get working.
If I put "Require valid-user" option in the below config it confirms that I can authenticate in Apache using my AD account. Now I need to restrict access to Apache by only the users who are in the apacheusers(a)windows.dom AD group.
This is a current Apache config which I cannot properly set up and I need your help in this.
# https://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html
<Directory /var/www/html/auth-ldap>
Order deny,allow
Allow from All
AuthName "LDAP Authentication"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPUrl ldap://server.ipa.linux.dom/dc=ipa,dc=linux,dc=dom?uid?sub
AuthLDAPBindDN uid=apachebind,cn=users,cn=accounts,dc=ipa,dc=linux,dc=dom
AuthLDAPBindPassword Admin123
AuthLDAPGroupAttributeIsDN off
AuthLDAPGroupAttribute memberUid
Require ldap-group cn=apacheusers_ad(a)windows.dom,cn=groups,cn=compat,dc=ipa,dc=linux,dc=dom
</Directory>
uid=apachebind is a user created in FreeIPA.
cn=apacheusers_ad(a)windows.dom is a group name added to Default Trust View as an overridden AD group apacheusers(a)windows.dom.
The above config is based on the info which I get if I run such ldapsearch command. It tells that I need to check apacheusers_ad(a)windows.dom group to define members of that group.
$ ldapsearch -Y GSSAPI -b 'dc=ipa,dc=linux,dc=dom' "(&(objectClass=posixGroup)(cn=apacheusers_ad(a)windows.dom))"
SASL/GSSAPI authentication started
SASL username: admin(a)IPA.LINUX.DOM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=ipa,dc=linux,dc=dom> with scope subtree
# filter: (&(objectClass=posixGroup)(cn=apacheusers_ad(a)windows.dom))
# requesting: ALL
#
# apacheusers_ad(a)windows.dom, groups, compat, ipa.linux.dom
dn: cn=apacheusers_ad(a)windows.dom,cn=groups,cn=compat,dc=ipa,dc=linux,dc=dom
objectClass: posixGroup
objectClass: ipaOverrideTarget
objectClass: top
gidNumber: 1000111
memberUid: hassudo(a)windows.dom
memberUid: apacheuser(a)windows.dom
memberUid: apachebind(a)windows.dom
memberUid: user2(a)windows.dom
memberUid: user1(a)windows.dom
ipaAnchorUUID:: OlNJRDpTLTEtNS0yMS0xODk0OTg2MDMtMjU5NDAxODQ4OC0xNDAzMzI5NDE1LT
ExMDk=
cn: apacheusers_ad(a)windows.dom
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
I'm trying to log in to Apache as user1(a)windows.dom user
$ id -a
uid=1959401104(user1(a)windows.dom) gid=1959401104(user1(a)windows.dom) groups=1959401104(user1@windows.dom),1000111(apacheusers_ad(a)windows.dom),117000008(apacheusers),1959400513(domain users@windows.dom),1959401105(winusers(a)windows.dom) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
The group 117000008(apacheusers) is a IPA group, AD group added to this as an external member. But I don't understand how to verify in Apache whether user1 a member of it. So I tried two options: ID Views and IDM Group with an external member apacheusers(a)windows.dom but still didn't find how a ldap filter in Apache should look like.
I suppose that I miss something but I don't understand what. Sorry for so long text but I am working on this problem for a few days already and still don't have a proper result. I just need to restrict access to Apache by the users who are members of AD group apacheusers(a)windows.dom.
Here are software versions.
FreeIPA server 7.6.1810 and a client are the same OS version but there are also some plans to connect Ubuntu 14.04 and 16.04 clients.
Server packages versions:
$ rpm -qa | grep -E '^(ipa|sss)'
sssd-krb5-common-1.16.2-13.el7.x86_64
sssd-ldap-1.16.2-13.el7.x86_64
sssd-1.16.2-13.el7.x86_64
ipa-server-trust-ad-4.6.4-10.el7.centos.x86_64
ipa-common-4.6.4-10.el7.centos.noarch
ipa-client-common-4.6.4-10.el7.centos.noarch
sssd-client-1.16.2-13.el7.x86_64
sssd-common-1.16.2-13.el7.x86_64
sssd-common-pac-1.16.2-13.el7.x86_64
sssd-ad-1.16.2-13.el7.x86_64
sssd-krb5-1.16.2-13.el7.x86_64
sssd-proxy-1.16.2-13.el7.x86_64
ipa-server-dns-4.6.4-10.el7.centos.noarch
sssd-ipa-1.16.2-13.el7.x86_64
sssd-dbus-1.16.2-13.el7.x86_64
ipa-client-4.6.4-10.el7.centos.x86_64
ipa-server-4.6.4-10.el7.centos.x86_64
ipa-server-common-4.6.4-10.el7.centos.noarch
Active Directory is run on Windows 2016 server in default configuration.
Also learnt threads in redhat & freeipa mail lists but didn't find a proper solution for me.
I am thankful for any help,
Dmitrii
5 years, 3 months