Fwd: [389-users] How to invalidate local cache after user changed their password
by Mark Reynolds
Forwarding to freeipa-users who have more knowledge on SSSD
-------- Forwarded Message --------
Subject: [389-users] How to invalidate local cache after user changed
their password
Date: Wed, 27 Feb 2019 19:22:19 +0000 (UTC)
From: xinhuan zheng <xhzheng2001(a)yahoo.com>
Reply-To: General discussion list for the 389 Directory server project.
<389-users(a)lists.fedoraproject.org>
To: 389-users(a)lists.fedoraproject.org
Hello,
I have been struggling with this problem for a while. When a user
changed their password, our 389 directory servers received new password
and saved into directory server. However, when user tries to login to a
server whose authentication is using 389 directory server, their new
password won't work for the first few minutes. There is a local cache
process, sssd, running on the server the user tries to login. Apparently
sssd is still using old password information, and does not know password
has changed on directory servers. I have set sssd to keep cache
information for 5 minutes only, and do pre-fetch prior to cache
information expiring. But I don't know how to tell sssd to ignore cache
completely when information has changed on 389 directory server side.
Is there a way to completely disable sssd local cache, and only use it
when 389 directory servers are not available?
Thank you,
- Xinhuan
5 years, 1 month
Ca signed very for non-IPA client
by Bret Wortman
> We have some ESXi boxes that need CA-signed certs and we're trying to figure out how to properly construct a CSR so that our IPA CA will process it.
>
> I'm having them create the cert using these commands:
>
> # certutil -R -d $PATH_TO_DB -a -g 2048 -s "CN=${FQDN},O=MY.NET" -i ${SHORTHOSTNAME},${FQDN}
>
> and when I take the resulting file and try to sign it in the GUI, I get a 903 error. When I try from the command-line, I get prompted for the principal, which might be the problem since I'm not sure what it would be:
>
> # ipa cert-request my.csr
> Principal:
>
> Has anyone done this, or is it never going to work since the target system isn't actually an IPA client?
>
> Bret Wortman
> Founder, Damascus Products, LLC
> 855-644-2783 | bret(a)wrapbuddies.co
> http://wrapbuddies.co/
> 70 Main St. Suite 23 Warrenton, VA 20186
Bret Wortman
Founder, Damascus Products, LLC
855-644-2783 | bret(a)wrapbuddies.co
http://wrapbuddies.co/
70 Main St. Suite 23 Warrenton, VA 20186
5 years, 1 month
OTP via LDAP auth time sync
by Callum Smith
Dear All,
I'm seeing issues with the time synchronisation for OTP but ONLY for authentication through LDAP and not through kerberos. Is this even possible or am I going down the wrong rabbit hole on this issue. The error presents as LDAP authentication giving "ldap operation failed" when authentication to HashiCorp Vault, configured to auth against IPA over LDAP, if the token is slightly old.
Regards,
Callum
--
Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>
5 years, 1 month
Two distinct IPA server clusters:
by TomK
Hey All,
Given that I have two separate IPA clusters on the same subnet but two
different domains, is there any chance that the IPA servers can issue
identical UID / GID numbers thereby causing conflicts on the setup?
When setting up the IPA servers, is there a change the same ID range can
be given to each separate IPA cluster?
The two IPA clusters are independent of each other (not replicas of each
other) and are only authoritative for their two separate domains.
Example ID ranges of off the primaries of the two clusters:
Cluster A [ ipa01 / 02 ]
# ipa idrange-find
----------------
2 ranges matched
----------------
Range name: ABC.123_id_range
First Posix ID of the range: 155600000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 155600000
Domain SID of the trusted domain:
S-1-5-21-1803828911-4163023034-2461700517
Range type: Active Directory domain range
Range name: A.ABC.123_id_range
First Posix ID of the range: 1746600000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range type: local domain range
----------------------------
Number of entries returned 2
----------------------------
#
Cluster B [ ipa03 / 04 ]
# ipa idrange-find
----------------
2 ranges matched
----------------
Range name: ABC.123_id_range
First Posix ID of the range: 155600000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 0
Domain SID of the trusted domain:
S-1-5-21-1803828911-4163023034-2461700517
Range type: Active Directory domain range
Range name: B.ABC.123_id_range
First Posix ID of the range: 1163400000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range type: local domain range
----------------------------
Number of entries returned 2
----------------------------
#
--
Cheers,
Tom K.
-------------------------------------------------------------------------------------
Living on earth is expensive, but it includes a free trip around the sun.
5 years, 1 month
Re: Issues with AD user ssh
by Sumit Bose
(second try without the logs)
On Fri, Feb 15, 2019 at 09:26:08PM +0100, Sumit Bose wrote:
> On Fri, Feb 15, 2019 at 07:24:10PM +0000, D wrote:
> > I have increased krb5_auth_timeout to 30 and raised debug to level 9, Logs attached.
> >
> > The krb5_child_timeout has gone away, so we might be one step closer to finding the issue now.
> >
> > Eager to hear your thoughts on the logs.
Now timeouts occur when trying to connect to LDAP servers, see lines 81
and 139 in the log file. The name and the IP address can be found a few
line before. Is it expected that AD DCs respond very slowly or are there
some firewall between the IPA server and the AD DCs? In the former case
you can try to increase ldap_search_timeout, default is 6s as well.
bye,
Sumit
> >
> > Thanks,
> > D
> >
> > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > On Friday, 15 February 2019 13:23, Sumit Bose via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote:
> >
> > > On Fri, Feb 15, 2019 at 04:22:33PM +0000, D wrote:
> > >
> > > > Apologies, forgot to attach.
> > > > D
> > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > > > On Friday, February 15, 2019 11:19 AM, D via FreeIPA-users freeipa-users(a)lists.fedorahosted.org wrote:
> > > >
> > > > > New logs are attached. They are from attempts to ssh into the IPA server as one of the AD users.
> > > > > I think this is the problem now, but the full logs are attached in case I'm mistaken.
> > > > > ==> /var/log/sssd/sssd_ipa.splat.acme.com.log <==
> > > > > (Fri Feb 15 15:57:06 2019) [sssd[be[ipa.splat.acme.com]]] [krb5_child_timeout] (0x0040): Timeout for child [11388] reached. In case KDC is distant or network is slow you may consider increasing value of krb5_auth_timeout.
> > >
> > > Ok, the timeout is happening already during pre-auth setting the backend
> > > into offline-mode. Maybe the keyring error is related to the offline
> > > mode, although I do not see it in my setup when offline.
> > >
> > > Have you tried the suggestion from the debug message and increased
> > > krb5_auth_timeout in the [domain/....] section of sssd.conf? The default
> > > is 6 (seconds), I would suggest to try 30 for a start. And please set
> > > debug_level=9 in the [domain/...] section as well. I extra output might
> > > help to identify where the delay is coming from.
> > >
> > > bye,
> > > Sumit
> > >
> > > > > (Fri Feb 15 15:57:06 2019) [sssd[be[ipa.splat.acme.com]]] [krb5_auth_done] (0x0020): child timed out!
> > > > > Happy Friday :-)
> > > > > D
> > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > > > > On Thursday, February 14, 2019 4:34 AM, Sumit Bose via FreeIPA-users freeipa-users(a)lists.fedorahosted.org wrote:
> > > > >
> > > > > > On Wed, Feb 13, 2019 at 08:18:10PM +0000, D wrote:
> > > > > >
> > > > > > > Update on this.
> > > > > > > The strange ldb record being returned was due to the user being added to the external AD connector group as an external group. Removing that and cleaning caches has fixed the problem.
> > > > > > > The larger issue with SSHD not working on a fresh install is not resolved, Sumit would you prefer a new thread or to continue here?
> > > > > >
> > > > > > We can continue here.
> > > > > > The logs you have send only contains the SSS_PAM_PREAUTH step, I guess
> > > > > > the error happens during SSS_PAM_AUTHENTICATE. Can you also increase the
> > > > > > debug_level in the [domain/...] section to 9 and restart SSSD before
> > > > > > running the test? I do not need all the logs, krb5_child.log would be
> > > > > > sufficient for a start.
> > > > > > bye,
> > > > > > Sumit
> > > > > >
> > > > > > > Thanks again for everything,
> > > > > > > D
> > > > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > > > > > > On Wednesday, 13 February 2019 11:03, D via FreeIPA-users freeipa-users(a)lists.fedorahosted.org wrote:
> > > > > > >
> > > > > > > > Apologies for the delay Sumit.
> > > > > > > > I've attached full sanitized logs this time. This should answer a few of the questions you asked.
> > > > > > > >
> > > > > > > > > is there a line before '[-1750600185][Invalid UID in persistent keyring
> > > > > > > > > name]' error where krb5_child tries to switch to this UID or is it
> > > > > > > > > always running as root?
> > > > > > > >
> > > > > > > > I don't see a line involving a switch from that UID - the results when running ssh user\@ad.domain.com(a)client as root vs.user(a)ad.domain.com seem to be the same.
> > > > > > > >
> > > > > > > > > > One of the (ldbsearch records returned) appears to be a user, and the other, incorrect one, is a group record. Cleaning cache and deleting database files does not seem to fix this.
> > > > > > > > >
> > > > > > > > > Does the group record share some properties of the user record like same
> > > > > > > > > name or GID==UID?
> > > > > > > >
> > > > > > > > Yes it does, GID is the same.
> > > > > > > >
> > > > > > > > > Besides trying to figure out what is wrong with the KEYRING ccache you
> > > > > > > > > might also want to try if a different ccache type, e.g. FILE:....,
> > > > > > > > > works any better?
> > > > > > > >
> > > > > > > > I can switch this in the kerberos config on the client right, sure
> > > > > > > > D
> > > > > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > > > > > > > On Tuesday, February 12, 2019 4:00 PM, Sumit Bose via FreeIPA-users freeipa-users(a)lists.fedorahosted.org wrote:
> > > > > > > >
> > > > > > > > > On Tue, Feb 12, 2019 at 08:37:44PM +0000, D wrote:
> > > > > > > > >
> > > > > > > > > > Sumit,
> > > > > > > > > > The ldbsearch on the ipa client revealed two records with the SID in question, and the krb5 ccname is [KEYRING:persistent:$posix_uid_attribute] which matches the default ccname format in krb5.conf.
> > > > > > > > >
> > > > > > > > > And is $posix_uid_attribute the same UID as the one from the log message
> > > > > > > > > two lines above:
> > > > > > > > > [unpack_buffer] (0x0100): cmd [...] uid [...] gid [...] validate ...
> > > > > > > > > Later on in the logs there should be
> > > > > > > > > [become_user] (0x0200): Trying to become user ...
> > > > > > > > > (0x2000): Running as ....
> > > > > > > > > is there a line before '[-1750600185][Invalid UID in persistent keyring
> > > > > > > > > name]' error where krb5_child tries to switch to this UID or is it
> > > > > > > > > always running as root?
> > > > > > > > >
> > > > > > > > > > One of them appears to be a user, and the other, incorrect one, is a group record. Cleaning cache and deleting database files does not seem to fix this.
> > > > > > > > >
> > > > > > > > > Does the group record share some properties of the user record like same
> > > > > > > > > name or GID==UID?
> > > > > > > > >
> > > > > > > > > > The ldbsearch command on the ipa server returns only the user record.
> > > > > > > > > > Do you have any idea where this odd group record might be coming from?
> > > > > > > > >
> > > > > > > > > It would be best to have full logs to understand what is happening.
> > > > > > > > > But since you say that the group memberships of the user are looking
> > > > > > > > > correct I guess this is not the primary issue why the login failed.
> > > > > > > > > Besides trying to figure out what is wrong with the KEYRING ccache you
> > > > > > > > > might also want to try if a different ccache type, e.g. FILE:....,
> > > > > > > > > works any better?
> > > > > > > > > HTH
> > > > > > > > > bye,
> > > > > > > > > Sumit
> > > > > > > > >
> > > > > > > > > > Thank you for your hard work,
> > > > > > > > > > D
> > > > > > > > > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > > > > > > > > > On Tuesday, 12 February 2019 02:19, Sumit Bose via FreeIPA-users freeipa-users(a)lists.fedorahosted.org wrote:
> > > > > > > > > >
> > > > > > > > > > > On Mon, Feb 11, 2019 at 03:51:07PM +0000, D via FreeIPA-users wrote:
> > > > > > > > > > >
> > > > > > > > > > > > Hello,
> > > > > > > > > > > > Would anyone mind helping me troubleshoot a problem?
> > > > > > > > > > > >
> > > > > > > > > > > > 1. Running a two-way trust between AD2016 and ipa-server 4.5.4-10.el7.
> > > > > > > > > > > > 2. Unable to log into an IPA client with an AD account via ssh. The client has no trouble with “kinit $ad_user” and “getent passwd $ad_user”.
> > > > > > > > > > > > 3. The AD user appears to properly exist in the correct groups for IPA/ad internal/external mapping as described in the docs.
> > > > > > > > > > > >
> > > > > > > > > > > > I think the problem occurs here, with the PAC fetch:
> > > > > > > > > > > > ==> /var/log/sssd/sssd_pac.log <==
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [sssd[pac]] [sysdb_search_object_attr] (0x0020): Search with filter [(&(|(objectCategory=user)(objectCategory=group))(objectSIDString= < MY SID HERE >))] returned more than one object.
> > > > > > > > > > >
> > > > > > > > > > > SIDs should be unique and it looks that currently in SSSD's cache are
> > > > > > > > > > > more than one object with the given SID. You can check the results
> > > > > > > > > > > yourself by calling:
> > > > > > > > > > > ldbsearch -H /var/lib/sss/db/cache_DOMAIN.NAME.ldb '(&(|(objectCategory=user)(objectCategory=group))(objectSIDString= < MY SID HERE >))'
> > > > > > > > > > > (ldbsearch is in the ldb-tools package). Maybe this already explains
> > > > > > > > > > > what has happened but feel free to send the (sanitized) output.
> > > > > > > > > > >
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [sssd[pac]] [sysdb_search_object_attr] (0x0040): Error: 22 (Invalid argument)
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [sssd[pac]] [cache_req_search_cache] (0x0020): CR #5: Unable to lookup [<MY SID>@ad.domain.com] in cache [22]: Invalid argument
> > > > > > > > > > > > ==> /var/log/sssd/krb5_child.log-20190210 <==
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [sss_send_pac] (0x0040): sss_pac_make_request failed [-1][22].
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [validate_tgt] (0x0040): sss_send_pac failed, group membership for user with principal [<my username>@AD.DOMAIN.COM] might not be correct.
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [create_ccache] (0x0020): 973: [-1750600185][Invalid UID in persistent keyring name]
> > > > > > > > > > > > (Mon Feb 11 05:24:36 2019) [[sssd[krb5_child[26961]]]] [map_krb5_error] (0x0020): 1657: [-1750600185][Invalid UID in persistent keyring name]
> > > > > > > > > > >
> > > > > > > > > > > That's odd. At the start of the log messages for 'krb5_child[26961]'
> > > > > > > > > > > there should be a line like:
> > > > > > > > > > > [unpack_buffer] (0x0100): ccname: [KEYRING:persistent:.....
> > > > > > > > > > > Can you send the full line which the complete name of the ccache?
> > > > > > > > > > > bye,
> > > > > > > > > > > Sumit
5 years, 1 month
Search for sertificates
by Andrey Bondarenko
Hello,
Are there any possibilities to fetch certificates from the IPA that are (1)
valid, (2) will expire in 20 (for example) days?
ipa cert-find --validnotafter-to=`date -d "+20 days" "+%Y-%m-%d"
shows revoked serts, unfortunately. May be some ldapsearch?
--
With best regards,
Andrey Bondarenkomail:me@andreybondarenko.comhttps://andreybondarenko.com
skype:andrey.bondarenko
phone, Telegram, WhatsApp, etc:+420-773-591-443
7758 40AC 88CC 96C9 0C9A 9EE4 3B72 547B 7538 D41B
5 years, 1 month
Recreating a VM with same host name and re-registering it with FreeIPA
by TomK
Hey All,
Getting a scenario where the hostname doesn't resolve to the new IP if
the VM is recreated multiple times against an IPA server.
I've tried clearing the caches on the clients but no luck. I have to
allow a specific amount of time to pass before I can use the DNS name
that now points to a different (new) IP that was assigned via DHCP.
This apparently also impacts the automounter and it won't work until
much later either. I won't be able to use the NFS mount configured
until then. On initial login users need to wait about 5 minutes before
they can login with home folder set to / instead as a result:
Using username "abc.123\sam".
Using keyboard-interactive authentication.
Password:
Creating home directory for abc.123\sam.
Last login: Wed Feb 20 02:39:18 2019 from 192.168.0.76
Could not chdir to home directory /n/abc.123/sam: No such file or directory
-sh-4.2$
Has anyone seen this scenario before and have a general high level idea
where I could start to poke? Seems to me like a DNS Cache Refresh or
Timeout but not sure about the specifics.
/n/abc.123/sam exists and mount works off of other hosts that have been
around for a while.
--
Cheers,
Tom K.
-------------------------------------------------------------------------------------
Living on earth is expensive, but it includes a free trip around the sun.
5 years, 1 month
how to deal with an existing user before client installation
by Albert Szostkiewicz
Hi,
So I do have an user on my laptop with same username as IPA user. I've noticed that after installing client, this existing user is still being authenticated by it's original password and is with its original UID.
What is the best procedure in such cases? Should I remove existing users and just keep root before installation ? is there a way to sync existing users towards ipa users?
Cheers!
5 years, 1 month
ipa-restore with different IP address?
by Kat
Does anyone know of a way to apply an ipa-restore if you keep the same
hostname, but because the network changed, the host has a different IP
address? IP is outside of my control. It seems everything works except
named (of course) and pki-tomcat which don't want to start correctly. I
just can't find a way to change the base IP?
I wonder if it would work with a --data restore instead of the default
full restore?
Thoughts?
k
5 years, 1 month
replica failing install - denieD
by Kat
Hi all -
Trying to add a new replica and client install is fine, but replica
install goes all along until it hits:
Configuring ipa-custodia
[1/4]: Generating ipa-custodia config file
[2/4]: Generating ipa-custodia keys
[3/4]: starting ipa-custodia
[4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR 406 Client Error: Failed to validate
message: No recipient matched the provided key["Failed:
[ValueError('Decryption failed.',)]"]
ipapython.admintool: ERROR The ipa-replica-install command failed.
See /var/log/ipareplica-install.log for more information
If I check in the custodia-log on the master it is replicating from I see:
2019-02-21 17:59:25 - SimpleCredsAuth-[auth:simple] - PASS: '22565'
authenticated as '48, 48'
2019-02-21 17:59:25 - SimpleHeaderAuth-[auth:header] - PASS: '22565'
authenticated as '(null)'
2019-02-21 17:59:25 - IPAKEMKeys-[authz:kemkeys] - PASS: '22565'
authorized for '/keys'
2019-02-21 17:59:25 - Secrets-[/keys] - DENIED:
'(null)' requested key 'ca/caSigningCert cert-pki-ca'
Any thoughts?
thanks
K
5 years, 1 month