Due to how our organization is moving, we'll be forced to upgrade our
current IPA installation. In a nutshell, this involves using a
one-way AD trust.
So, with the latest versions of RHEL and IPA offered on our Satellite
server, I was able to get an installation up and running and AD trust
established; because of the work of all of the IPA developers, this
was quite easy - THANK YOU.
I've noticed that there seems to be a major delay in how often an
external user's group membership is updated. In fact, it seems that I
have to run sss_cache -u against the external user in order to verify
additions/removals from the group in question.
Since I'm still in a testing phase, I am performing the queries on the
only two provisioned nodes in the new realm, the IPA servers
themselves. Has any other user with the same configuration run into
this issue, too? If so, anything to double-check?
I'm certain that this is an sss configuration issue, but after
searching through google and this mailing list, I can't seem to find
any real "solution".
this is my first post and probably not my last.
Can anyone tell me where to find a script to import hosts from a text file?
I already found this thread: https://www.redhat.com/archives/freeipa-users/2014-May/msg00158.html
The export script works, but I'm lost with the import script.
Any help would be appreciated.
With kind regards,
I was wondering if anyone here knew of a basic password reset page for
It must have:
* No hostname restriction, i.e. if the IPA domain is dev.example.net the
reset page should be able to be viewed from password.example.com
* Easily edited/styled, i.e. to remove any references to OTP, and to use
our own terms/language/styles.
Nice to have:
* No use of Kerberos. (same as the no hostname restriction)
I've tried using a couple of different pages found on github but haven't
found one that really fits all our requirements.
I am confused by some of the conflicting documentation about whether this is possible or not. Almost all of the documentation/working examples seem to use an actual Windows Domain Controller. Specifically the part on DNS , as the Samba4 internal DNS server has several know limitations.
>The internal DNS does not support:
>Conditional forwarders are not implemented yet
I THINK I got DNS actually working , but had to use solution like here
Although Petr says to stay away from forwarders in IPA
Is it better to attempt AD as subdomain of IPA (which I'm currently doing) , or IPA as subdomain of AD ?
On both samba4 and freeipa machine I can currently dig SRV records for both domains , but when I attempt ipa add-trust, I see in httpd error logs
>[Fri Aug 10 11:58:43.122526 2018] [:error] [pid 6169] ipa: ERROR: Attempt to solve forest trust topology conflicts
>[Fri Aug 10 11:58:43.125865 2018] [:error] [pid 6169] ipa: ERROR: non-public: NTSTATUSError: (-1073741601, 'The specified domain did not exist.')
Which leads me to believe that no, DNS is not working correctly ( I have all firewall/iptables off and selinux off).
I can give more concrete/examples , but before get lost in the weeds wanted to know on broad consensus is it even possible or known bad issues with Samba AD ?
Like here https://www.freeipa.org/page/IPAv3_AD_trust#Samba , it says
>In order to get properly working MIT krb5-based Samba4 build one have to use --without-ad-dc --with-system-mitkrb5 options when configuring WAF top level build.
Which I'm confused ... how to get I get AD trust, if I'm setting up samba without AD abilities??
Yet here https://www.freeipa.org/page/Windows_authentication_against_FreeIPA
a. If you have an AD ( Microsoft ) , use it
b. If you don't have a Microsoft AD , setup Samba4
>but it can be configured to trust FreeIPA
Does anyone know of a complete A..Z example of how to do that? (what options were used to configure Samba and Freeipa, etc)