Re: new servers not creating DNS entries
by Gotham
Hi,
Can anyone throw some light on this, I m also stuck here for past few
days with the same error, tried reinstalling client,rebuilding the VM
again, adding manual dns entry....nothing seems to work.
Thanks for your help,
Gotham
5 years
migrate-ds doesn't migrate roles?
by Mitchell Smith
Hi,
I am migrating users off an old 4.3.1 FreeIPA cluster to a new 4.6.4 FreeIPA cluster via the ‘ipa migrate-ds’ command.
ipa migrate-ds --bind-dn="cn=Directory Manager" --user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup --user-ignore-attribute={krbPrincipalName,krbextradata,krblastfailedauth,krblastpwdchange,krblastsuccessfulauth,krbloginfailedcount,krbpasswordexpiration,krbticketflags,krbpwdpolicyreference,mepManagedEntry} --user-ignore-objectclass=mepOriginEntry --with-compat ldap://172.16.1.156
First issue I ran in to is that it didn’t retain the nsAccountLock flag for users so all my disabled users were enabled again, that was an easy fix.
Second issue I ran in to is that roles were not migrated and applied to users, I could manually create the roles and apply them to users, but I am wondering why these weren’t migrated by migrate-ds?
It is my understanding that this is the intended usage of migrate-ds, to migrate from one FreeIPA to another, dropping important objects like roles seems fairly critical?
Your feedback and suggestions would be greatly appreciated.
Thanks
5 years, 1 month
AD trust and external group memberships, sssd issue?
by John Desantis
Hello all!
Due to how our organization is moving, we'll be forced to upgrade our
current IPA installation. In a nutshell, this involves using a
one-way AD trust.
So, with the latest versions of RHEL and IPA offered on our Satellite
server, I was able to get an installation up and running and AD trust
established; because of the work of all of the IPA developers, this
was quite easy - THANK YOU.
I've noticed that there seems to be a major delay in how often an
external user's group membership is updated. In fact, it seems that I
have to run sss_cache -u against the external user in order to verify
additions/removals from the group in question.
Since I'm still in a testing phase, I am performing the queries on the
only two provisioned nodes in the new realm, the IPA servers
themselves. Has any other user with the same configuration run into
this issue, too? If so, anything to double-check?
I'm certain that this is an sss configuration issue, but after
searching through google and this mailing list, I can't seem to find
any real "solution".
Thanks,
John DeSantis
5 years, 1 month
basic password reset page?
by Anthony Jarvis-Clark
Hello Everyone,
I was wondering if anyone here knew of a basic password reset page for
FreeIPA?
It must have:
* No hostname restriction, i.e. if the IPA domain is dev.example.net the
reset page should be able to be viewed from password.example.com
* Easily edited/styled, i.e. to remove any references to OTP, and to use
our own terms/language/styles.
Nice to have:
* No use of Kerberos. (same as the no hostname restriction)
I've tried using a couple of different pages found on github but haven't
found one that really fits all our requirements.
Thank you,
Anthony Clark
5 years, 1 month
FreeIPA AD Trust with Samba4 ... is it possible?
by D Anderson
Hello all,
I am confused by some of the conflicting documentation about whether this is possible or not. Almost all of the documentation/working examples seem to use an actual Windows Domain Controller. Specifically the part on DNS , as the Samba4 internal DNS server has several know limitations.
https://wiki.samba.org/index.php/Samba_Internal_DNS_Back_End#Limitations|
>The internal DNS does not support:
>zone transfers
https://wiki.samba.org/index.php/DNS_Administration#Administering_DNS_on_...
>Conditional forwarders are not implemented yet
I THINK I got DNS actually working , but had to use solution like here
https://www.redhat.com/archives/freeipa-users/2012-October/msg00194.html
Although Petr says to stay away from forwarders in IPA
Is it better to attempt AD as subdomain of IPA (which I'm currently doing) , or IPA as subdomain of AD ?
On both samba4 and freeipa machine I can currently dig SRV records for both domains , but when I attempt ipa add-trust, I see in httpd error logs
>[Fri Aug 10 11:58:43.122526 2018] [:error] [pid 6169] ipa: ERROR: Attempt to solve forest trust topology conflicts
>[Fri Aug 10 11:58:43.125865 2018] [:error] [pid 6169] ipa: ERROR: non-public: NTSTATUSError: (-1073741601, 'The specified domain did not exist.')
Which leads me to believe that no, DNS is not working correctly ( I have all firewall/iptables off and selinux off).
I can give more concrete/examples , but before get lost in the weeds wanted to know on broad consensus is it even possible or known bad issues with Samba AD ?
Like here https://www.freeipa.org/page/IPAv3_AD_trust#Samba , it says
>In order to get properly working MIT krb5-based Samba4 build one have to use --without-ad-dc --with-system-mitkrb5 options when configuring WAF top level build.
Which I'm confused ... how to get I get AD trust, if I'm setting up samba without AD abilities??
Yet here https://www.freeipa.org/page/Windows_authentication_against_FreeIPA
It recommends
a. If you have an AD ( Microsoft ) , use it
b. If you don't have a Microsoft AD , setup Samba4
>but it can be configured to trust FreeIPA
Does anyone know of a complete A..Z example of how to do that? (what options were used to configure Samba and Freeipa, etc)
Thanks
5 years, 1 month