Re: krbpasswordexpiration field gone from "ipa user-show" ?
by Igor Stets
We use ipa-server-4.6.4-10.el7.centos.6.x86_64
and update expiration check script:
# userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep
krbpasswordexpiration | awk '{print $2}' | cut -c 1-14)
userpw_expiry_datetime=$(/usr/bin/ipa user-show ${user} --all | grep -i
"password expiration:" | awk '{print $4}' | cut -c 1-14)
This is work for me.
Regards. Igor S.
1 year, 2 months
How to allow users to manage their own certs
by Michael Plemmons
We have a need where we want to allow a user to submit their own CSR to
generate their own SSL certificate and to be able to download their own
certificate.
I get the following error:
Insufficient access: Principal 'testplem(a)MGMT.EXAMPLE.COM' is not permitted
to use CA 'ipa' with profile 'IECUserRoles' for certificate issuance.
Here are the permissions I have setup.
* Create a new Privilege called SelfService
* Add the following permissions to the SelfService Privilege
* Request Certificate (FreeIPA builtin permission)
* Retrieve Certificates from the CA (FreeIPA builtin permission)
* UserSelfSerivceCertificate (custom permission)
* ReadCAProfile (custom permission)
* ReadIPACA (custom permission)
* Create Role called SelfService
* Attach the SelfService Privilege to this Role
* I then attach that Role to a test user.
I am sure I am missing other permissions but I am not sure what. If there
is already documentation that explains how to do this I am happy to
reference that. If not, what else am I missing.
============
dn:
cn=UserSelfSerivceCertificate,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com
member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com
ipaPermRight: read
ipaPermRight: search
ipaPermRight: compare
ipaPermRight: write
ipaPermRight: add
ipaPermTargetFilter: (objectclass=posixaccount)
ipaPermBindRuleType: permission
ipaPermissionType: SYSTEM
ipaPermissionType: V2
cn: UserSelfSerivceCertificate
objectClass: top
objectClass: groupofnames
objectClass: ipapermission
objectClass: ipapermissionv2
ipaPermLocation: cn=users,cn=accounts,dc=mgmt,dc=example,dc=com
ipaPermIncludedAttr: usercertificate
============
dn: cn=ReadCAProfile,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com
member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com
ipaPermBindRuleType: permission
ipaPermTarget:
cn=IECUserRoles,cn=certprofiles,cn=ca,dc=mgmt,dc=example,dc=co
m
ipaPermRight: read
ipaPermRight: search
ipaPermTargetFilter: (objectclass=ipacertprofile)
ipaPermissionType: SYSTEM
ipaPermissionType: V2
cn: ReadCAProfile
objectClass: top
objectClass: groupofnames
objectClass: ipapermission
objectClass: ipapermissionv2
ipaPermLocation: cn=certprofiles,cn=ca,dc=mgmt,dc=example,dc=com
ipaPermIncludedAttr: cn
ipaPermIncludedAttr: description
ipaPermIncludedAttr: ipacertprofilestoreissued
ipaPermIncludedAttr: objectclass
============
dn: cn=ReadIPACA,cn=permissions,cn=pbac,dc=mgmt,dc=example,dc=com
member: cn=SelfService,cn=privileges,cn=pbac,dc=mgmt,dc=example,dc=com
ipaPermTarget: cn=ipa,cn=cas,cn=ca,dc=mgmt,dc=example,dc=com
ipaPermRight: read
ipaPermRight: search
ipaPermRight: compare
ipaPermTargetFilter: (objectclass=ipaca)
ipaPermBindRuleType: permission
ipaPermissionType: SYSTEM
ipaPermissionType: V2
cn: ReadIPACA
objectClass: top
objectClass: groupofnames
objectClass: ipapermission
objectClass: ipapermissionv2
ipaPermLocation: cn=cas,cn=ca,dc=mgmt,dc=example,dc=com
ipaPermIncludedAttr: cn
ipaPermIncludedAttr: description
ipaPermIncludedAttr: ipacaid
ipaPermIncludedAttr: ipacaissuerdn
ipaPermIncludedAttr: ipacasubjectdn
ipaPermIncludedAttr: objectclass
Thank you for any insight you are able to provide.
--
*Mike Plemmons *
Senior Infrastructure Engineer
614-427-2411
<https://oliveai.com/>
99 E. Main Street
Columbus, OH 43215
oliveai.com
Meet Olive, Your Newest Employee <https://youtu.be/9Vf84z9KA6Y>
1 year, 2 months
IPA server rebooted after freeze, now services can't authenticate with ldap
by Kristian Petersen
My primary IPA server has failed. I was running a python script against
IPA doing some user management when everything when unresponsive. I
couldn't even get in at a console to check what was going on. I ended up
rebooting it. After doing so, dirsrv wouldn't start because dse.ldif was
missing. I have copied this file over from a replica IPA server, so dirsrv
starts now. However, it seems that other services are unable to connect to
LDAP properly. DNS isn't resolving when querying the primary even though
ipactl shows named is running. smb and winbind won't start and it appears
to be a problem with connecting to LDAP. Is there a way to check the
integrity of my LDAP database? Or should I try to copy the LDAP database
form my working replica to the primary?
--
Kristian Petersen
System Administrator
BYU Dept. of Chemistry and Biochemistry
1 year, 2 months