By coincidence I found something in /var/log/messages that does not look
Oct 2 09:41:30 pipa02.linux.mydomain.at ns-slapd:
[02/Oct/2020:09:41:30.887447735 +0200] - ERR - NSMMReplicationPlugin -
Data required to update replica has been purged from the changelog. If
the error persists the replica must be reinitialized.
The error seems to persist. What has do be done? Do i have to uninstall
ipa replica and do an ipa-replica-install agein?
So, I have been working on creating certificates for services on a solid installation of FreeIPA on a machine we have.
I did everything that this blog stated to do...
But now when I enter the command, sudo ipa-getcert list.
The status is CA_UNCONFIGURED, ca-error is "Error setting up ccache for "host" service on client using default keytab: Preauthentication failed.", stuck is yes.
I checked the krb5.keytab it's set to -rw------- and root:root.
I'm not sure what else I can do to address the problem. Any help would be appreciated.
I swear I have been reading and trying everything I can find on here and elsewhere today and I'm still having problems fixing my certs.
As appears to be a common problem, certmonger didn't auto-renew any of them.
IPA v4.6.9 running on Ubuntu 18.04; only the one server
IPA RA is fine
ldap and krbtgt are "CA UNREACHABLE": Server at https://ipa01.simplyws.com/ipa/xml failed request, will retry: 903 (RPC failed at server. an internal error has occurred).
Everything else is NEED_CSR_GEN_PIN including HTTP
Possibly ipa-cert-fix or pki-server cert-fix would take care of it, but they aren't in this version and I'm reluctant to upgrade the distro without proper preparation.
Everything starts without any problems. With the date set, everything is functioning like normal as far as I can tell.
I have rolled back the date successfully making sure to respect the 'notbefore' on ra-agent.pem
I've tried both manually: getcert resubmit -i xxx and restarting certmonger to no avail...
cn=ipa,cn=cas,cn=ca,$BASEDN and ou=authorities,ou=ca,o=ipaca appear to be fine.
Everything in /var/log/pki/pki-tomcat/ca/debug is FINE
There are some errors about missing .jar files in /var/log/pki/pki-tomcat/pki/debug
/var/log/ipa and /var/log/dirsrv don't seem to have anything of note.
Any thoughts would be greatly appreciated!
I've got a simple FreeIPA topology with a 1-way trust to a nice
uncomplicated Active Directory environment. Unlike my other projects
there is no complex AD forest or topology to navigate; just a single
Because of this we have short usernames working for login just fine;
works great. Instead of "chris(a)domain.com" I can login as "chris"
However I was asked if it was possible to also use short aka "not fully
qualified" names when looking at local 'id', user and group info
Basically the question was if it was possible to use short names for
everything including id views, getent output and group output
This is where my knowledge hits a wall -- I think this level of username
and group handling is fed into NSS via IPA? If so is there a way to
alter FreeIPA to use unqualified names -- presumably via altering or
creating a new Trust View and applying it to the hosts? Not really sure
if this is sensible or even advisable but I've been asked to research
Here is an example:
## Short login works fine! my AD username is "dagdigian(a)example.com" ...
$ ssh dagdigian(a)172.17.0.57 <mailto:firstname.lastname@example.org>
Last login: Thu Oct 22 22:37:32 2020 from 10.10.210.63
## But user are asking about the OS view of usernames and groups:
## Is there a way to use non fully qualified names in these sorts of
views, possibly via new Trust Views on the IPA server side?
## Is this even reasonable to consider doing?
<mailto:email@example.com@ansible-testhost-01> ~]$ id
Our IPA servers are in a one-way AD trust. Since all of our users are in
AD, I take advantage of the SSSD settings on the clients to hide the
@AD_REALM from their login names, and use AD_REALM as the default_realm.
This works nicely.
Solaris clients, however, do not have the convenience of SSSD. I
understand that the fully-qualified login names are required for systems
using the compat feature so that the IPA servers know to lookup those users
in AD. Still, I was wondering if there is anyway of doing something
similar on Solaris to hide the domain part if it is the default. I had
hoped that maybe an idview would do it, but seems unlikely.
My use case on AWS involves ephemeral or auto-scaling servers that do
not live long enough to justify a formal IPA enroll/un-enroll process.
We have a great AD-integrated IPA system running at the moment and I've
been able to configure a light test client that trusts the IPA CA
certificate and will become an LDAPS client of the FreeIPA server
This works great for local IPA users but I'm trying to think this
through and I'm not sure if I can use LDAP to authenticate an AD user?
Is this even possible?
This is my working sssd.conf for a test client that just uses LDAP --
works great for resolving users and groups that are local IPA users but
so far I can't resolve any of the AD resident users:
autofs_provider = ldap
cache_credentials = True
ldap_search_base = cn=users,cn=accounts,dc=ipa,dc=example,dc=com
ldap_group_search_base = cn=groups,cn=accounts,dc=ipa,dc=example,dc=com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ipa001.ipa.example.com/
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/pki/tls/
default_shell = /bin/bash
override_shell = /bin/bash
Is there any method using ldap_search_base or an override of the Default
Trust View that would allow me to deploy a client that only talks LDAP
to FreeIPA but is able to resolve and authenticate AD users? I'm
wondering if this is even possible or if I'm looking at a lost cause.
when I deploy the freeipa-client to hosts behind a haproxy most of the
hostnames get changed to the rDNS entry of the haproxy. The
freeipa-clients get enrolled with this name. I know I can set --hostname
but how to do this with ansible-freeipa?
Thanks in advance & best regards
I’m aware that we can make overrides on AD users with the Default Trust View object on IPA. I’ve created another one for specific users named “Clients Trust” and added three user accounts there. Made the overrides that I want, and when I checked with getent on a Linux client, the overrides aren’t worked.
On the new ID view, there’s this Host options, so I checked two hosts that I’m interested, and still didn’t override.
As a last resort I’ve reset sssd cache, with sss_cache -E, but no success either.
So the question is: Is it supported to override AD users in other trust than the default trust view? If yes how can I debug with the override isn’t working?
Thank you all.