I discovered this:
Does this, in theory, mean that in the near future, a trust with Azure AD Domain Services would be possible without much effort from the developers?
I thought I would bring this to your attention in the off chance that this has eluded you and after all the article is quite recent.
When attempting to debug another problem with FreeIPA, I noticed
If I have an IPA domain example.com, I can do an ipa-client-install
from a machine named c.d.example.com and it successfully adds the
client to the domain and updates IPA's DNS, but if I do an ipa
host-add of c.d.example.com it gives an error saying
ipa: ERROR: DNS zone d.example.com. not found
which is correct, inasmuch as I never created a d.example.com zone.
But ipa-client-install happily added c.d to the example.com zone. So
which of these two commands is doing the right thing?
I have a 2 server IPA setup.
The replica was added a while ago.
Today I tried to extract the cert from the /root/cacert.p12 from the replica server - however I have no idea what the dir manager password was at the time I created the replica..
I have the initial dir manager pass for when I setup the primary server and can extract that fine using
# openssl pkcs12 -in /root/cacert.p12 -clcerts -nokeys -out /tmp/cert.crt
However I do not know the pass for the p12 bundle on the replica.
I have the current directory manager also.
What can I do to extract the p12 bundle on the replica ?
i.e can I re-generate it ? Or does it not matter as I have the primary .p12 pass.
Any advice would be welcomed
I recently installed freeIPA on ubuntu 18 and tested client both from ubuntu and centos , but except default admin user, I'm not able to login using any user from any client . it says permission denied error
I am trying to get OpenShift to use my FreeIPA installation
(ipa-server-4.6.5-11.el7.centos.4.x86_64) as an identity provider.
OpenShift is refusing to talk to the LDAP server, because its
certificate doesn't contain a subjectAltName.
So I need to re-request/re-issue the certificate with the SAN. Will it
be sufficient to modify the caIPAserviceCert profile to copy the host-
name from the CN to the SAN (as discussed in ) and then use
Will this break anything? (I only have a single IPA server/CA.)
In Soviet Russia, Google searches you!
Hello , I recently installed freeIPA on ubuntu 18 and tested client both
from ubuntu and centos , but except default admin user, I'm not able to
login using any user from any client . it says permission denied error pls
Should i create a single reverse zone or should there be zones for each subnet? 10.1.1/24 10.1.2/24 10.1.3/26 10.1.3.192/26 etc? 10.1.1-50/ is the likely used ip range with a few /25-26's
It would appear that this page is over 6 years old.
The link for the Auth_remoteuser tar-ball does not exist. and the extension installation instructions are obsolete.
Daniel E. White
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: (301) 286-6919
Mobile: (240) 513-5290
I would like to know what do you think about using the management network (eth1) to enable the flow from clients to IPA servers? My company is concerned about using the production network interface (eth0) and is considering doing everything on the second interface.
Is it worth it?
Pros and cons?
What does your experience say?
I ran into a perplexing problem recently:
We have all of our users/groups stored in ipa, including some "service
accounts" that we run services under. As we started migrating to CentOS 7
we came across the issue with some services configured to store their PID
files in /run (or /var/run) which is tmpfs and the services would fail to
start due to missing pid directories.
We learned that we could create a conf in /usr/lib/tmpfiles.d that would
create the necessary directories on startup. Well, it didn't work. It took
us a while to figure out, but the issue is that the user/group ownership of
the directory was set to a user that is looked up from IPA (via sssd) and
was failing with:
systemd-tmpfiles: [/usr/lib/tmpfiles.d/my-service.conf:1] Unknown
systemd-tmpfiles-setup.service: main process exited, code=exited,
BUT it seems that because sssd.service relies
on systemd-tmpfiles-setup.service, we have a race condition.
sssd.service +271ms └─basic.target @976ms └─sockets.target @975ms
└─rpcbind.socket @975ms └─sysinit.target @969ms
└─systemd-update-utmp.service @963ms +5ms └─auditd.service @933ms +28ms -->
└─systemd-tmpfiles-setup.service @903ms +29ms └─rhel-import-state.service
@874ms +28ms └─local-fs.target @872ms └─run-user-20137.mount @20.363s
└─local-fs-pre.target @680ms └─lvm2-monitor.service @260ms +418ms
└─lvm2-lvmetad.service @306ms └─lvm2-lvmetad.socket @260ms └─-.slice
At first, I thought it might be due to the order of nsswitch.conf, but I
group: files sss
group: sss files
and that didn't seem to make a difference.
Curiously: it is not complaining that it can't find the user, only the
Once the system is up, I can log in and:
getent group my_group
So if sssd is waiting on systemd-tmpfiles, how on earth can we ever use
tmpfiles.d with users/groups stored in IPA if sssd isn't "up" yet?
I am not sure how to handle this... just wondering in anyone has come
across this before and if there is a solution.