Overall, what is the goal of the IPA compat mode, and what are the consequences
of enabling/disabling it ?
And specifically, what's the differences between :
# ipa migrate-ds --with-compat ...
# ipa-compat-manage disable
# ipa migrate-ds ...
Thanks on advance
Jacquelin Charbonnel - (+33)2 4173 5397
CNRS Mathrice/LAREMA - Campus universitaire d'Angers
The CRL being served by the CRL Master has not added a newly revoked certificate for 4 months. The CRL is updated and published as expected every four hours, just with no change to the list of revocations. Currently the CRL lists 34 certificates where as a query with ipa cert-find returns 40.
The missing certificates are not expired.
I do not see any errors in /var/log/pki/pki-tomcat/ca/debug*
I've been through the steps at https://www.freeipa.org/page/Troubleshooting/PKI and checked the CRL settings per https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master
The CRL files in /var/lib/ipa/pki-ca/publish/ are being generated/updated.
OK, I know that the AD-DC and the IDM servers need matching Kerberos realm and DNS domain names
Let's say AD.FOO.BAR.URP / IDM.FOO.BAR.URP for Kerberos and ad.foo.bar.urp / idm.foo.bar.urp for DNS
I am using 4 labels to parallel the environment for which this is intended.
The DNS domain for the environment is foo.bar.urp and there is currently no FOO.BAR.URP AD-DC, but we eventually expect one from "Upstream" and hope to make AD.FOO.BAR.URP a Kerberos sub-realm/domain of it
AD.FOO.BAR.URP and ad.foo.bar.urp were created.
IDM.FOO.BAR.URP and idm.foo.bar.urp will be created shortly and connected by a cross-forest trust. These, of course, will be sub-domains to AD.FOO.BAR.URP/ad.foo.bar.urp
The confuzzlepation is about client domain names.
Do Linux clients need to use the idm.foo.bar.urp DNS domain or can they just use foo.bar.urp ?
Same question for non-Linux clients -- ad.foo.bar.urp DNS domain or can they just use foo.bar.urp ?
And does the lack of the "parent" Kerberos realm/domain FOO.BAR.URP complicate the matter ?
Daniel E. White
NASCOM Linux Engineer
NASA Goddard Space Flight Center
Science Applications International Corporation (SAIC)
Office: (301) 286-6919
Mobile: (240) 513-5290
We have been a big time IPA vault users and managed to accumulate a few hundred thousands KRA requests in our IPA LDAP. This had been going on before ephemeral KRA requests were enabled in our installations and now we have these requests sitting in LDAP.
Is there any (preferably: a safe) way to remove these KRA requests? Even the newest ones are 6+ months old.
Thank you for your help,
I'm trying to come up with a Sudo rule that will allow a user to "su" to only a single specified user. I need to give a DBA access to the oracle user account.
This serverfault article details exactly what I want to do, however this is not for FreeIPA.
I've tried creating a sudo command that's "/usr/bin/su - USER" and other variations to no avail.
I've also tried creating a sudo rule that allows all commands to be run as "USER".
Hi, I can confirm that the computing for geeks link does work:
When testing LDAP settings Jenkins does determine my group membership correctly however, I cannot see any IPA server groups appearing in the "User/group" column if I try to enable Matrix-based security.
I've obviously missed something.
I have found online docs proposing chronyd support for freeipa (target 4.7).
I am running 4.8. Does support for using chronyd instead of ntpd exist yet? I have not founnd anything concrete yet to confirm this.
IF this exists, is there a documented procedure to change?
and if the support does not exist yet, does anyone have an insight as to when that might happen?
Thank you all in advance.
For the moment we're stuck with RHEL8.1. The ansible-freeipa
package there (0.1.6-4) does not seem to include the "ipaconf" and
"iparole" modules (maybe others). Are they missing, in a
different package or do we need to upgrade to a newer RHEL
Dominik ^_^ ^_^