Adding OTP token without using IPA UI
by dd4321 Dey
Hi
Is it possible to add/generate OTP token without using IPA user interface ? Due to security reasons, i don't want to give access to IPA web interface to users. Recently, i have configured password manager which integrates OpenLDAP/IPA server. So each user can change their password using password manager eliminating needs for accessing IPA web UI. In the same way, is it possible to do the same i.e generating OTP token using any third party application ?
Regards
2 years, 8 months
Replication broken
by Antoine Gatineau
Hello,
I'm on freeipa 4.9.0 on CentOS Stream. (1 master and 1 replica)
I have noticed that my replication is broken. Unfortunatly, I don't know since when...
First Question, can it b fixed?
Second question, is it possible to peform a restore (on one node, both nodes) to fix the issue.
I recently upgraded from CentOS 8 to CentOS Stream (ipa with it). So can I restore from a previous version?
Here are some snipets of what I see.
$ sudo ipa-healthcheck
Internal server error HTTPSConnectionPool(host='ipa-master-tmp.empire.lan', port=443): Max retries exceeded with url:
/ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa49f3df320>: Failed to
establish a new connection: [Errno -2] Name or service not known',))
[
{
"source": "pki.server.healthcheck.clones.connectivity_and_data",
"check": "ClonesConnectivyAndDataCheck",
"result": "ERROR",
"uuid": "66815b82-56d9-43a4-9035-78333c5cb5cd",
"when": "20210308162643Z",
"duration": "0.364202",
"kw": {
"status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: ipa-master-tmp.empire.lan Port: 443"
}
},
{
"source": "ipahealthcheck.ds.replication",
"check": "ReplicationCheck",
"result": "WARNING",
"uuid": "55addd45-6440-4317-8d0b-8eb0d516bd4e",
"when": "20210308162645Z",
"duration": "0.353734",
"kw": {
"key": "DSREPLLE0002",
"items": [
"Replication",
"Conflict Entries"
],
"msg": "There were 6 conflict entries found under the replication suffix \"dc=empire,dc=lan\"."
}
}
]
pki-tomcatd seems ok :
$ sudo journalctl -u pki-tomcatd@pki-tomcat
-- Logs begin at Mon 2021-03-08 17:24:39 CET, end at Mon 2021-03-08 17:35:01 CET. --
Mar 08 17:25:01 ipa-master.empire.lan systemd[1]: Starting PKI Tomcat Server pki-tomcat...
Mar 08 17:25:04 ipa-master.empire.lan java[1613]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
Mar 08 17:25:05 ipa-master.empire.lan server[1716]: Java virtual machine used: /usr/lib/jvm/java-1.8.0-openjdk/bin/java
Mar 08 17:25:05 ipa-master.empire.lan server[1716]: classpath used: /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-
juli.jar:/usr/share/java/ant.jar:/usr/share/java/ant-la>
Mar 08 17:25:05 ipa-master.empire.lan server[1716]: main class used: org.apache.catalina.startup.Bootstrap
Mar 08 17:25:05 ipa-master.empire.lan server[1716]: flags used: -Dcom.redhat.fips=false
Mar 08 17:25:05 ipa-master.empire.lan server[1716]: options used: -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat
-Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/>
Mar 08 17:25:05 ipa-master.empire.lan server[1716]: arguments used: start
Mar 08 17:25:05 ipa-master.empire.lan ipa-pki-wait-running[1717]: pki.client: /usr/libexec/ipa/ipa-pki-wait-running:63: The subsystem in
PKIConnection.__init__() has been deprecated (https>
Mar 08 17:25:05 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Created connection
http://ipa-master.empire.lan:8080/ca
Mar 08 17:25:05 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa-
master.empire.lan', port=8080): Max retries exceeded>
Mar 08 17:25:06 ipa-master.empire.lan java[1716]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
Mar 08 17:25:06 ipa-master.empire.lan server[1716]: WARNING: Some of the specified [protocols] are not supported by the SSL engine and have
been skipped: [[TLSv1, TLSv1.1]]
Mar 08 17:25:07 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa-
master.empire.lan', port=8080): Read timed out. (rea>
Mar 08 17:25:09 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa-
master.empire.lan', port=8080): Read timed out. (rea>
Mar 08 17:25:11 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='ipa-
master.empire.lan', port=8080): Read timed out. (rea>
Mar 08 17:25:12 ipa-master.empire.lan ipa-pki-wait-running[1717]: ipa-pki-wait-running: Success, subsystem ca is running!
Mar 08 17:25:12 ipa-master.empire.lan systemd[1]: Started PKI Tomcat Server pki-tomcat.
Best
Antoine
2 years, 8 months
How to automatically manage a service before host creation
by Nelson LAMEIRAS
Hi all,
I'm looking for a way to automatize certificate creation for services hosted on servers inside a highly available cluster.
exemple: we have the following setup :
- http/serverha (an IPA service that will be highly available)
- server01 (not kickstarted yet)
- server02 (not kickstarted yet)
Both server01 and server02 must be able to get http/serverha certificate when kickstarted, but I find this impossible because they are not part of "managed by" hosts configured in service http/serverha
I'm forced to add manually each host to "managed by" section of the service, but only after it is kickstarted, which ruins my automatation goal
I hope this explanation is clear.
1 - Is there an elegant (ie. official) way to automaticaly manage this situation ?
2 - My intuitive solution would be to use automember to put server01 and server02 inside the same hostgroup and to able to add hostsgroups to the "managed by" section on a service, but this is not possible on my current setup (IPA v4.6.8) - only adding hosts (not hostgroups!) are allowed. Could this be a legitimate RFE I should write?
Please note that I'm not suppose to know beforehand the precise name of serverXY ? it could be server24... ;)
Thanks for your answers,
regards,
Nelson
2 years, 8 months
Re: FreeIPA integration with Azure AD
by Alexander Bokovoy
On to, 11 maalis 2021, Jonathan Aquilina wrote:
>Hi Alexander,
>
>My question was more how can i start this venture towards supporting Azure AD.
We already have some plans for that. If you want to help, please add
your specific use cases to https://pagure.io/freeipa/issue/6664
ticket with as much details as possible.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 years, 8 months
Re: FreeIPA integration with Azure AD
by Alexander Bokovoy
On to, 11 maalis 2021, Jonathan Aquilina wrote:
>Hi Alexander,
>
>Thanks for your feedback what would be the best way forward to help
>test and work towards having azure AD connectivity with FreeIPA?
As I said, there is nothing implemented yet. Once we'd have something,
I'll issue a test call on this list. Don't expect anything in upcoming
months though, this is a huge undertaking.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 years, 8 months
Re: FreeIPA integration with Azure AD
by Alexander Bokovoy
On to, 11 maalis 2021, Jonathan Aquilina via FreeIPA-users wrote:
>Hi Ronald,
>
>What kind of work would need to be done to get it to talk to an Azure AD tenant?
A lot. This is not implemented and not supported yet.
>
>Regards,
>Jonathan
>________________________________
>From: Ronald Wimmer via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
>Sent: 11 March 2021 08:22
>To: freeipa-users(a)lists.fedorahosted.org <freeipa-users(a)lists.fedorahosted.org>
>Cc: Ronald Wimmer <ronaldw(a)ronzo.at>
>Subject: [Freeipa-users] Re: FreeIPA integration with Azure AD
>
>On 11.03.21 06:53, Jonathan Aquilina via FreeIPA-users wrote:
>> Hi Guys,
>>
>> Is it possible to integrate free IPA with Azure AD?
>
>Afaik no. The only thing AD and Azure AD have in common is the name.
>There is no Kerberos for example...
>
>Cheers,
>Ronald
>_______________________________________________
>FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 years, 8 months
POSIX attributes and Trusts in FreeIPA
by Lachlan Musicman
Can I please get clarification on a FreeIPA instance (as IdM in RHEL8.3) and AD's POSIX attributes?
From what I can see, the POSIX attributes - are ignored?
Specifically, when I run
$ id user(a)ad.domain.com
$ id -u user(a)ad.domain.com
$ id -g user(a)ad.domain.com
The POSIX attribute values are not being returned. I am getting a correct list of AD groups etc, which is great. But no POSIX attributes. Do I need to explicitly request those attributes?
I note that there is an article from 2017 (1) "Configuring an Active Directory Domain with POSIX Attributes" which declares itself deprecated for (2) "Chapter 8. Using ID Views in Active Directory Environments", which is RHEL7. From what I can see both of these are about direct attachment to AD rather than for use in an IPA instance (although they reference IdM)
It looks like AD side POSIX attributes are only available to direct integration and even then only when specifically installed with realm (direct integration) and --automatic-id-mapping=no (3)
(1) https://access.redhat.com/articles/3023821
(2) https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
(3) https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
Cheers
L.
2 years, 8 months
Re: FreeIPA integration with Azure AD
by Ronald Wimmer
On 11.03.21 06:53, Jonathan Aquilina via FreeIPA-users wrote:
> Hi Guys,
>
> Is it possible to integrate free IPA with Azure AD?
Afaik no. The only thing AD and Azure AD have in common is the name.
There is no Kerberos for example...
Cheers,
Ronald
2 years, 8 months