June 2021 - FreeIPA-users - Fedora mailing-lists

Network I/O error when trying to resolve AD users
by Ronald Wimmer 28 Jul '21

28 Jul '21

Today I set up an IPA test web application in our IPA test environment. I figured out that my AD user was resolved but the user of my colleague was not. (getent passwd userA/userB) I stopped SSSD, cleared the cache with 'rm -rf /var/lib/sss/db/*' and started SSSD again. After that I could not resolve any AD user. The sssd logs showed an Network I/O error: ==> /var/log/sssd/sssd_ipatest.mydomain.at.log <== (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: Operations error(1), Failed to handle the request. . (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed, server logs might contain more details. (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed. (2021-06-30 11:46:14): [be[ipatest.mydomain.at]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: [1432158230]: Network I/O Error. ==> /var/log/sssd/sssd_nss.log <== (2021-06-30 11:46:14): [nss] [cache_req_common_process_dp_reply] (0x0040): CR #197: Data Provider Error: 3, 1432158230, Network I/O Error (2021-06-30 11:46:14): [nss] [cache_req_common_process_dp_reply] (0x0400): CR #197: Due to an error we will return cached data (2021-06-30 11:46:14): [nss] [cache_req_search_cache] (0x0400): CR #197: Looking up [aduser271(a)ORG.MYDOMAIN.AT] in cache (2021-06-30 11:46:14): [nss] [cache_req_search_cache] (0x0400): CR #197: Object [aduser271(a)ORG.MYDOMAIN.AT] was not found in cache (2021-06-30 11:46:14): [nss] [cache_req_process_result] (0x0400): CR #197: Finished: Not found (2021-06-30 11:46:14): [nss] [client_recv] (0x0200): Client disconnected! What the hell is going on here? Any hints would be highly appreciated! Cheers, Ronald

2 5

Compatibility Plugin .update file for Active Directory
by Joseph Fry 23 Jul '21

23 Jul '21

My goal is to use the compatibility plugin to display IPA hosts in a format that an Active Directory centric tool can consume. Essentially my solution creates two containers under cn=compat called cn=adComputers and cn=adComputerGroups. An entry is added to adComputers for every ipaHost, and attributes populated that match active directory ldap attributes for a 'computer' object. We do the same for each IPA hostgroup. I have come pretty close to getting this working, but now I need to get the groups populated with the group members, but not the IPA hosts... instead I need the members to be the corresponding cn=adComputers entries that were created. So I need to manipulate the members attribute. For example the member attribute of one of the hostgroups in ipa is: fqdn=test.lab.local,cn=computers,cn=accounts,dc=lab,dc=local I need to change it to: cn=test.lab.local,cn=adcomputers,cn=compat,dc=lab,dc=local Below is my .update file. I want to add a line at the end like: add:schema-compat-entry-attribute: member=%{member} But want to rewrite the %{member} value as described above. I know I can do some logic here, as evidenced by https://pagure.io/freeipa/blob/master/f/install/updates/80-schema_compat.up… where they use %ifeq and %%%deref_f. But I cannot find any documentation explaining what options are available. Essentially I am hoping there is some sort of regex manipulation capability here? My .update file so far: dn: cn=adComputers, cn=Schema Compatibility, cn=plugins, cn=config add:objectClass: top add:objectClass: extensibleObject add:cn: adComputers add:schema-compat-container-group: cn=compat, $SUFFIX add:schema-compat-container-rdn: cn=adComputers add:schema-compat-search-base: cn=computers, cn=accounts, $SUFFIX add:schema-compat-search-filter: (&(fqdn=*)(objectClass=ipaHost)) add:schema-compat-entry-rdn: cn=%first("%{fqdn}") add:schema-compat-check-access: yes add:schema-compat-entry-attribute: objectclass=computer add:schema-compat-entry-attribute: cn=%{fqdn} add:schema-compat-entry-attribute: sAMAccountType=805306369 add:schema-compat-entry-attribute: dNSHostName=%{fqdn} add:schema-compat-entry-attribute: operatingSystem=%{nsHardwarePlatform} add:schema-compat-entry-attribute: operatingSystemVersion=%{nsOsVersion} add:schema-compat-entry-attribute: name=%{serverHostName} add:schema-compat-entry-attribute: sAMAccountName=$$%{serverHostName} add:schema-compat-entry-attribute: location=%{nsHostLocation} dn: cn=adComputerGroups, cn=Schema Compatibility, cn=plugins, cn=config add:objectClass: top add:objectClass: extensibleObject add:cn: adComputerGroups add:schema-compat-container-group: cn=compat, $SUFFIX add:schema-compat-container-rdn: cn=adComputerGroups add:schema-compat-search-base: cn=hostgroups, cn=accounts, $SUFFIX add:schema-compat-search-filter: (&(member=*)(objectClass=ipahostgroup)) add:schema-compat-entry-rdn: cn=%{cn} add:schema-compat-entry-check-access: yes add:schema-compat-entry-attribute: objectclass=group add:schema-compat-entry-attribute: cn=%{cn} add:schema-compat-entry-attribute: groupType=-2147483646 add:schema-compat-entry-attribute: sAMAccountType=268435456 add:schema-compat-entry-attribute: name=%{cn} add:schema-compat-entry-attribute: sAMAccountName=$$%{cn}

4 24

FreeIPA server packages upgrade best practice
by Suchismita Panda 16 Jul '21

16 Jul '21

Hi, I would like to know the best practice for patching FreeIPA-Server packages. We generally have daily patching enabled in our servers. Will it be a good idea to do automatic patching of FreeIPA-Server packages? If we want to restrict the FreeIPA-Server packages from automatomatic upgrade and rather keep it for manual upgrade, what are the packages we should hold back with a version restriction? And how frequently should we do the manual upgrade? If the FreeIPA-client packages are upgraded regularly by daily patching(yum-cron or unattended upgrade) will there be any problem with authentication, if the FreeIPA-Servers are behind version upgrade? We have two FreeIPA environments, one with CentOS7 and another with CentOS8. And we have FreeIPA clients mostly with Ubuntu(18 and 20) and CentOS (7 and 8). Any help and guidance is appreciated. Thanks Suchi

4 7

healthcheck complains about a removed replica
by Kees Bakker 13 Jul '21

13 Jul '21

Hi, After installing a new replica and running /usr/bin/ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data I'm getting this error keyctl_search: Required key not available Enter password for Internal Key Storage Token: Internal server error HTTPSConnectionPool(host='iparep3.ghs.nl', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fc473262a90>: Failed to establish a new connection: [Errno 113] No route to host',)) [ { "source": "pki.server.healthcheck.clones.connectivity_and_data", "check": "ClonesConnectivyAndDataCheck", "result": "ERROR", "uuid": "c2f3ec1d-494b-4f6a-b6e3-0e38108f2005", "when": "20210528150818Z", "duration": "30.348789", "kw": { "status": "ERROR: pki-tomcat : Internal error testing CA clone. Host: iparep3.ghs.nl Port: 443" } } ] First, it is asking for a password, and I have no clue for what. I've tried the admin password and the Directory Manager password. It makes no difference. Second, it tries to connect to a replica that was removed several months ago. Both ipa-replica-manage list and ipa-csreplica-manage show the correct list of masters that we currently have. Where does ipa-healthcheck get the information from to query the removed replica? BTW. Two replica run CentOS 8 Stream, and one runs CentOS 7. The first two give this healthcheck error, the centos7 master does not. -- Kees

5 19

IPA client + AD Trust + ID Override inconsistent lookup results
by iulian roman 07 Jul '21

07 Jul '21

Hello everybody, I try to make the above combination to work in my environment , and already spent several weeks + open a few threads with different sort of issues. So far, I can say that it works only with workarounds , restarts, clear caches, etc , which is not the setup I can move in production with. I try to provide the latest update of the setup and the issues I am currently facing: RedHat Idm with AD trust configured (non-posix) Default Trust View configured which overrides the UID and GID of the AD users The UID and GID do exist in Active Directory (the user and group have the same name) , although the group name is in different OU - I do not know if this is an issue or not On the client, some of the users are resolved, some not. If I manually run getent group <username> before running the id command, it does resolve the group and user. Without running getent group command, sometimes it resolves, sometimes not. I checked the logs on the client and server and the errors I noticed when running id <username> are: on the client: [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null) on the server: [nss] [nss_protocol_fill_initgr] (0x0080): Unable to find primary gid [2]: No such file or directory It seems to be related to the magical primary GID which seems to be the source of all my issues, but I. have no idea how to fix it (the GID exist in AD and it is defined in the Default Trust View). I am considering even changing settings in AD, but I do not know what should I change. I tried to define as well all the AD groups (for which I do group override in Default Trust View) in IPA as posix groups with that specific GID . In that situation for some users the lookup failed first time but after the negative cache expired or sssd is restarted the lookup for the user and group works properly (situation was quite similar with the one in the thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… ). For AD users which do not have attributes overwritten everything works properly.

2 5

FreeIPA Upgrade F31 -> F32: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
by Anthony Joseph Messina 01 Jul '21

01 Jul '21

After upgrading FreeIPA from F31 to F32, on startup I now see a lot of these errors from certmonger, ns-slapd, java, etc. May 08 17:57:28 certmonger[38]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:30 ns-slapd[67]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:33 dogtag-ipa-renew-agent-submit[143]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock May 08 17:57:42 java[640]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock The server seems to come up without issue, but can you point me in the right direction to resolve these errors? freeipa-server-4.8.6-1.fc32.x86_64 opendnssec-2.1.6-5.fc32.x86_64 opencryptoki-3.13.0-1.fc32.x86_64 I've installed a fresh F32 freeipa-server (on a test domain) and I don't see these errors. Thanks. -A -- Anthony - https://messinet.com F9B6 560E 68EA 037D 8C3D D1C9 FF31 3BDB D9D8 99B6

7 9

How does FreeIPA resolve AD group names
by iulian roman 30 Jun '21

30 Jun '21

Hello everybody, Can anyone explain which attribute is used to lookup/resolve group names in AD ? As far as I can see on my ipa clients, it seems to use sAMAccountName . Is that correct ?

2 2

FreeIPA 4.9.6 released
by Alexander Bokovoy 29 Jun '21

29 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.6 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.9.6 * 8402: [RFE] ipa-client-install forces nsupdate to bind with gssapi Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case. === Enhancements === Known Issues * FreeIPA 4.9.4 contains a new LDAP caching layer that might incorrectly return data in certain cases. This is known to affect ansible-freeipa operations with automember rules. FreeIPA 4.9.6 addresses this issue. === Bug fixes FreeIPA 4.9.6 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are more than 10 bug-fixes since FreeIPA 4.9.5 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/7752[#7752] ipa client throws http.client.ResponseNotReady error * https://pagure.io/freeipa/issue/8402[#8402] (https://bugzilla.redhat.com/show_bug.cgi?id=1854557[rhbz#1854557]) [RFE] ipa-client-install forces nsupdate to bind with gssapi * https://pagure.io/freeipa/issue/8532[#8532] (https://bugzilla.redhat.com/show_bug.cgi?id=1886837[rhbz#1886837]) Revise PKINIT upgrade code * https://pagure.io/freeipa/issue/8726[#8726] Provide a better error message with updatedns and FQDN Is not provided * https://pagure.io/freeipa/issue/8754[#8754] (https://bugzilla.redhat.com/show_bug.cgi?id=1919384[rhbz#1919384]) Certificate Serial Number issue * https://pagure.io/freeipa/issue/8817[#8817] Running ipa-server-certinstall with v1 certificate fails with Attempted "__iter__" operation on ASN.1 schema object * https://pagure.io/freeipa/issue/8880[#8880] (https://bugzilla.redhat.com/show_bug.cgi?id=1973023[rhbz#1973023]) CA_less ipa-server-install fails if CA cert subject contains non ascii chars * https://pagure.io/freeipa/issue/8882[#8882] Directly integrate custodia * https://pagure.io/freeipa/issue/8884[#8884] (https://bugzilla.redhat.com/show_bug.cgi?id=1967325[rhbz#1967325]) API returns the misleading error "Insufficient Access" if run as non-admin * https://pagure.io/freeipa/issue/8885[#8885] (https://bugzilla.redhat.com/show_bug.cgi?id=1975139[rhbz#1975139]) Upgrade error: Add failure missing required attribute "objectclass" * https://pagure.io/freeipa/issue/8889[#8889] [tests] healthcheck 0.9 * https://pagure.io/freeipa/issue/8897[#8897] (https://bugzilla.redhat.com/show_bug.cgi?id=1976286[rhbz#1976286]) ansible-freeipa automember test fails with `automember_add_condition: testgroup: 'objectclass'` due to ldap cache * https://pagure.io/freeipa/issue/8898[#8898] plugin `plugins` doesn't work -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

cache invalidation dilema on the clients
by iulian roman 29 Jun '21

29 Jun '21

Hello, I tried for some time to understand how the cache invalidation works on the clients, and I have to admit that I am even more confused that when I started, therefore I would like to ask if there is someone who can either explain or point me to the relevant documentation. I'll describe bellow the situation I am currently facing: PHASE 1 - RedHat Idm with AD trust configured (non-posix) - override the UID of AD users in Idm - on the clients run the id <username> ; the correct (overwritten ) UID and an auto-generated GID is displayed PHASE 2 - overwrite the GID as well on Idm - on the clients still the old auto-generated GID is displayed (after sss_cache -E and restart of sssd) when I run id <username> - remove everything in /var/lib/sss/db , restart sssd and run id <username> - no user found - getent group <username> - new overwritten GID is displayed - id <username> displays the correct UID and GID For the users who are not in cache, restarting sssd seems to be enough (although I did not test if thoroughly). My question is : What do I have to do on the client in order to have the latest information from the Idm Override ? Apparently sss_cache -E and restart ssssd is not enough . Do we always need to remove everything in /var/lib/sss/db in order to have the latest information from the server ?

3 4

dns of two out of three masters not up to date
by Kees Bakker 29 Jun '21

29 Jun '21

Hey, Recently I discovered that the nameservers of two out the three IPA masters (replicas) are not responding with up-to-date information. Our setup has three masters. Each is configured as nameserver. Most of the time I use one as the main master when I modify DNS entries. We also have a DHCP server that sends updates to that "main" master. What I now discovered is that updates are not available when clients use the two other masters. On all three masters the DNS record is present when I use local ldapsearch [1]. But with dig the record is only present on one master. If I restart the nameserver it then has all records available. What would be the best method to find out what is wrong? BTW. There are two things that changed recently. I mention this in case it rings a bell. 1. one master was re-installed with CentOS 8 Stream. An other CentOS8 master was added a few weeks ago. 2. our nameservers don't have connection to the Internet any more. So, root servers cannot be found. [1] by local ldapsearch I mean doing a command like this: ldapsearch -H ldapi://%2fvar%2frun%2f... -- Kees

3 8

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2021