left-right VS both
by lejeczek
Hi guys.
Would you know why addition of new replica/master via
'ipa-replica-install --setup-ca ..' in 'domain' topology
creates 'both' type of segment but in 'ca' it is
'left-right' x 2 ?
If that is by design then what is the rationale?
many thanks, L
2 years, 9 months
ipa-ca dns record misformed during ipa upgrade
by Kees Bakker
Hi,
Yesterday I upgraded one of the masters (CentOS 8 Stream, from 4.9.2 => 4.9.3) and
in the process it modified ipa-ca to only have its own IP address. Here is
an extract from ipaupgrade.log
2021-07-08T18:37:29Z DEBUG raw: server_role_find(None, server_server='rotte.example.com', status='enabled', include_master=True, version='2.240')
2021-07-08T18:37:29Z DEBUG server_role_find(None, server_server='rotte.example.com', status='enabled', include_master=True, all=False, raw=False, version='2.240')
2021-07-08T18:37:29Z DEBUG raw: server_role_find(None, server_server='iparep4.example.com', status='enabled', include_master=True, version='2.240')
2021-07-08T18:37:29Z DEBUG server_role_find(None, server_server='iparep4.example.com', status='enabled', include_master=True, all=False, raw=False, version='2.240')
2021-07-08T18:37:29Z DEBUG raw: server_role_find(None, server_server='linge.example.com', status='enabled', include_master=True, version='2.240')
2021-07-08T18:37:29Z DEBUG server_role_find(None, server_server='linge.example.com', status='enabled', include_master=True, all=False, raw=False, version='2.240')
2021-07-08T18:37:29Z DEBUG raw: dnszone_show(<DNS name example.com.>, version='2.240')
2021-07-08T18:37:29Z DEBUG dnszone_show(<DNS name example.com.>, rights=False, all=False, raw=False, version='2.240')
2021-07-08T18:37:29Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:32Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:35Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:38Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:41Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:44Z DEBUG Name iparep4.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:44Z ERROR unable to resolve host name iparep4.example.com. to IP address, ipa-ca DNS record will be incomplete
2021-07-08T18:37:44Z DEBUG Name linge.example.com. resolved to {UnsafeIPAddress('172.16.16.10'), UnsafeIPAddress('fe80::529a:4cff:fe9d:3b10')}
2021-07-08T18:37:44Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:47Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:50Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:37:53Z DEBUG Name rotte.example.com. does not have any address: [Errno -2] Name or service not known
2021-07-08T18:38:01Z ERROR unable to resolve host name rotte.example.com. to IP address, ipa-ca DNS record will be incomplete
...
2021-07-08T18:38:02Z DEBUG raw: dnsrecord_mod(<DNS name example.com.>, <DNS name ipa-ca.example.com.>, arecord=['172.16.16.10'], aaaarecord=['fe80::529a:4cff:fe9d:3b10'], version='2.240')
2021-07-08T18:38:02Z DEBUG dnsrecord_mod(<DNS name example.com.>, <DNS name ipa-ca.example.com.>, arecord=('172.16.16.10',), aaaarecord=('fe80::529a:4cff:fe9d:3b10',), rights=False, structured=False, all=False, raw=False, version='2.240')
That's a bit puzzling. Why couldn't it find these two hostnames during the upgrade?
/etc/resolv.conf:
nameserver 127.0.0.1
There does not seem to be anything wrong (before and after the upgrade).
Both hostname names resolve perfectly well.
The only thing I can think of (wild guess) is that the nameservers are configured
with dnssec disabled. Could that be it?
--
Kees
2 years, 9 months
bug in ldap_entry_reconstruct()
by Kees Bakker
Hey,
In two of my three masters I see these error messages.
Jul 01 09:38:38 linge.ghs.nl named-pkcs11[6945]: bug in
ldap_entry_reconstruct(): protocol violation: attempt to reconstruct
non-existing entry
Jul 01 09:38:38 linge.ghs.nl named-pkcs11[6945]: ldap_sync_search_entry
failed: not found
It also so happens that DNS is not updated on these two systems.
We only use one master to update DNS, either via the web interface
or via DHCP-update. These changes are correctly found in LDAP, on
all three systems. However, the two other nameservers don't pick
up the changes.
There are no "syncrepl_update" messages in the log (after increasing
trace level with rndc trace 10).
To be honest, I don't know if the above errors are related to the missing
updates. I'm grasping at straws here.
Something is seriously wrong, but what? How can I debug this further?
The two failing systems run CentOS 8 Stream. Some rpm info:
389-ds-base-1.4.3.16-8.module_el8.4.0+644+ed25d39e.x86_64
ipa-server-4.9.2-3.module_el8.5.0+750+c59b186b.x86_64
--
Kees
2 years, 9 months
Unlocked AD user not usable immediately
by Ronald Wimmer
Some external users have an AD user account that is allowed (HBAC) to
access IPA clients. These users are locked in AD when they are not
needed and only unlocked on demand.
Which tunables do we have on the IPA side to get the unlocked state
reflected immediately in IPA?
Cheers,
Ronald
2 years, 9 months
IPA client + AD Trust + ID Override inconsistent lookup results
by iulian roman
Hello everybody,
I try to make the above combination to work in my environment , and already spent several weeks + open a few threads with different sort of issues. So far, I can say that it works only with workarounds , restarts, clear caches, etc , which is not the setup I can move in production with.
I try to provide the latest update of the setup and the issues I am currently facing:
RedHat Idm with AD trust configured (non-posix)
Default Trust View configured which overrides the UID and GID of the AD users
The UID and GID do exist in Active Directory (the user and group have the same name) , although the group name is in different OU - I do not know if this is an issue or not
On the client, some of the users are resolved, some not. If I manually run getent group <username> before running the id command, it does resolve the group and user. Without running getent group command, sometimes it resolves, sometimes not.
I checked the logs on the client and server and the errors I noticed when running id <username> are:
on the client:
[ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null)
on the server:
[nss] [nss_protocol_fill_initgr] (0x0080): Unable to find primary gid [2]: No such file or directory
It seems to be related to the magical primary GID which seems to be the source of all my issues, but I. have no idea how to fix it (the GID exist in AD and it is defined in the Default Trust View). I am considering even changing settings in AD, but I do not know what should I change.
I tried to define as well all the AD groups (for which I do group override in Default Trust View) in IPA as posix groups with that specific GID . In that situation for some users the lookup failed first time but after the negative cache expired or sssd is restarted the lookup for the user and group works properly (situation was quite similar with the one in the thread https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... ).
For AD users which do not have attributes overwritten everything works properly.
2 years, 9 months
permission on ldap subtree
by iulian roman
Hello,
I tried to grant read/search access to a specific subtree in IPA for anonymous bind. The ipa permission-add command completed successfully, but when I try ldapsearch it does not display any objects.
ipa permission-show 'read oracle context'
Permission name: read oracle context
Granted rights: read, search, compare
Bind rule type: anonymous
Subtree: cn=OracleContext,dc=ipadev,dc=example,dc=com
Target DN: cn=*,cn=OracleContext,dc=ipadev,dc=example,dc=com
Permission flags: SYSTEM, V2
ldapsearch -h ipadevserver -p 389 -x -b "cn=OracleContext,dc=ipadev,dc=example,dc=com"
# extended LDIF
#
# LDAPv3
# base <cn=OracleContext,dc=ipadev,dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 0 Success
# numResponses: 1
Any idea what is wrong or what do I need to change ?
2 years, 9 months
pki-tomcatd fails to start with LDAP error authentication failed (48)
by Tiemen Ruiten
Hello,
On a newly installed CentOS 8 IPA master (a few days ago), the
pki-tomcatd@pki-tomcat service fails to start and logs LDAP authentication
failed (48) in /var/log/pki/pki-tomcat/ca/debug.2021-07-01.log. See below.
This happened after I dnf upgraded the master and replica at the same time,
my mistake.
I've gone through the troubleshooting steps described here:
https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tom...
but all certificates appear to be correct.
What else can I do?
RPM versions:
[root@ipa-01 ca]# rpm -qa | grep ipa
ipa-healthcheck-0.7-3.module_el8.5.0+750+c59b186b.noarch
python3-libipa_hbac-2.4.0-9.el8_4.1.x86_64
sssd-ipa-2.4.0-9.el8_4.1.x86_64
python3-ipalib-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
ipa-server-trust-ad-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
centos-logos-ipa-85.8-1.el8.noarch
ipa-healthcheck-core-0.7-3.module_el8.5.0+750+c59b186b.noarch
ipa-client-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
ipa-selinux-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
ipa-server-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
python3-ipaclient-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
python3-ipaserver-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
ipa-server-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
libipa_hbac-2.4.0-9.el8_4.1.x86_64
ipa-common-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
ipa-server-dns-4.9.2-4.module_el8.4.0+846+96522ed7.noarch
ipa-client-4.9.2-4.module_el8.4.0+846+96522ed7.x86_64
<...>
2021-07-01 17:28:20 [main] INFO: CMSEngine: initializing password store
2021-07-01 17:28:20 [main] INFO: CMSEngine: initializing password store for
internaldb
2021-07-01 17:28:20 [main] INFO: CMSEngine: initializing password store for
replicationdb
2021-07-01 17:28:20 [main] INFO: CMSEngine: Java version: 1.8.0_292
2021-07-01 17:28:20 [main] INFO: CMSEngine: security providers:
2021-07-01 17:28:20 [main] INFO: PluginRegistry: Loading plugin registry
from /var/lib/pki/pki-tomcat/conf/ca/registry.cfg
2021-07-01 17:28:21 [main] SEVERE: LdapBoundConnFactory: Unable to connect
to LDAP server: Authentication failed
netscape.ldap.LDAPException: Authentication failed (48)
at netscape.ldap.LDAPSaslBind.checkForSASLBindCompletion(Unknown
Source)
at netscape.ldap.LDAPSaslBind.bind(Unknown Source)
at netscape.ldap.LDAPSaslBind.bind(Unknown Source)
at netscape.ldap.LDAPConnection.authenticate(Unknown Source)
at netscape.ldap.LDAPConnection.authenticate(Unknown Source)
at netscape.ldap.LDAPConnection.checkClientAuth(Unknown Source)
at netscape.ldap.LDAPConnection.connect(Unknown Source)
at netscape.ldap.LDAPConnection.connect(Unknown Source)
at netscape.ldap.LDAPConnection.connect(Unknown Source)
at
com.netscape.cmscore.ldapconn.LdapBoundConnection.<init>(LdapBoundConnection.java:105)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBoundConnFactory.java:284)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:260)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:223)
at
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactory.java:192)
at org.dogtagpki.server.ca.CAEngine.initDatabase(CAEngine.java:186)
at com.netscape.cmscore.apps.CMSEngine.start(CMSEngine.java:1002)
at
com.netscape.cmscore.apps.CMSEngine.contextInitialized(CMSEngine.java:1643)
at
org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4685)
at
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5146)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:717)
at
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:129)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:150)
at
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase.java:140)
at java.security.AccessController.doPrivileged(Native Method)
at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:688)
at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:705)
at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:631)
at
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1831)
at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
at
java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:112)
at
org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:526)
at
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:425)
at
org.apache.catalina.startup.HostConfig.start(HostConfig.java:1576)
at
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:309)
at
org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:123)
at
org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:423)
at
org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:366)
at
org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:936)
at
org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:841)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at
org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384)
at
org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)
at
java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:134)
at
org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909)
at
org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:262)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at
org.apache.catalina.core.StandardService.startInternal(StandardService.java:421)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at
org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:930)
at
org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.startup.Catalina.start(Catalina.java:633)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:343)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:474)
<...>
--
Tiemen Ruiten
Infrastructure Engineer
2 years, 9 months
Certificate profile to ignore (drop) email in SAN - possible?
by Ian Pilcher
I've hit a roadblock while trying to generate a certificate for a VMware
vSphere appliance.
The VMware "Certificate Management" tool doesn't allow one to upload a
certificate and key. Instead, one has to generate a CSR in the VMware
GUI which then gets submitted to the CA (IPA in this case).
Unfortunately, the VMware tool refuses to generate a CSR that does not
include an email address in its subject alternative names extension, and
IPA refuses to issue a host or service certificate that includes an
email address.
Is it possible to create a certificate profile that will simply ignore
the email address (i.e. not include it in the SAN of the issued
certificate)?
--
========================================================================
Ian Pilcher Sr. Principal Product Manager
+1 469 892-8704 Red Hat Cloud Platforms
========================================================================
2 years, 9 months
failing to add additional replica (already 3 in place)
by Rolf Linder
Hey there
Using freeipa on centos (ipa-server-4.6.8-5.el7.centos.6.x86_64) we fail to add an additional replica, but only when enabling CA services (option "--setup-ca").
We use the following command to stage a new replica (and have in the past):
> ipa-replica-install --principal admin --admin-password ${adminpw} --setup-dns --no-dnssec-validation --no-forwarder --setup-ca --domain lxusp.local --server [master-idm-node]
which we have used to stage the previous replicas too.
Log (/var/log/ipareplica-install.log) shows that its stuck in state
> DEBUG certmonger request is in state dbus.String(u'SUBMITTING', variant_level=1)
Repeated until then aborted by a timeout message (and non-functional replica).
Since there are only outdated reports (>2 years old) about slightly similar (but not matching!) behavior like https://bugzilla.redhat.com/show_bug.cgi?id=1623113 we kindly ask if anyone can help here.
Best regards,
Rolf
2 years, 9 months