Fwd: WebUI plugin not working on new replica
by Kristian Petersen
---------- Forwarded message ---------
From: Kristian Petersen <nesretep(a)chem.byu.edu>
Date: Wed, Aug 18, 2021 at 4:29 PM
Subject: Re: [Freeipa-users] WebUI plugin not working on new replica
To: Rob Crittenden <rcritten(a)redhat.com>
Have locations where those files belong for the web ui changed at all?
On Wed, Aug 18, 2021, 4:21 PM Rob Crittenden <rcritten(a)redhat.com> wrote:
> Kristian Petersen wrote:
> > Yes, I did. After putting all of the plugin files in their appropriate
> > places, I did an ipactl restart.
>
> I can only assume you missed some piece then. The python plugins provide
> the data for the UI but the UI consists of javascript which is stored
> separately.
>
> rob
>
> >
> > On Wed, Aug 18, 2021 at 3:29 PM Rob Crittenden <rcritten(a)redhat.com
> > <mailto:rcritten@redhat.com>> wrote:
> >
> > Kristian Petersen via FreeIPA-users wrote:
> > > I have created a new replica and I'm trying to add a plugin so it
> > > matches the other freeIPA server in the WebUI and CLI. I already
> have
> > > the plugins on the first machine so I just copied them from one
> > machine
> > > to the other and made sure they were in the same locations on
> each.
> > > However, it appears that something isn't right as the additional
> > > attributes that appear as user fields on the original FreeIPA
> > server do
> > > not show up in the WebUI on the new replica. What might I have
> > missed?
> >
> > Did you restart Apache?
> >
> > rob
> >
> > > --
> > > Kristian Petersen
> > > System Administrator
> > > BYU Dept. of Chemistry and Biochemistry
> > > 801-422-4100
> > >
> > > _______________________________________________
> > > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > <mailto:freeipa-users@lists.fedorahosted.org>
> > > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> > <mailto:freeipa-users-leave@lists.fedorahosted.org>
> > > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
> >
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> > > Do not reply to spam on the list, report it:
> > https://pagure.io/fedora-infrastructure
> > >
> >
> >
> >
> > --
> > Kristian Petersen
> > System Administrator
> > BYU Dept. of Chemistry and Biochemistry
> > 801-422-4100
>
>
--
Kristian Petersen
System Administrator
BYU Dept. of Chemistry and Biochemistry
801-422-4100
2 years, 8 months
generic linux clients configuration
by iulian roman
Hello ,
I try to enrol some old linux clients (sssd 1.9.4) to ipaserver using the settings as mentioned in ipa-advise. I used ldap provider in sssd and I can query the accounts defined in ipa server but not the Active Directory accounts . I use AD trust and views in IPA, therefore the question is if this configuration is supported on the old clients and if yes , what are the ldap_search_values which should be used ? Are there any configuration examples or tips to make it work ?
2 years, 8 months
generic linux clients configuration
by iulian roman
Hello ,
I try to enrol some old linux clients (sssd 1.9.4) to ipaserver using the settings as mentioned in ipa-advise. I used ldap provider in sssd and I can query the accounts defined in ipa server but not the Active Directory accounts . I use AD trust and views in IPA, therefore the question is if this configuration is supported on the old clients and if yes , what are the ldap_search_values which should be used ? Are there any configuration examples or tips to make it work ?
2 years, 8 months
WebUI plugin not working on new replica
by Kristian Petersen
I have created a new replica and I'm trying to add a plugin so it matches
the other freeIPA server in the WebUI and CLI. I already have the plugins
on the first machine so I just copied them from one machine to the other
and made sure they were in the same locations on each. However, it appears
that something isn't right as the additional attributes that appear as user
fields on the original FreeIPA server do not show up in the WebUI on the
new replica. What might I have missed?
--
Kristian Petersen
System Administrator
BYU Dept. of Chemistry and Biochemistry
801-422-4100
2 years, 8 months
Deletion of dse.ldif - why/when?
by lejeczek
Hi guys.
I'd find these:
-rw-------. 1 dirsrv root 221792 Jul 9 11:53
/etc/dirsrv/.../dse.ldif.ipa.e70ef09741825387
-rw-rw----. 1 dirsrv root 221845 Jul 9 11:53
/etc/dirsrv/.../dse.ldif.modified.out
-rw-------. 1 dirsrv dirsrv 221650 Jul 13 18:26
/etc/dirsrv/.../dse.ldif.startOK
-rw-------. 1 dirsrv dirsrv 0 Jul 13 18:28
/etc/dirsrv/.../dse.ldif.bak
and not 'ldif' so IPA would fail for 'dirsrv' fails to start.
Use 'dse.ldif.startOK' as a source for a 'ldif' copy and IPA
starts seemingly okey.
In what circumstances - that is, if that should happen at
all - 'dse.ldif' would be deleted by IPA?
many thanks, L
2 years, 8 months
Re: krb5_child.log - Internal credentials cache error
by Sumit Bose
Am Mon, Aug 16, 2021 at 10:49:18PM +0000 schrieb Dungan, Scott A. via FreeIPA-users:
> Hello.
>
> We have a client system (client1) that refuses login and throws an error in the krb5_child.log only when a particular account tries to log in (user1). The same account can log into other ipa domain client machines just fine. Other ipa accounts can log in to this machine, just not the user1 account. In /var/log/secure we see:
>
> Aug 16 15:16:56 client1 sshd[13173]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx user=user1
> Aug 16 15:16:56 client1 sshd[13173]: pam_sss(sshd:auth): received for user user1: 4 (System error)
> Aug 16 15:16:59 client1 sshd[13171]: error: PAM: Authentication failure for user1 from xxx.xxx.xxx.xxx
>
> sssd_domain_withheld.log:
>
> (2021-08-16 15:16:56): [be[id.gps.caltech.edu]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information
>
> krb5_child.log:
>
> (2021-08-16 15:16:56): [krb5_child[13176]] [create_ccache] (0x0020): 1039: [-1765328188][Internal credentials cache error]
> (2021-08-16 15:16:56): [krb5_child[13176]] [map_krb5_error] (0x0020): 1849: [-1765328188][Internal credentials cache error]
Hi,
can you add 'debug_level = 9' to the [domain/...] section of sssd.conf,
restart SSSD and try again to get more debug information into the logs?
If possible please send the full log of the failed krb5_child run.
>
> Sometimes we see this in krb5_child.log as well:
>
> (2021-08-16 12:32:13): [krb5_child[6232]] [get_and_save_tgt] (0x0020): 1720: [-1765328360][Preauthentication failed]
> (2021-08-16 12:32:13): [krb5_child[6232]] [map_krb5_error] (0x0020): 1849: [-1765328360][Preauthentication failed]
This typically indicates a wrong password.
bye,
Sumit
>
> Steps taken to clear the issue with no results:
>
> 1. sss_cache -E
>
> 2. systemctl stop sssd
> rm -rf /var/lib/sss/db/*
> systemctl start sssd
>
> 3. ipa-client-install -uninstall and then rejoin
>
> Environment:
>
> RHEL8.4 - 4.18.0-305.12.1.el8_4.x86_64
> ipa-client-4.9.2-3.module+el8.4.0+10413+a92f1bfa.x86_64
>
> Contents of /etc/krb5.conf:
>
> #File modified by ipa-client-install
>
> includedir /etc/krb5.conf.d/
> includedir /var/lib/sss/pubconf/krb5.include.d/
>
> [libdefaults]
> default_realm = DOMAIN.WITHHELD.LOCAL
> dns_lookup_realm = true
> rdns = false
> dns_canonicalize_hostname = false
> dns_lookup_kdc = true
> ticket_lifetime = 24h
> forwardable = true
> udp_preference_limit = 0
> default_ccache_name = KEYRING:persistent:%{uid}
>
> [realms]
> DOMAIN.WITHHELD.LOCAL = {
> pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
> pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
>
> }
>
> [domain_realm]
> .domain.withheld.local = DOMAIN.WITHHELD.LOCAL
> domain.withheld.local = DOMAIN.WITHHELD.LOCAL
> client1.domain.withheld.local = DOMAIN.WITHHELD.LOCAL
> .withheld.local = DOMAIN.WITHHELD.LOCAL
> withheld.local = DOMAIN.WITHHELD.LOCAL
>
>
> Contents of /etc/sssd/sssd.conf:
>
> [domain/domain.withheld.local]
>
> id_provider = ipa
> dns_discovery_domain = domain.withheld.local
> ipa_server = _srv_, idm2.domain.withheld.local
> ipa_domain = domain.withheld.local
> ipa_hostname = client1.domain.withheld.local
> auth_provider = ipa
> chpass_provider = ipa
> access_provider = ipa
> cache_credentials = True
> ldap_tls_cacert = /etc/ipa/ca.crt
> krb5_store_password_if_offline = True
> sudo_provider = ipa
> autofs_provider = ipa
> subdomains_provider = ipa
> session_provider = ipa
> hostid_provider = ipa
> ipa_automount_location = default
> [sssd]
> services = nss, pam, ssh, sudo, autofs
>
> domains = domain.withheld.local
> [nss]
> homedir_substring = /home
>
> [pam]
>
> [sudo]
>
> [autofs]
>
> [ssh]
>
> [pac]
>
> [ifp]
>
> [secrets]
>
> [session_recording]
>
> Any help would be appreciated.
>
> -Scott
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
2 years, 8 months
Re: A couple of CRL questions
by Rob Crittenden
IPA Listmail wrote:
> On Mon, Aug 16, 2021 at 11:33 AM Rob Crittenden <rcritten(a)redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
> I don't know why resetting the crl number would affect the set of
> revoked certificates.
>
>
> Sorry, that was unclear. I meant that whatever means of shrinking, even
> the nuclear option of completely wiping the CRL and starting with a new
> empty CRL would be workable, though obviously not optimal. I would
> assume that such a drastic reset would likewise reset the CRL number and
> I was trying to say that would be okay for my purposes.
Adding list back.
I'm not sure that resetting the number would have the effect you suggest
as there would still be revoked certificates within their validity
period. It also likely breaks an RFC by using duplicate CRL numbers.
rob
2 years, 8 months
krb5_child.log - Internal credentials cache error
by Dungan, Scott A.
Hello.
We have a client system (client1) that refuses login and throws an error in the krb5_child.log only when a particular account tries to log in (user1). The same account can log into other ipa domain client machines just fine. Other ipa accounts can log in to this machine, just not the user1 account. In /var/log/secure we see:
Aug 16 15:16:56 client1 sshd[13173]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.xxx.xxx.xxx user=user1
Aug 16 15:16:56 client1 sshd[13173]: pam_sss(sshd:auth): received for user user1: 4 (System error)
Aug 16 15:16:59 client1 sshd[13171]: error: PAM: Authentication failure for user1 from xxx.xxx.xxx.xxx
sssd_domain_withheld.log:
(2021-08-16 15:16:56): [be[id.gps.caltech.edu]] [krb5_auth_done] (0x0040): The krb5_child process returned an error. Please inspect the krb5_child.log file or the journal for more information
krb5_child.log:
(2021-08-16 15:16:56): [krb5_child[13176]] [create_ccache] (0x0020): 1039: [-1765328188][Internal credentials cache error]
(2021-08-16 15:16:56): [krb5_child[13176]] [map_krb5_error] (0x0020): 1849: [-1765328188][Internal credentials cache error]
Sometimes we see this in krb5_child.log as well:
(2021-08-16 12:32:13): [krb5_child[6232]] [get_and_save_tgt] (0x0020): 1720: [-1765328360][Preauthentication failed]
(2021-08-16 12:32:13): [krb5_child[6232]] [map_krb5_error] (0x0020): 1849: [-1765328360][Preauthentication failed]
Steps taken to clear the issue with no results:
1. sss_cache -E
2. systemctl stop sssd
rm -rf /var/lib/sss/db/*
systemctl start sssd
3. ipa-client-install -uninstall and then rejoin
Environment:
RHEL8.4 - 4.18.0-305.12.1.el8_4.x86_64
ipa-client-4.9.2-3.module+el8.4.0+10413+a92f1bfa.x86_64
Contents of /etc/krb5.conf:
#File modified by ipa-client-install
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[libdefaults]
default_realm = DOMAIN.WITHHELD.LOCAL
dns_lookup_realm = true
rdns = false
dns_canonicalize_hostname = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
DOMAIN.WITHHELD.LOCAL = {
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.domain.withheld.local = DOMAIN.WITHHELD.LOCAL
domain.withheld.local = DOMAIN.WITHHELD.LOCAL
client1.domain.withheld.local = DOMAIN.WITHHELD.LOCAL
.withheld.local = DOMAIN.WITHHELD.LOCAL
withheld.local = DOMAIN.WITHHELD.LOCAL
Contents of /etc/sssd/sssd.conf:
[domain/domain.withheld.local]
id_provider = ipa
dns_discovery_domain = domain.withheld.local
ipa_server = _srv_, idm2.domain.withheld.local
ipa_domain = domain.withheld.local
ipa_hostname = client1.domain.withheld.local
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
krb5_store_password_if_offline = True
sudo_provider = ipa
autofs_provider = ipa
subdomains_provider = ipa
session_provider = ipa
hostid_provider = ipa
ipa_automount_location = default
[sssd]
services = nss, pam, ssh, sudo, autofs
domains = domain.withheld.local
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]
[secrets]
[session_recording]
Any help would be appreciated.
-Scott
2 years, 8 months
Ipa trust-add fail with Internal Error
by Dragnell
hello there, for a couple of days now i have this scenarios where my
replicas couldn't find any trusted object and only show the SID of the
member of the external groups. So i destroy that and build a replica from
the master wich was the only one who could add and remove trusted object, i
deleted the old trust and unistall the old master. (backup exist). However
the new master from with i try to create a new trust fail to do so with a
internal error.
Could any one take a look to this logs from
Thanks in advance.
Freeipa 4.9.2
/var/log/htttp/error_log
debug 50
https://paste.ubuntu.com/p/9yjRSMjP8V
2 years, 8 months
A couple of CRL questions
by IPA Listmail
1) Is there a way to shrink a CRL? That is, to remove revoked certs (per
cert or en masse) from the CRL? While not optimal, even breaking the CRL
number by resetting it back to 0 would be a workable solution if that is
the only way.
2) Is there a way to manually trigger a new CRL before the "Next Update"
time?
2 years, 8 months