[SSSD] Announcing SSSD 2.6.3
by Pavel Březina
# SSSD 2.6.3
The SSSD team is proud to announce the release of version 2.6.3 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.6.3
See the full release notes at:
https://sssd.io/release-notes/sssd-2.6.3.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
## Highlights
### Important fixes
* A regression introduced in sssd-2.6.2 in the IPA provider that
prevented users from login was fixed. Access control always denied
access because the selinux_child returned an unexpected reply.
* A critical regression that prevented authentication of users via AD
and IPA providers was fixed. LDAP port was reused for Kerberos
communication and this provider would send incomprehensible information
to this port.
* When authenticating AD users, backtrace was triggered even though
everything was working correctly. This was caused by a search in the
global catalog. Servers from the global catalog are filtered out of the
list before writing the KDC info file. With this fix, SSSD does not
attempt to write to the KDC info file when performing a GC lookup.
1 year, 2 months
IPA yubikey duo
by Per Qvindesland
Hi
Is there any information on how to implement IPA with yubikey duo? I had a look and it seems straightforward enough to implement duo and ssh https://duo.com/docs/duounix but it would be nice to be able to manage it through ipa.
Regards
Per
Sent from my Commodore 64
1 year, 2 months
CA - does it make sense with globbing/wildcard
by lejeczek
Hi guys
I'm for the first time contemplating CA service from a public CA to
subordinate IPA to it - would it make sense with a *.sub.domain cert, if
such one cert one already has from that public CA, to still want to sub
IPA's CA?
(not a CA expert so go easy on me)
many thanks, L.
1 year, 2 months
Some ipa user passwords did not work after update
by Ronald Wimmer
On December the 30th we have updated the following packages on our IPA
servers:
Package list:
0:ipa-client-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.x86_64
0:ipa-client-common-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:ipa-common-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:ipa-selinux-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:ipa-server-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.x86_64
0:ipa-server-common-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:ipa-server-trust-ad-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.x86_64
0:python3-ipaclient-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:python3-ipalib-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:python3-ipaserver-4.9.6-10.0.1.module+el8.5.0+20451+6c55862e.noarch
0:389-ds-base-1.4.3.23-12.module+el8.5.0+20461+fe0fe228.x86_64
0:389-ds-base-libs-1.4.3.23-12.module+el8.5.0+20461+fe0fe228.x86_64
0:python3-lib389-1.4.3.23-12.module+el8.5.0+20461+fe0fe228.noarch
0:systemd-239-51.0.1.el8_5.3.x86_64
0:systemd-libs-239-51.0.1.el8_5.3.x86_64
0:systemd-pam-239-51.0.1.el8_5.3.x86_64
0:systemd-udev-239-51.0.1.el8_5.3.x86_64
0:kernel-4.18.0-348.7.1.el8_5.x86_64
0:kernel-core-4.18.0-348.7.1.el8_5.x86_64
0:kernel-modules-4.18.0-348.7.1.el8_5.x86_64
0:kernel-tools-4.18.0-348.7.1.el8_5.x86_64
0:kernel-tools-libs-4.18.0-348.7.1.el8_5.x86_64
0:kexec-tools-2.0.20-57.0.3.el8_5.1.x86_64
0:libipa_hbac-2.5.2-2.0.1.el8_5.3.x86_64
0:libsss_autofs-2.5.2-2.0.1.el8_5.3.x86_64
0:libsss_certmap-2.5.2-2.0.1.el8_5.3.x86_64
0:libsss_idmap-2.5.2-2.0.1.el8_5.3.x86_64
0:libsss_nss_idmap-2.5.2-2.0.1.el8_5.3.x86_64
0:libsss_simpleifp-2.5.2-2.0.1.el8_5.3.x86_64
0:libsss_sudo-2.5.2-2.0.1.el8_5.3.x86_64
1:openssl-1.1.1k-5.el8_5.x86_64
1:openssl-libs-1.1.1k-5.el8_5.x86_64
1:openssl-perl-1.1.1k-5.el8_5.x86_64
0:oraclelinux-release-el8-1.0-21.el8.x86_64
0:python3-libipa_hbac-2.5.2-2.0.1.el8_5.3.x86_64
0:python3-libsss_nss_idmap-2.5.2-2.0.1.el8_5.3.x86_64
0:python3-perf-4.18.0-348.7.1.el8_5.x86_64
0:python3-sss-2.5.2-2.0.1.el8_5.3.x86_64
0:python3-sss-murmur-2.5.2-2.0.1.el8_5.3.x86_64
0:python3-sssdconfig-2.5.2-2.0.1.el8_5.3.noarch
0:selinux-policy-3.14.3-80.0.2.el8_5.2.noarch
0:selinux-policy-targeted-3.14.3-80.0.2.el8_5.2.noarch
0:sssd-client-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-common-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-common-pac-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-dbus-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-ipa-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-kcm-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-krb5-common-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-nfs-idmap-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-tools-2.5.2-2.0.1.el8_5.3.x86_64
0:sssd-winbind-idmap-2.5.2-2.0.1.el8_5.3.x86_64
0:systemd-239-51.0.1.el8_5.2.x86_64
0:systemd-libs-239-51.0.1.el8_5.2.x86_64
0:systemd-pam-239-51.0.1.el8_5.2.x86_64
0:systemd-udev-239-51.0.1.el8_5.2.x86_64
0:kernel-uek-5.4.17-2136.302.6.1.el8uek.x86_64
After having updated these packages some of our ipa users (including
admin) were not able to log in anymore. Fortunately, some users still
worked allowing us to reset the passwords of the respective users.
Can this be update related or is it just a coincidence? We had to reset
the passwords and no time to hunt the problem down. But what can
possibly have caused this?
Cheers,
Ronald
1 year, 2 months
dependency blocks to install ipa-server on Centos 7
by Kathy Zhu
Hi List,
When I tried to install ipa-server on Centos 7, I ran into the following:
Error: Package: ipa-server-4.6.8-5.el7.centos.10.x86_64 (updates)
Requires: mod_wsgi
Available: mod_wsgi-3.4-18.el7.x86_64 (base)
mod_wsgi = 3.4-18.el7
Available: python36-mod_wsgi-4.6.2-2.el7.ius.x86_64 (ius)
mod_wsgi = 4.6.2
After upgrading to the latest, it's still the same. Does anyone know how to
get by this?
Many thanks!
Kathy.
1 year, 2 months
After OS/IPA updates Employee attributes in web app are blank
by Scott Serr
Attributes in the Employee Information section of the user web page are blank following a series of OS/IPA updates.
The "ipa user-find --all" cli command shows these attributes fine.
Specifically (in my case):
Department Number
Employee Number
Employee Type
I'm wondering if anyone else has seen this. Trying to find a small test case, I've found 1 of my development VMs that has some snapshots. It's Rocky 8. It has seen OS/IPA updates frequently in the last month. This VM also has a snapshot on December 8th.
Now I have 3 clones of this VM (at different snapshot times):
dev-current -- fails to show these attributes on user web page
dev-dec8 -- shows these attributes
dev-dec8-updated-to-current -- shows these attributes
The system is mainly used to test updates, data remains the same. The only difference I can think of is "dev-current" has had *incremental* OS/IPA updates between Dec 8th and now.
I'm combing through a filesystem diff, trying to figure out why they behave differently, /usr/share/ipa appears to be the same. Something else odd: "dev-current" has a new section "User attributes for SMB services" on the user web page. The dev-dec8 and dev-dec8-updated-to-current states/VMs don't have this section on the user web page.
Interested in any troubleshooting ideas, or ideas of why this is happening.
Thank you,
Scott
1 year, 2 months
IPA managed sub CA with no subject name constraint
by Omar Aloraini
I'm trying to create a sub CA that is managed by IPA and be able to sign
certificates with arbitrary subjects.
You can create a profile for a sub CA and sign the sub CA certificate. I
have followed this guide previously with success:
https://frasertweedale.github.io/blog-redhat/posts/2018-08-21-ipa-subordi...
Doing it this way, you have to manage the private key yourself. What I want
to do now is to let IPA manage the private key and the sub CA just like the
root CA. This will let me use the IPA API to request certificates with the
issuesr set to the sub CA.
I did roughly the following:
# ipa ca-add kubernetes-ca --subject=CN=kubernetes-ca,O=$DOMAIN
--desc='Kubernetes general CA'
# ipa ca-add etcd-ca --subject=CN=etcd-ca,O=$DOMAIN --desc='For all
etcd-related functions'
# ipa ca-add kubernetes-front-proxy-ca
--subject=CN=kubernetes-front-proxy-ca,O=$DOMAIN --desc='For the front-end
proxy'
# ipa certprofile-import ipaSubCA --desc "IPA Managed Sub CA certs" --file
subCA.cfg --store=1
# ipa host-add --no-reverse --force k8s.$DOMAIN
# ipa caacl-add ipaSubCA
# ipa caacl-add-ca ipaSubCA --ca kubernetes-ca
# ipa caacl-add-profile ipaSubCA --certprofile ipaSubCA
# ipa caacl-add-host ipaSubCA --hosts k8s.$DOMAIN
When creating the profile, I removed the common name constraint and the
commonNameToSANDefaultImpl as per the guide.
My ipaSubCA.cfg
auth.instance_id=raCertAuth
classId=caEnrollImpl
desc=This certificate profile is for enrolling server certificates with
IPA-RA agent authentication.
enable=true
enableBy=ipara
input.i1.class_id=certReqInputImpl
input.i2.class_id=submitterInfoInputImpl
input.list=i1,i2
name=IPA-RA Agent-Authenticated Server Certificate Enrollment
output.list=o1
output.o1.class_id=certOutputImpl
policyset.list=serverCertSet
policyset.serverCertSet.1.constraint.class_id=noConstraintImpl
policyset.serverCertSet.1.constraint.name=No Constraint
policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl
policyset.serverCertSet.1.default.name=Subject Name Default
policyset.serverCertSet.10.constraint.class_id=noConstraintImpl
policyset.serverCertSet.10.constraint.name=No Constraint
policyset.serverCertSet.10.default.class_id
=subjectKeyIdentifierExtDefaultImpl
policyset.serverCertSet.10.default.name=Subject Key Identifier Extension
Default
policyset.serverCertSet.10.default.params.critical=false
policyset.serverCertSet.11.constraint.class_id=noConstraintImpl
policyset.serverCertSet.11.constraint.name=No Constraint
policyset.serverCertSet.11.default.class_id=userExtensionDefaultImpl
policyset.serverCertSet.11.default.name=User Supplied Extension Default
policyset.serverCertSet.11.default.params.userExtOID=2.5.29.17
policyset.serverCertSet.12.constraint.class_id=noConstraintImpl
policyset.serverCertSet.12.constraint.name=No Constraint
policyset.serverCertSet.12.default.class_id=commonNameToSANDefaultImpl
policyset.serverCertSet.12.default.name=Copy Common Name to Subject
Alternative Name
policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl
policyset.serverCertSet.2.constraint.name=Validity Constraint
policyset.serverCertSet.2.constraint.params.notAfterCheck=false
policyset.serverCertSet.2.constraint.params.notBeforeCheck=false
policyset.serverCertSet.2.constraint.params.range=365
policyset.serverCertSet.2.default.class_id=validityDefaultImpl
policyset.serverCertSet.2.default.name=Validity Default
policyset.serverCertSet.2.default.params.range=365
policyset.serverCertSet.2.default.params.startTime=0
policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl
policyset.serverCertSet.3.constraint.name=Key Constraint
policyset.serverCertSet.3.constraint.params.keyParameters
=1024,2048,3072,4096,8192
policyset.serverCertSet.3.constraint.params.keyType=RSA
policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl
policyset.serverCertSet.3.default.name=Key Default
policyset.serverCertSet.4.constraint.class_id=noConstraintImpl
policyset.serverCertSet.4.constraint.name=No Constraint
policyset.serverCertSet.4.default.class_id
=authorityKeyIdentifierExtDefaultImpl
policyset.serverCertSet.4.default.name=Authority Key Identifier Default
policyset.serverCertSet.5.constraint.class_id=noConstraintImpl
policyset.serverCertSet.5.constraint.name=No Constraint
policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
policyset.serverCertSet.5.default.name=AIA Extension Default
policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true
policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0
=URIName
policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0=
http://ipa-ca.home.arpa/ca/ocsp
policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0
=1.3.6.1.5.5.7.48.1
policyset.serverCertSet.5.default.params.authInfoAccessCritical=false
policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1
policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl
policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint
policyset.serverCertSet.6.constraint.params.keyUsageCritical=true
policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false
policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true
policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false
policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true
policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false
policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false
policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false
policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true
policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=true
policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl
policyset.serverCertSet.6.default.name=Key Usage Default
policyset.serverCertSet.6.default.params.keyUsageCritical=true
policyset.serverCertSet.6.default.params.keyUsageCrlSign=false
policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true
policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false
policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true
policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false
policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=false
policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false
policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=true
policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=true
policyset.serverCertSet.7.constraint.class_id=noConstraintImpl
policyset.serverCertSet.7.constraint.name=No Constraint
policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl
policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default
policyset.serverCertSet.7.default.params.exKeyUsageCritical=false
policyset.serverCertSet.7.default.params.exKeyUsageOIDs
=1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl
policyset.serverCertSet.8.constraint.name=No Constraint
policyset.serverCertSet.8.constraint.params.signingAlgsAllowed
=SHA1withRSA,SHA256withRSA,SHA512withRSA,MD5withRSA,MD2withRSA,SHA1withDSA,SHA1withEC,SHA256withEC,SHA384withEC,SHA512withEC
policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl
policyset.serverCertSet.8.default.name=Signing Alg
policyset.serverCertSet.8.default.params.signingAlg=-
policyset.serverCertSet.9.constraint.class_id=noConstraintImpl
policyset.serverCertSet.9.constraint.name=No Constraint
policyset.serverCertSet.9.default.class_id
=crlDistributionPointsExtDefaultImpl
policyset.serverCertSet.9.default.name=CRL Distribution Points Extension
Default
policyset.serverCertSet.9.default.params.crlDistPointsCritical=false
policyset.serverCertSet.9.default.params.crlDistPointsEnable_0=true
policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0=CN=Certificate
Authority,o=ipaca
policyset.serverCertSet.9.default.params.crlDistPointsIssuerType_0
=DirectoryName
policyset.serverCertSet.9.default.params.crlDistPointsNum=1
policyset.serverCertSet.9.default.params.crlDistPointsPointName_0=
http://ipa-ca.home.arpa/ipa/crl/MasterCRL.bin
policyset.serverCertSet.9.default.params.crlDistPointsPointType_0=URIName
policyset.serverCertSet.9.default.params.crlDistPointsReasons_0=
policyset.serverCertSet.list=1,2,3,4,5,6,7,8,9,10,11
profileId=ipaSubCA
visible=false
When I try to generate a certificate using ipa-getcert:
sudo ipa-getcert request -f /etc/pki/tls/certs/app12.crt -k
/etc/pki/tls/private/app12.key -K host/ipa.home.arpa -X kubernetes-ca -N
kube-apiserver --profile ipaSubCA
I get the following error:
Server at https://ipa.home.arpa/ipa/json denied our request, giving up:
3009 (invalid 'csr': hostname in subject of request 'kube-apiserver' does
not match name or aliases of principal 'host/ipa.home.arpa(a)HOME.ARPA')
I'm not really fimilar with IPA design, but I'm guessing the there is
validation happening at both IPA(caacl) and dogtag.
Is it possible to get such configratuon working? Or should I just mange the
private key myself?
I haven't tried prinipal aliases. They might work, but they are global
object which will cause problems for me.
thanks,
1 year, 2 months
Web service to receive callbacks via HTTP
by akshay p
I need to trap various FreeIPA events such as user addition or deletion. If I can trap these events (perhaps via callbacks), then I can do things like backing up home directories during user deletion or sending out a welcome mail on user addition.
Similarly, when staging users are added, I can use a callback and send an email to the admin notifying them of the same.
I can build a web service to receive callbacks via HTTP. Or if there is any other way to hook into the FreeIPA workflow, I will be glad to do that well.
1 year, 2 months
Importing automount maps
by Simon Matthews
The Redhat documentation provides a script for importing automount maps. The script also uses ldapadd to add some data into the LDAP server. This part doesn't appear to work. It's not clear to me that this part needs to work.
The part of the script is:
basedn=$(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:)
cat > /tmp/amap.ldif <<EOF
dn: nis-domain=$2+nis-map=$4,cn=NIS Server,cn=plugins,cn=config
objectClass: extensibleObject
nis-domain: $2
nis-map: $4
nis-base: automountmapname=$4,cn=$1,cn=automount,$basedn
nis-filter: (objectclass=*)
nis-key-format: %{automountKey}
nis-value-format: %{automountInformation}
EOF
ldapadd -x -h $3 -D "cn=Directory Manager" -W -f /tmp/amap.ldif
Apart from the fact that $3 is probably the wrong variable (it points to the hostname of the NIS server, which is likely different), when I try to run it, I get:
ldapadd -x -D "cn=Directory Manager" -W -f /tmp/amap.ldif
Enter LDAP Password:
adding new entry "nis-domain=blue+nis-map=auto.home,cn=NIS Server,cn=plugins,cn=config"
ldap_add: No such object (32)
The file /tmp/amap.ldif contains:
dn: nis-domain=blue+nis-map=auto.home,cn=NIS Server,cn=plugins,cn=config
objectClass: extensibleObject
nis-domain: blue
nis-map: auto.home
nis-base: automountmapname=auto.home,cn=default,cn=automount,dc=ipa,dc=bluepearlsoftware,dc=com
nis-filter: (objectclass=*)
nis-key-format: %{automountKey}
nis-value-format: %{automountInformation}
["blue" is my NIS domain].
1 year, 2 months