Modified ipa-rewrite.conf
by Ronald Wimmer
Is it okay to modify /etc/httpd/conf.d/ipa-rewrite.conf in order to put
the WebGUI behind a Loadbalancer? Or will it break something I am not
aware of?
Modified version looks like this:
> # VERSION 7 - DO NOT REMOVE THIS LINE
>
> RewriteEngine on
>
> RequestHeader edit Referer ^https://ipa\.linux\.mydomain\.at/ https://pipa08.linux.mydomain.at/
>
> # By default forward all requests to /ipa. If you don't want IPA
> # to be the default on your web server comment this line out.
> #RewriteRule ^/$ https://pipa08.linux.mydomain.at/ipa/ui [L,NC,R=301]
>
> # Redirect to the fully-qualified hostname. Not redirecting to secure
> # port so configuration files can be retrieved without requiring SSL.
> #RewriteCond %{HTTP_HOST} !^pipa08.linux.mydomain.at$ [NC]
> #RewriteCond %{HTTP_HOST} !^ipa-ca.linux.mydomain.at$ [NC]
> #RewriteRule ^/ipa/(.*) http://pipa08.linux.mydomain.at/ipa/$1 [L,R=301]
>
> # Redirect to the secure port if not displaying an error or retrieving
> # configuration.
> #RewriteCond %{SERVER_PORT} !^443$
> #RewriteCond %{REQUEST_URI} !^/ipa/(errors|config|crl)
> #RewriteCond %{REQUEST_URI} !^/ipa/[^\?]+(\.js|\.css|\.png|\.gif|\.ico|\.woff|\.svg|\.ttf|\.eot)$
> #RewriteRule ^/ipa/(.*) https://pipa08.linux.mydomain.at/ipa/$1 [L,R=301,NC]
>
> RewriteCond %{HTTP_HOST} ^ipa-ca.linux.mydomain.at$ [NC]
> RewriteCond %{REQUEST_URI} !^/ipa/crl
> RewriteCond %{REQUEST_URI} !^/(ca|kra|pki|acme)
> RewriteRule ^/(.*) https://pipa08.linux.mydomain.at/$1 [L,R=301]
>
> # Rewrite for plugin index, make it like it's a static file
> RewriteRule ^/ipa/ui/js/freeipa/plugins.js$ /ipa/wsgi/plugins.py [PT]
1 year, 2 months
FreeIPA and Certbot ?
by Günther J. Niederwimmer
Hello list,
Why are there actually problems between FreeIPA and Certbot?
What I have found out so far is it no longer possible to install FreeIPA as a
client and replication server if Certbot is installed before ipa-client-
install?
The question now is, are there also problems when Certbot is installed after
FreeIPA?
Can I still use Lestencryt at all?
Thanks for an answer,
--
mit freundlichen Grüßen / best regards
Günther J. Niederwimmer
1 year, 2 months
2 conflict entries found under the replication suffix o=ipaca - ? - issue
by lejeczek
Hi guys.
-> $ ipa-healthcheck
..
{
"source": "ipahealthcheck.ds.replication",
"check": "ReplicationCheck",
"result": "WARNING",
"uuid": "7ff8f869-36c8-411c-9c44-7cb323deaf95",
"when": "20220104193941Z",
"duration": "0.574693",
"kw": {
"key": "DSREPLLE0002",
"items": [
"Replication",
"Conflict Entries"
],
"msg": "There were 2 conflict entries found under the
replication suffix \"o=ipaca\"."
}
I have found some old tips here from the list but I'm not
sure what to do with it.
-> $ ldapsearch -H ldaps://$(hostname) -W -D 'cn=Directory
Manager' -b 'o=ipaca'
'(&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))'
nsds5ReplConflict
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <o=ipaca> with scope subtree
# filter: (&(objectClass=ldapSubEntry)(nsds5ReplConflict=*))
# requesting: nsds5ReplConflict
#
# 7c395f01-6d6211ec-a624dc4c-7402d017 +
admin-dzien.mine.private, people, ipaca
dn:
nsuniqueid=7c395f01-6d6211ec-a624dc4c-7402d017+uid=admin-dzien.mine.privat
e,ou=people,o=ipaca
nsds5ReplConflict: namingConflict (ADD)
uid=admin-dzien.mine.private,ou=people
,o=ipaca
# e6ed9901-6d6811ec-affe8b51-4855b2e0 +
admin-swir.mine.private, people, ipaca
dn:
nsuniqueid=e6ed9901-6d6811ec-affe8b51-4855b2e0+uid=admin-swir.mine.private
,ou=people,o=ipaca
nsds5ReplConflict: namingConflict (ADD)
uid=admin-swir.mine.private,ou=people,
o=ipaca
Remove either entries?
many thanks, L.
1 year, 2 months
Re: SSL error after upgrade
by Per Qvindesland
Hi ScottMany thanks for the information and apologies for the delay in responding.I folllowed the information and it's all working now.RegardsPerOn 25 Dec 2021, at 17:06, "Dungan, Scott A. via FreeIPA-users" <freeipa-users(a)lists.fedorahosted.org> wrote:Hi, Per. I ran into the same problem and Alexander referred me to this link: https://www.mail-archive.com/freeipa-users@lists.fedorahosted.org/msg1258... fix for us was is pretty easy: Make a backup of /etc/pki/pki-tomcat/server.xmlOn lines 129 and 171 of server.xml, you’ll see a value for “secret=” and “sharedSecret=.” Those values will be different and that is the cause of the problem. Both values should match
what is found in the ProxyPassMatch statements located in the file /etc/httpd/conf.d/ipa-pki-proxy.conf. In my case, the value for secret= was correct and I just had to change the sharedSecert= to match.Restart services with ipactl restart -Scott From: Per Qvindesland via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> Sent: Wednesday, December 22, 2021 7:22 AM To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Per Qvindesland <perq(a)icloud.com> Subject: [Freeipa-users] SSL error after upgrade Hi All After an update to 4.9.6-10, I am unable to view any of the certificates that the IPA server has signed, I get error: An error has occurred (IPA Error 4301: CertificateOperationError) when I click on Authnticaiton -> Certificates, if I
click on "Certificate Autorities" then I get popup message with the error "Failed to authenticate to CA REST API" and "An error
has occurred (IPA Error 4016: RemoteRetrieveError)" is showing on the screen. ipactl status is showing everything as running:ipactl statusDirectory Service: RUNNINGkrb5kdc Service: RUNNINGkadmin Service: RUNNINGnamed Service: RUNNINGhttpd Service: RUNNINGipa-custodia Service: RUNNINGpki-tomcatd Service: RUNNINGsmb Service: RUNNINGwinbind Service: RUNNINGipa-otpd Service: RUNNINGipa-dnskeysyncd Service: RUNNINGipa: INFO: The ipactl command was successful Does anyone know what's causing this error? I ran ipa-healthcheck and pasted the output below, it reports that it's missing SRV records but the IPA server is the DNS server and it has the SRV records. RegardsPer ipa-healthcheckra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)ra.get_certificate(): Request failed with status 403: Non-2xx response from CA REST API: 403. (403)[ { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConnectivityCheck", "result": "ERROR", "uuid": "ac0200eb-3ec8-405f-ba5e-523cbb40ad6b", "when": "20211222151125Z", "duration": "0.016156", "kw": { "msg": "Request for certificate failed, Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "2f010c35-7d7d-431f-89b0-c342516cf296", "when": "20211222151130Z", "duration": "0.412221", "kw": { "key": "20211104170633", "serial": 7, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "10a946e2-e511-417a-b189-a66f1b555470", "when": "20211222151130Z", "duration": "0.519989", "kw": { "key": "20211104170628", "serial": 5, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "7c85e383-8508-4b8e-a10b-838b0b70eb73", "when": "20211222151130Z", "duration": "0.618106", "kw": { "key": "20211104170629", "serial": 2, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "1776678c-d997-435b-b809-52576128a2e9", "when": "20211222151130Z", "duration": "0.709013", "kw": { "key": "20211104170630", "serial": 4, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "f02ff5d9-13cf-4582-9bd3-7567b32c415d", "when": "20211222151130Z", "duration": "0.789825", "kw": { "key": "20211104170631", "serial": 1, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "d30b17b3-f45e-4317-bf8e-c1c13c3f77e3", "when": "20211222151131Z", "duration": "0.903311", "kw": { "key": "20211104170632", "serial": 3, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "32ff9bb7-69b8-4af3-8c20-9f2ab4394a73", "when": "20211222151131Z", "duration": "0.969296", "kw": { "key": "20211104170635", "serial": 34, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "18fb96f0-7a64-4c1c-b03b-bb21e3f90bf1", "when": "20211222151131Z", "duration": "1.065584", "kw": { "key": "20211104170634", "serial": 8, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertRevocation", "result": "ERROR", "uuid": "d82cdf6d-4d4b-44e4-9aa8-33211aa55c96", "when": "20211222151131Z", "duration": "1.116597", "kw": { "key": "20210811074531", "serial": 10, "error": "Certificate operation cannot be completed: Request failed with status 403: Non-2xx response from CA REST API: 403. (403)", "msg": "Request for certificate serial number {serial} in request {key} failed: {error}" } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "cc0c7d5c-1132-4b18-ac8e-c7625d3963f0", "when": "20211222151131Z", "duration": "0.015692", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "f0d6873f-b681-457d-8006-9e5bb051b9df", "when": "20211222151131Z", "duration": "0.017296", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "92a5517d-5f73-4f49-8874-bf6bbeb2ed9d", "when": "20211222151131Z", "duration": "0.018275", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "7f1994fb-e1dc-4d8c-93c5-5ba2e6652427", "when": "20211222151131Z", "duration": "0.019243", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "e9bbd202-8f37-4a44-b9b0-377ae5a53d08", "when": "20211222151131Z", "duration": "0.020150", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos-master._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "2d4a438f-6271-470e-a6f5-68a30858d928", "when": "20211222151131Z", "duration": "0.021502", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._tcp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "828efbaf-2071-4693-94f4-0e4c2ec884c0", "when": "20211222151131Z", "duration": "0.022772", "kw": { "msg": "Expected SRV record missing", "key": "_kpasswd._udp.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "b0a73e45-da65-43a6-a540-8e092e3e4d76", "when": "20211222151131Z", "duration": "0.023895", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com.:lda...." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "3329eea5-c794-4201-a973-82f22b58f151", "when": "20211222151131Z", "duration": "0.025341", "kw": { "msg": "Expected SRV record missing", "key": "_ldap._tcp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "dde9dd12-e044-4bde-a75f-2ea4d96910dc", "when": "20211222151131Z", "duration": "0.027364", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com....." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "9ebec84f-aa7d-4ba9-8c4e-ca8dd2aa98c8", "when": "20211222151131Z", "duration": "0.029421", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.proxdynamics.com....." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "cd921441-98bf-4fc1-a043-ed35a056e818", "when": "20211222151131Z", "duration": "0.030800", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._tcp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "93f21c35-a10d-418b-a549-c0c70d6330cd", "when": "20211222151131Z", "duration": "0.031808", "kw": { "msg": "Expected SRV record missing", "key": "_kerberos._udp.dc._msdcs.proxdynamics.com.:ldap2.inne.proxdynamics.com." } }, { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "331ef74f-e5d6-47d8-a666-a352320772de", "when": "20211222151131Z", "duration": "0.034319", "kw": { "msg": "Got {count} ipa-ca A records, expected {expected}", "count": 0, "expected": 1 } }] _______________________________________________FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.orgTo unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.orgFedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelinesList Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
1 year, 2 months
allowing password only one place
by Charles Hedrick
We have users who have otp set. I want to require them to use it except in one specific situation, where I want to be able to use a keytable to generate credentials for them (which have to work for all services).
Can anyone think of a way to do this?
Auth indicators doesn't seem to do the job, since it looks like a constraint on using the ticket, where I'm concerned with how it's generated. The only thing I've come up with is setting the directory server to override ipaUserAuthType for that host. There's got to be a better way.
1 year, 2 months
listing current KCM ccaches
by Charles Hedrick
I'm trying to find ways to get rid of as much of my custom C coding as possible, since I may be the only one that can maintain it. One major one is renewd, which renews tgt's automatically.
sssd can now do this. However I also need to kill the tickets when the user is no longer active. This could be done in a fairly simple shell script, but only if I can find a list of current active credential caches. At the moment the only way I can see to do that is to use tdbdump on secrets.ldb. I'm probably going to try that, but I'd prefer a better approach.
1 year, 2 months
Replica install fails due nonexisting RID ranges
by Andrius Jurkus
Hello, I didint enable adrust or installed related packages, I dont use samba shares either on existing installation.
I wanted to create additional replica, during install it asked what is NETBIOS name and if I want to generate SID identifiers for users (answered no) then process failed with errors below.
Should I update my ID ranges? or there is replica install option to skip this setup. (I dont use cross AD trusts, or similar features)
Configuring SID generation
[1/7]: creating samba domain object
Samba domain object already exists
[2/7]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
[3/7]: adding RID bases
Found more than one local domain ID range with no RID base set.
[error] RuntimeError: Too many ID ranges
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
Too many ID ranges
2021-12-27T17:56:04Z DEBUG [2/7]: adding admin(group) SIDs
2021-12-27T17:56:04Z DEBUG Admin SID already set, nothing to do
2021-12-27T17:56:04Z DEBUG Admin group SID already set, nothing to do
2021-12-27T17:56:04Z DEBUG step duration: SID generation __add_admin_sids 0.00 sec
2021-12-27T17:56:04Z DEBUG [3/7]: adding RID bases
2021-12-27T17:56:04Z CRITICAL Found more than one local domain ID range with no RID base set.
2021-12-27T17:56:04Z DEBUG Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step
method()
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases
raise RuntimeError("Too many ID ranges\n")
RuntimeError: Too many ID ranges
2021-12-27T17:56:04Z DEBUG [error] RuntimeError: Too many ID ranges
2021-12-27T17:56:04Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 180, in execute
return_value = self.run()
File "/usr/lib/python3.6/site-packages/ipapython/install/cli.py", line 342, in run
return cfgr.run()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 360, in run
return self.execute()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 386, in execute
for rval in self._executor():
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 655, in _configure
next(executor)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 431, in __runner
exc_handler(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 460, in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 518, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 515, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 450, in _handle_exception
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 421, in __runner
step()
File "/usr/lib/python3.6/site-packages/ipapython/install/core.py", line 418, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/usr/lib/python3.6/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python3.6/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/__init__.py", line 603, in main
replica_install(self)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 401, in decorated
func(installer)
File "/usr/lib/python3.6/site-packages/ipaserver/install/server/replicainstall.py", line 1371, in install
adtrust.install(False, options, fstore, api)
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrust.py", line 483, in install
smb.create_instance()
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 895, in create_instance
self.start_creation(show_service_name=False)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 635, in start_creation
run_step(full_msg, method)
File "/usr/lib/python3.6/site-packages/ipaserver/install/service.py", line 621, in run_step
method()
File "/usr/lib/python3.6/site-packages/ipaserver/install/adtrustinstance.py", line 380, in __add_rid_bases
raise RuntimeError("Too many ID ranges\n")
2021-12-27T17:56:04Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Too many ID ranges
2021-12-27T17:56:04Z ERROR Too many ID ranges
1 year, 2 months
[pam] [sss_dp_on_reconnect] (0x0010): Could not reconnect to provider.
by Alexander Becker
Hello all,
since some time we have some cases where a sssd login does not work anymore and a service restart is necessary. According to analysis, there is a high disk and CPU usage at that time.
Affected are clients with Ubuntu 20.04
sssd 2.2.3
freeipa 4.8.6
We get the following error messages:
sssd_pam.log
[pam] [sss_dp_on_reconnect] (0x0010): Could not reconnect to ad.server provider.
auth.log
pam_sss(sshd:account): Access denied for user monitor: 4 (System error)
sshd[3126935]: fatal: Access denied for user monitor by PAM account configuration [preauth].
Does anyone have any ideas?
1 year, 2 months
2FA - prompting - single_prompt
by Winfried de Heiden
Hi all,
Using FreeIPA, 2FA can be made optional by enabling "Password" AND "Two
factor authentication (password + OTP)" for a user. For particular hosts
the 2FA now can be made mandatory by enabling "Two factor authentication
(password + OTP)"
Now, for hosts for which 2FA is NOT mandatory, according to the man
pages, 2FA can be made "invissible" by using the "single_prompt" option.
In man sssd.conf:
"If the second factor is optional and it should be possible to log in
either only with the password or with both factors two-step prompting
has to be used."
However, this doesn't work. When using the "single_prompt" login will
fail. Using two prompts, and just press enter for the second 2FA prompt,
login will succeed.
Hence: did I forget something or is there a bug involved?
FYI: tested on CentOS Stream9
--
email handtekening privé Met vriendelijke groet,
Winfried de Heiden
wdh(a)dds.nl
1 year, 2 months
ipa-ca-install rejects confirmed correct DM password
by Chris Candreva
My problem is what the subject says. Most of the searches I've found are
what to do when you don't know the Directory Manager password. However I
can confirm it is correct with ldapsearch, yet ipa-ca-install says it is
wrong. I'd appreciate any hints as to where to look next.
[root@ipa3 chris]# export DMP=<pasword>
[root@ipa3 chris]# ldapsearch -x -D "cn=directory manager" -w $DMP -s base -b "" "objectclass=*" | head
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: objectclass=*
# requesting: ALL
#
#
dn:
[root@ipa3 chris]# ipa-ca-install --password=$DMP
Directory Manager password is invalid
--
---
========================================================================
Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris
1 year, 2 months