renew op produces cert with CN=localhost
by Leo Galambos
Hello,
our FreeIPA was running with correct certificates for 2 years (subject
"CN=ipa.hq.company,O=HQ.COMPANY"). Unfortunately, the new certificates
(ocspSigningCert, auditSigningCert) were recreated with simple
"CN=localhost" (automatically), i.e. the original value
"CN=ipa.hq.company,O=HQ.COMPANY" was ignored by certmonger.
If you have some knowledge of the FreeIPA internals - can you point me
to the right direction, so that I could debug and/or fix this rotation
bug, please?
Thank you,
LG
certmonger-0.79.13-3.el8.x86_64
ipa-server-4.9.6-10.module+el8.5.0+13587+92118e57.x86_64
# getcert list
Request ID '20200324213127':
status: MONITORING
stuck: no
:
CA: IPA
issuer: CN=Certificate Authority,O=HQ.COMPANY
subject: CN=ipa.hq.company,O=HQ.COMPANY
expires: 2022-03-25 22:31:28 CET
principal name: krbtgt/HQ.COMPANY(a)HQ.COMPANY
key usage:
digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-pkinit-KPKdc
profile: KDCs_PKINIT_Certs
pre-save command:
post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert
track: yes
auto-renew: yes
Request ID '20210120221127':
status: MONITORING
stuck: no
:
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=HQ.COMPANY
subject: CN=localhost
expires: 2024-02-04 22:29:37 CET
key usage: digitalSignature,nonRepudiation
profile: caSignedLogCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"auditSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20210120221129':
status: MONITORING
stuck: no
:
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=HQ.COMPANY
subject: CN=localhost
expires: 2024-02-04 22:28:36 CET
eku: id-kp-OCSPSigning
profile: caOCSPCert
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert
"ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
<snip>
2 years, 2 months
No memberof attribute for external users
by Ruslan Valikhanov
I cannot get memberof attribute for external users from one-way trust with AD.
I have an external group ad_grafana_external with users adtest(a)adtest.local and adtest2(a)adtest.local from AD. This group is a member of group ad_grafana:
ldapsearch -W -D "uid=admin,cn=users,cn=accounts,dc=mytest,dc=local" '(cn=ad_grafana)' | grep member
member: cn=ad_grafana_external,cn=groups,cn=accounts,dc=mytest,dc=local
I can see that AD users are members of ad_grafana group:
getent group ad_grafana
ad_grafana:*:105800310:adtest2@adtest.local,adtest@adtest.local
But I cannot get memberof attribute for this external users:
# ldapsearch -W -D "uid=admin,cn=users,cn=accounts,dc=mytest,dc=local" '(uid=adtest2(a)adtest.local)'
# extended LDIF
#
# LDAPv3
# base <dc=mytest,dc=local> (default) with scope subtree
# filter: (uid=adtest2(a)adtest.local)
# requesting: ALL
#
# adtest2(a)adtest.local, users, compat, m.mcs.im
dn: uid=adtest2(a)adtest.local,cn=users,cn=compat,dc=mytest,dc=local
objectClass: posixAccount
objectClass: ipaOverrideTarget
objectClass: top
gecos: adtest2 adtest2
cn: adtest2 adtest2
uidNumber: 140601109
gidNumber: 140601109
homeDirectory: /home/adtest.local/adtest2
ipaAnchorUUID:: OlNJRDpTLTEtNS0yMS0yNjExMDg4Ny0yODU2MDIzNTY0LTI5MTIyOTUzNjYtMT
EwOQ==
uid: adtest2(a)adtest.local
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
Is it possible to add memberof attrubutes to external users?
This is needed to authenticate them in web applications such as Grafana and Gitlab in my case.
FreeIPA version: 4.6.8-5
OS: CentOS Linux release 7.7.1908 (Core)
2 years, 2 months
Re: ipa with duo
by John Desantis
Charles,
> Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time.
Yes, it is possible and we currently utilize DUO on restricted
systems. Our IPA domain consists of an AD Trust (bulk of users) and
IDM-only users.
HTH,
John DeSantis
Il giorno ven 11 feb 2022 alle ore 12:40 Charles Hedrick via
FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> ha scritto:
>
> Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time.
>
> I see that it's possible to raise the timeout. But is that safe to do? I'm wondering whether otpd is really designed to have lots of threads waiting for the user to respond.
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
2 years, 2 months
FreeIPA and AIX
by Ronald Wimmer
I was wondering if one can configure AIX in a way that trusted AD domain
users can be used to log in under AIX. We followed
https://www.freeipa.org/page/ConfiguringUnixClients but this guide seems
to be LDAP-only and AD users do not have a represenntation in FreeIPA's
LDAP directory.
Could someone please clarify if AD users could work or not?
Cheers,
Ronald
2 years, 2 months
How to disallow ldap query without authentication ?
by MERCIER Jonathan
Dear FreeIPA community and Dev Team,
We have installed some month ago freeipa throw ansible collection/role, and I see that we can query the LDAP to get registered user. For us it is a medium issue, I would like to know, how to allow LDAP query only through an authentication.
Did you have a wiki or a documentation for this ?
Thanks a lot
Best regards
2 years, 2 months
ipa with duo
by Charles Hedrick
Our campus uses DUO. We're wondering whether it's possible to use that from IPA. My main concern is that user interaction can take time.
I see that it's possible to raise the timeout. But is that safe to do? I'm wondering whether otpd is really designed to have lots of threads waiting for the user to respond.
2 years, 2 months
Use FreeIPA as a CA for web apps
by Peter Taylor
Hi all
The docs aren't 100% clear on this, how do I use the WebUI to sign a tls cert with the CA
I've tried adding via Authentication > Certificates > Certificates but it said it can't find the principal, and when I tick the add principal button, it says i cannot create a user principal
I have already added the domain name in Identity > Hosts, but this appears not to change anything
Any help would be greatly appreciated
Many Thanks
2 years, 2 months
Increasing SSSD primary-master reconnection interval
by Bill M
Hi there,
I've a primary and three secondary servers in the sssd.conf on my IPA clients. The failover works as expected, and from the logs I can see the client attempting to reconnect to the primary server every 5 minutes.
ipa_server = host1-ipa1
ipa_backup_server = host2-ipa1, host3-ipa1, host4-ipa1
Is there an option in sssd.conf to increase this 5 minute interval? So in case host1 and host2 are down, and current active server is host3, I'd like the sssd client to attempt a reconnect to the primary server (host1) every 15-20 minutes.
have a good day, thanks.
2 years, 2 months
Adding DNS on a replica
by Simon Matthews
I set up a replica server, but I omitted the "--setup-dns" option when installing the replica. Is there any way to add this, without uninstalling completely and re-installing?
2 years, 2 months
Monitoring for changes
by Yehuda Katz
We have an operational need to track the userClass attribute for our IPA
hosts over time, specifically in a git repository (don't ask).
I thought of several ways of doing this and I am looking for suggestions as
to the best option. I also want to make the smallest possible modifications
to FreeIPA.
1. Monitor the `cn=changelog` tree for changes affecting hosts. We would
keep the last date our script ran and query the tree for items more recent
than that. The major issue is that it doesn't look like you can query for
">=" against modifyTimestamp (at least, I get no results).
2. I found references to FreeIPA using `RFC 4533` instead of the old
changelog sync. It seems like that might have been superseded by RFC 3928,
but I can't find any documentation about that. I have also found references
to 389ds supporting Persistent Searches, but again there doesn't seem to be
great documentation. I am not sure I want to implement something without
documentation about it being a supported feature.
Both options 1 and 2 would probably need a full sync every so often to make
sure they didn't miss changes.
3. Create a FreeIPA plugin. This seems like overkill since I just need LDAP
data and we would need to make sure it gets installed on all of our systems.
4. Just schedule a normal LDAP query every so often (i.e. maybe once an
hour) and assume that changes aren't made so quickly that anything
important would be lost. I like this option least since I don't know that I
can trust that assumption.
Any thoughts about these (or other) methods?
Thank you,
- Y
2 years, 2 months