IdM with trust relationship with Samba AD DC - User accounts with passwords expired
by Mateo Duffour
Hi,
We currently have an IdM installation with a trust relationship with a Samba AD DC. Our user accounts reside on Samba AD DC, we dont have user accounts on IdM.
We are having a problem with Samba user acounts that have its passwords expired.
When we try to login with an ubuntu IdM client with one of those accounts, it fails and asks again for password.
The behaviour we are expecting is that Ubuntu should ask for a password change.
Thanks, best regards.
Lic. Mateo Duffour
Unidad Informática
2901.40.91
[ http://maps.apple.com/?q=18%20de%20julio%20985%20-%20Piso%204,Montevideo,... | 18 de julio 985 - Piso 3, Montevideo, Uruguay ]
[ http://www.fnr.gub.uy/ | ]
No me imprimas si no es necesario. Protejamos el medio ambiente. Este mensaje y la información adjunta al mismo está dirigido exclusivamente a su destinatario. Puede contener información confidencial, privilegiada o de uso restringido, protegida por las normas. Si Ud. recibió este e-mail por error, por favor, sírvase notificarle a quien se lo envió y borrar el original. Cualquier otro uso del e-mail por Ud. está prohibido.
1 week
Broken ipa replica
by Giulio Casella
Hi everyone,
I'm stuck with a broken replica. I had a setup with two ipa server in
replica (ipa-server-4.6.4 on CentOS 7.6), let's say "idc01" and "idc02".
Due to heavy load idc01 crashed many times, and was not working anymore.
So I tried to redo the replica again. At first I tried to
"ipa-replica-manage re-initialize", with no success.
Now I'm trying to redo from scratch the replica setup: on idc02 I
removed the segments (ipa topologysegment-del, for both ca and domain
suffix), on idc01 I removed everything (ipa-server-install --uninstall),
then I joined domain (ipa-client-install), and everything is working so far.
When doing "ipa-replica-install" on idc01 I get:
[...]
[28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 22 seconds elapsed
[ldap://idc02.my.dom.ain:389] reports: Update failed! Status: [Error
(-11) connection error: Unknown connection error (-11) - Total update
aborted]
And on idc02 (the working server), in
/var/log/dirsrv/slapd-MY-DOM-AIN/errors I find lines stating:
[20/Mar/2019:09:28:06.545187923 +0100] - INFO - NSMMReplicationPlugin -
repl5_tot_run - Beginning total update of replica
"agmt="cn=meToidc01.my.dom.ain" (idc01:389)".
[20/Mar/2019:09:28:26.528046160 +0100] - ERR - NSMMReplicationPlugin -
perform_operation - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Failed
to send extended operation: LDAP error -1 (Can't contact LDAP server)
[20/Mar/2019:09:28:26.530763939 +0100] - ERR - NSMMReplicationPlugin -
repl5_tot_log_operation_failure - agmt="cn=meToidc01.my.dom.ain"
(idc01:389): Received error -1 (Can't contact LDAP server): for total
update operation
[20/Mar/2019:09:28:26.532678072 +0100] - ERR - NSMMReplicationPlugin -
release_replica - agmt="cn=meToidc01.my.dom.ain" (idc01:389): Unable to
send endReplication extended operation (Can't contact LDAP server)
[20/Mar/2019:09:28:26.534307539 +0100] - ERR - NSMMReplicationPlugin -
repl5_tot_run - Total update failed for replica
"agmt="cn=meToidc01.my.dom.ain" (idc01:389)", error (-11)
[20/Mar/2019:09:28:26.561763168 +0100] - INFO - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=meToidc01.my.dom.ain" (idc01:389):
Replication bind with GSSAPI auth resumed
[20/Mar/2019:09:28:26.582389258 +0100] - WARN - NSMMReplicationPlugin -
repl5_inc_run - agmt="cn=meToidc01.my.dom.ain" (idc01:389): The remote
replica has a different database generation ID than the local database.
You may have to reinitialize the remote replica, or the local replica.
It seems that idc02 remembers something about the old replica.
Any hint?
Thank you in advance,
Giulio
2 weeks, 2 days
DNS record with all IPA servers
by Boris Behrens
Hi,
I am currently trying to cleanup our IPA installation and saw that all our
clients only got a single server configured, which doesn't sound good.
(we've currently got two IPA servers).
Is there some sort of record that can be used?
root@host1:/etc/ipa# cat /etc/ipa/default.conf
#File modified by ipa-client-install
[global]
basedn = dc=domain,dc=ca
realm = DOMAIN.CA
domain = DOMAIN.CA
server = ipa1.domain.ca
xmlrpc_uri = https://ipa1.domain.ca/ipa/xml
enable_ra = True
Cheers
Boris
--
Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im
groüen Saal.
1 month, 1 week
certs: SAN without othername / NT Principal name
by David Harvey
Hi FreeiPA users,
I'm having great fun with a web app that hates the othername/ NT Principal
name included with certificates generated with ipa-getcert.
I've tried several variations but can't omit this part of the subject
alternative name. Is there any way to do so?
Thanks in advance,
David
1 month, 3 weeks
geo replication - ? - concept of
by lejeczek
Hi guys.
This must have been asked/covered somewhere I think, as it
must be trivial concept/question many must have wondered -
can IPA, in supported manner with built-in way or not, do
'geo-repliacation' in some sense?
What I wonder specifically is - call it a secondary, backup
or a mirror site(of whole domain) which would _only_
receive(possibly synchronously) and be read-only but!...
that direction, the flow of main/primary -> secondary/backup
could be flipped, reversed(in relatively non-time consuming way)
Anybody done or contemplated such or similar thing and care
to share some thoughts?
many thanks, L.
1 month, 3 weeks
ipa-ca DNS record - ?
by lejeczek
Hi guys.
What is 'ipa-ca' for and what should it point to?
Also, should IPA change that record ever?
Reason I ask - from the docs as I understand - it should
point to all CA servers in the domain, but it not happening.
many thanks, L.
1 month, 3 weeks
upgrade to FreeIPA 4.7+ from 4.6
by Ivars Strazdins
Hello,
I am planning FreeIPA servers’ upgrade from Centos 7 with FreeIPA 4.6.8 to Alma Linux 8.5.
Can I just take out replicas one by one and install fresh Alma Linux, then add back with latest FreeIPA on that replica?
Or do I have to take some special precautions?
If FreeIPA version compatibility is not a concern, perhaps it is even possible to do in-place upgrade with ELevate <https://wiki.almalinux.org/elevate/> (Leapp utility) ?
Thank you in advance,
Ivars Strazdins
1 month, 3 weeks
Unable to create AD trust
by Jeremy Tourville
Hello
I am running CentOS 7.9
FreeIPA 4.6.8
Installed with integrated DNS and CA
A replica will be installed after the trust is established with the AD domain.
When trying to create a trust with AD i get the following error message (it seems to be somewhat random but goes back and forth between these two)
Fetching domains from trusted forest failed
OR
ipa: ERROR: cannot connect to 'https://<server>/ipa/session/json': Gateway Timeout
I have done the following to troubleshoot:
- disable Selinux, which makes no difference
- check firewall ports. for your reference I have the following defined
services: freeipa-ldap, freeiipa-ldaps, http, https, kerberos, ntp, dns, ssh
ports: 749/tcp, 7389/tcp, 8005/tcp, 8009/tcp
- check DNS, it all verifies properly according to 5.2.1.2 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
- enabled debugging per https://www.freeipa.org/page/Active_Directory_trust_setup#Establish_and_v...
- disabled DNSSEC per https://access.redhat.com/solutions/2263991
I do see something of interest in the error_log but I am not sure if this is the problem.
wsgi:error Timeout when reading response headers from daemon process 'ipa': /usr/share/ipa/wsgi.py
ipa: ERROR: Failed to call com.redhat.idm.trust.fetch_domains helper. DBus exception is org.freedesktop.DBus.Error.NoReply: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
ipa: ERROR: Helper fetch_domain was called for forest <forest_name_here>, return code is 2
Any assistance you can provide is appreciated!
1 month, 3 weeks
How to retrieve user's credentials from IPA database?
by Roger Seguin
We have a GUI-based computer program that drives an external device/machine.
By default our software only displays limited information on that external device.
However, when a power user (group defined in /etc) identifies himself by entering their credentials through our software GUI, our software then checks those credentials against /etc/shadow using crypt() and getspnam() and, if succesful, provides extra functions for configuring our external device/machine.
Actually, our software runs on several networked computers and our users, which are all local (defined in /etc), are duplicated on each computer.
This is not ideal and we would rather like to have all users managed by IPA in a central place (dedicated computer as the IPA server) with our software running in IPA clients. Therefore, our software won't be able to check users' credentials using the local /etc/shadow file anymore.
Basically, we would need to be able to query IPA programmatically (C language - or at least a shell script) to check that a username+password is correct.
How can we process?
Thanks
1 month, 3 weeks
possible to auth FreeIPA users against another LDAP server?
by Jarett DeAngelis
hi everyone,
I am trying (with great difficulty!) to do authn/authz both for an HPC cluster and a number of other Linux machines against our Okta directory service. Okta offers their "Advanced Server Access" product, which is *bonkers* expensive for the ~6 or 7 machines we need to auth with at $10K a year, and Aquera has a plugin for FreeIPA they maintain which will auth FreeIPA against Okta for another $10K a year. this is a small HPC lab and we're just trying to avoid as much credential proliferation as we can.
my hope is that FreeIPA can be configured to auth against Okta's "built in" LDAP service, which is fairly minimal but will validate passwords and return some basic information in response to queries like group membership. then I can join machines to FreeIPA, which will in turn auth against Okta to allow users to log in. is this possible?
thanks!
1 month, 3 weeks