November 2023 - FreeIPA-users - Fedora mailing-lists

FreeIPA users can't run processes within scope units on Fedora 39
by Sam Morris 15 Nov '23

15 Nov '23

I've just installed a Fedora 39 system and joined it to my IPA domain. I've found that when an IPA user connects with SSH, they can't launch podman rootless containers, nor can they create scope units. Local users are unaffected, hence I thought I'd post here in the hope that someone else can reproduce the error and/or can suggest additional troubleshooting steps. Here's what systemd logs when I try run 'systemd-run --user --scope echo hello': Nov 15 08:52:15 systemd[6789]: run-r340eeb2a10484700937e131eaa242301.scope: Couldn't move process 127204 to requested cgroup '/user.slice/user-1673000001.slice/user@1673000001.service/app.slice/run-r340eeb2a10484700937e131eaa242301.scope' (directly or via the system bus): Input/output error Nov 15 08:52:15 systemd[6789]: run-r340eeb2a10484700937e131eaa242301.scope: Failed to add PIDs to scope's control group: Permission denied Nov 15 08:52:15 systemd[6789]: run-r340eeb2a10484700937e131eaa242301.scope: Failed with result 'resources'. Nov 15 08:52:15 systemd[6789]: Failed to start run-r340eeb2a10484700937e131eaa242301.scope - /usr/bin/echo hello. Full details are at <https://bugzilla.redhat.com/show_bug.cgi?id=2249514>. -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 2

Help with permissions on new objects/attributes
by Francis Augusto Medeiros-Logeay 14 Nov '23

14 Nov '23

Hi, As I mentioned earlier, I am creating a plugin. My plugin creates the following container: # postfixadmin, mailserver, etc, ipa.test dn: cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test objectClass: top objectClass: nsContainer cn: postfixadmin Domain entries are like this: # ipa.test, postfixadmin, mailserver, etc, ipa.test dn: cn=ipa.test,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=test cn: ipa.test objectClass: postfixDomain objectClass: nsContainer objectClass: top Mailboxes are under a domain: # francis, ipa.test, postfixadmin, mailserver, etc, ipa.test dn: uid=francis,cn=ipa.test,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=te st uid: francis givenName: francis sn: Medeiros-Logeay objectClass: postfixMailbox objectClass: person objectClass: inetOrgPerson objectClass: inetUser objectClass: top objectClass: organizationalPerson cn: francis Medeiros-Logeay postfixMailAddress: francis(a)ipa.test status: TRUE And finally aliases: # testing, ipa.test, postfixadmin, mailserver, etc, ipa.test dn: uid=testing,cn=ipa.test,cn=postfixadmin,cn=mailserver,cn=etc,dc=ipa,dc=te st uid: testing postfixMailDestination: francis(a)ipa.test status: FALSE objectClass: postfixAlias objectClass: top postfixMailAlias: testing(a)ipa.test However, when using ldapsearch with a system user and using cn=postfixadmin,cn=mailserver,cn=etc,$SUFFIX, I only get the top container and the domain. I don’t get any of the other entries. Doing the same with an admin gives me all the entries below the mentioned DN. I am confused about permissions, so I tried to add this to the class «Alias» on my plugin code: managed_permissions = { 'System: Read Mail Data': { 'ipapermlocation': DN(('cn', 'postfixadmin'), ('cn', 'mailserver'), ('cn', 'etc')), 'ipapermbindruletype': 'annonymous', 'ipapermtarget': DN(('cn', 'postfixadmin'), ('cn', 'mailserver'), ('cn', 'etc')), 'replaces_global_anonymous_aci': True, 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': { 'cn', 'objectclass', 'postfixMailAlias', 'postfixMailDestination','uid','dn' } } } It doesn’t seem to help. I also added an attribute to my users, called «postfixMailAddress». That attribute is also not visible to my system user, despite having added this to my code: user.managed_permissions = {**user.managed_permissions, **{ 'System: Read User Mail Attributes': { 'ipapermbindruletype': 'all ', 'ipapermright': {'read', 'search', 'compare'}, 'ipapermdefaultattr': { 'postfixMailAddress', 'status', 'mailquota' }, 'System: Modify User Mail Attributes': { 'ipapermbindruletype': 'permission', 'ipapermright': {'write', 'add', 'delete'}, 'ipapermdefaultattr': { 'postfixMailAddress', 'status', 'mailquota' } } }}} I’d love if someone could please point me to the right direction to manage these permissions so that my binding user can see attributes and entries. Best, Francis

3 9

Old Clients
by Justin Sanderson 13 Nov '23

13 Nov '23

All - I've posted here before a while back. Long story short, I inherited a FreeIPA server and am now looking at building out a more robust environment. Two things I'd like to ask some input for: 1) Is there a way to determine when a client was last used for authentication? I'm looking at a list of about 1500 client systems - majority of which I'm sure haven't been used (retired client systems, etc.) in a decent amount of time. I'd like to clean these systems up so I have a more accurate representation of what is actually authenticating against my IDM. 2) After cleanup, I'm interested in building a replica (or two) to facilitate and upgrade. The current server is CentOS 7. We've had numerous problems from this server and would like to upgrade to a more supported/newer version of OS and IDM software. a) Is it possible to install a replica server as RHEL9 IDM server from my existing CentOS 7 server? Essentially, what I'd like to occur is we use the RHEL9 replica as a means to "migrate" and upgrade the existing services and eventually poweroff the original Cent7 server. The replica installation process seems to be fairly straight-forward, but I was wondering if anyone out there has tried this before and any painful "lessons learned" after the upgrade/migration... Any help or insight would be appreciated. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

2 2

aes256-sha2
by Charles Hedrick 13 Nov '23

13 Nov '23

If I wanted to using aes256-sha2 for tickets by default, how would I do that? I've verified that our KDC can issue service tickets for that if I specify -e aes256-sha2 with ipa-getkeytab, but kinit and everything else seems to use older encryptioni types.

1 0

[SSSD] Announcing SSSD 2.9.3
by Pavel Březina 13 Nov '23

13 Nov '23

# SSSD 2.9.3 The SSSD team is announcing the release of version 2.9.3 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.3 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.3.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights ### General information * The proxy provider is now able to handle certificate mapping and matching rules and users handled by the proxy provider can be configured for local Smartcard authentication. Besides the mapping rule local Smartcard authentication should be enabled with the 'local_auth_policy' option in the backend and with 'pam_cert_auth' in the PAM responder. ### Important fixes Passkey doesn't fail when using FreeIPA server-side authentication and require-user-verification=false. ### New features * When adding a new credential to KCM and the user has already reached their limit, the oldest expired credential will be removed to free some space. If no expired credential is found to be removed, the operation will fail as it happened in the previous versions.

1 0

New plugin - freeipa-postfixadmin
by Francis Augusto Medeiros-Logeay 12 Nov '23

12 Nov '23

Hi, I have finished writing a plugin to easily administrate postfix/dovecot accounts from FreeIPA: https://github.com/oculos/freeipa-postfixadmin/tree/main oculos/freeipa-postfixadmin: A FreeIPA plugin for mimicking PostfixAdmin functionality github.com There is already a very well written plugin (https://github.com/Carbenium/freeipa-mailserver/tree/master) that does much of what my plugin does (and much more elegantly), but my main goal was to replicate the way Postfixadmin presents data. There is a few stuff to do with this plugin. I need to hide some actions on the User’s Actions menu (such as create or delete, when the user already has or doesn’t have a mailbox). «enable_cond» didn’t work for me. I would be happy if someone else does the permissions part. Since I use freeIpa mostly on my homelab, so fine grained permissions was not a priority, but it might be to people. I also didn’t add an interface for changing passwords for the mailboxes that aren’t a «user» (ie., under cn=users). I might use Keycloak for that. I’ll focus on create postfix/dovecot configurations and will update the repo when that happens. Best, Francis

1 0

New plugin almost ready - postfixadmin
by Francis Augusto Medeiros-Logeay 12 Nov '23

12 Nov '23

Hi, I have almost finished a plugin for FreeIPA, so that admins can have similar functionality found on Postfix Admin. https://github.com/oculos/freeipa-postfixadmin/blob/main/README.md freeipa-postfixadmin/README.md at main · oculos/freeipa-postfixadmin github.com There is already a good plugin that does a bit of that, but the goal is a bit different. My main goal is not to mix up postfix configuration with groups and hosts, but have separate entities for domain, aliases and virtual domains, in addition to mailboxes. It was written mostly to allow me to migrate my mailboxes from MySQL to FreeIPA, and I don’t have a huge postfix configuration - I only have multiple domains, mailboxes, aliases and virtual domains, so that’s the functionality I wanted with this plugin. There are a few things missing before this can go in production («production» here means to actually migrate my mailboxes to FreeIPA), adding a mailbox to ipa users on the gui being the most important one. I would appreciate any comments and feedbacks regarding this plugin. It wasn’t easy to understand the logic on how to write one, but I got the hang of it (for simple stuff). Best, Francis

2 3

[FOSDEM] [CfP] Identity and Access Management devroom at FOSDEM 2024
by Iker Pedrosa 10 Nov '23

10 Nov '23

Hi! It is a great pleasure to announce a devroom dedicated to Identity and Access Management at FOSDEM 2024. The last devroom at FOSDEM dedicated to this topic was in 2018 and we would like to replicate that success. Original FOSDEM CfP below. I think there are enough interesting developments and uses of FreeIPA in different environments that it is worth presenting at this event. Consider submitting a talk proposal if you are planning to attend FOSDEM! Deadline is December 1st, 2023. Original CfP Hi! This is a call for proposals for the Identity and Access Management Devroom: https://iam-devroom.github.io/fosdem-2024/ # Identity and Access Management Devroom @ FOSDEM'2024 [FOSDEM 2024](https://fosdem.org/2024/) will have a [identity and access management devroom](https://fosdem.org/2024/schedule/track/identity_and_access_managem…. The IAM devroom is planned to be run at **Sunday, February 4th, 2024** in Brussels, Belgium at [ULB](http://www.ulb.ac.be/). ## Our topics this year This is the Identity and Access Management Devroom and we invite you to submit a talk that is relevant to operating systems' identity and access management in the free software and open source world. We don't exclude any relevant submission, for ideas and suggestions please check the previous edition of IAM devroom at [FOSDEM 2018](https://archive.fosdem.org/2018/schedule/track/identity_and_access_ma… Suggested topics: - Security: algorithms and protocols for IAM/IdM; passwords and password alternatives - Federated and social identity; leveraging external identities in applications - Audit, compliance, monitoring - User experience, desktop integration - Free software IAM/IdM offerings - IAM/IdM deployment reports and more. Don't be shy and show how your project helps to improve our lives. ## Submissions Submissions require a small abstract and a short speaker description and must be submitted [via the Pretalx system](https://fosdem.org/submit) no later than **1st of December 2023**. Suggested duration for a timeslot to apply for is **25 minutes** (20 min presentation + 5 mins questions). The schedule shall be finalized by **15 December 2023**. Note that this is a new submission system and accounts from pentabarf were not migrated: Presenters will have to create a new account. Instructions: * Go to [https://fosdem.org/submit](https://fosdem.org/submit) * Register a new account * Create a new event with your title and abstract and some information about you * Be sure to set the event track to "Identity and Access Management devroom" * Subscribe to the [iam-devroom at lists.fosdem.org <https://lists.fosdem.org/listinfo/fosdem>](https://lists.fosdem.org/listinfo/iam-devroom) mailing list for announcements ### Organizers * You! - any help with organizing is highly appreciated! * Alexander Bokovoy (ab at samba.org <https://lists.fosdem.org/listinfo/fosdem>) * Iker Pedrosa (ipedrosa at redhat.com <https://lists.fosdem.org/listinfo/fosdem>) -- Iker Pedrosa Senior Software Engineer, Identity Management team Red Hat <https://www.redhat.com> Txapela (gorria) buruan eta ibili munduan (Red) hat on his head and walk the world Basque proverb <https://www.redhat.com>

1 0

Allow sysaccount to view its own entry
by Adam Bishop 09 Nov '23

09 Nov '23

I have a piece of software that tries to look up its own uid to check that LDAP is correctly configured. This check fails because the sysaccount cannot view anything under cn=etc,cn=sysaccounts. Is there an existing permission/privilege that I can use to allow it to read the sysaccounts tree (or better, just its own entry)? Many Thanks, Adam Bishop

4 3

Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC
by Alexander Bokovoy 09 Nov '23

09 Nov '23

On Пан, 06 ліс 2023, Kroon PC, Peter wrote: >Hi all, > >thanks for the response, and my apologies for my slow reply -- life happened. >I put my responses inline. It seems that the ldapupdate file you provided generated a SID config. Thanks. It is hard to read your inline responses as they went without proper quoting but I think I understood what you wanted to show. You still need to add an ID range that covers your actual POSIX IDs. Without that we wouldn't able to generate SIDs either. After an ID range is added, `ipa config-mod --enable-sid --add-sids` should fix the rest. > >Peter > > >________________________________________ >Van: Alexander Bokovoy <abokovoy(a)redhat.com> >Verzonden: donderdag 26 oktober 2023 16:59 >Aan: Kroon PC, Peter >CC: Rob Crittenden; FreeIPA users list >Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC > >On Чцв, 26 кас 2023, Kroon PC, Peter wrote: >>Hi Alexander and Rob, >> >>many thanks for your prompt responses :) >>I made a new lxc machine and restored a backup so at least I have a working environment again. I kept the borken one for further investigation which I'll use to provide more information. >>I'm not super comfortable using mailing lists, and I'm not sure whether my mail client (outlook) will mangle my inline responses. >> >>Peter >> >>________________________________________ >>Van: Alexander Bokovoy <abokovoy(a)redhat.com> >>Verzonden: woensdag 25 oktober 2023 20:49 >>Aan: Rob Crittenden >>CC: FreeIPA users list; Kroon PC, Peter >>Onderwerp: Re: [Freeipa-users] Re: ipa CLI doesn't work due to revoked TGT following S4U2PROXY_NO_HEADER_PAC >> >>On ��, 25 �� 2023, Rob Crittenden wrote: >>>Alexander Bokovoy via FreeIPA-users wrote: >>>> On ��, 25 �� 2023, Kroon PC, Peter via FreeIPA-users wrote: >>>>> Hi all, >>>>> >>>>> After upgrading to Rocky linux 9.2 I'm running into issues with my IPA >>>>> server (4.10.1-9.el9_2). In particular, my IPA CLI seems FUBARred: >>>>> >>>>> $ kinit admin >>>>> Password for admin(a)EXAMPLE.COM: >>>>> $ ipa show-user admin >>>>> ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI >>>>> Error: No credentials were supplied, or the credentials were >>>>> unavailable or inaccessible (Credential cache is empty) >>>>> >>>>> /var/log/krb5kdc.log: >>>>> okt 24 16:17:48 freeipa.example.com krb5kdc[10493]: TGS_REQ (4 etypes >>>>> {aes256-cts-hmac-sha1-96(18), aes256-cts-hmac-sha384-192(20), >>>>> aes128-cts-hmac-sha256-128(19), aes128-cts-hmac-sha1-96(17)}) >>>>> 192.168.12.57: S4U2PROXY_NO_HEADER_PAC: authtime 0, etypes >>>>> {rep=UNSUPPORTED:(0)} HTTP/freeipa.example.com(a)EXAMPLE.COM for >>>>> ldap/freeipa.example.com(a)EXAMPLE.COM, TGT has been revoked >>>>> >>>>> As the log shows, the KDC states there is no PAC, and therefore revokes >>>>> the TGT (note, I had to RTFS to decipher the S4U2PROXY_NO_HEADER_PAC). >>>>> Because of this, the web gui also doesn't work. >>>> >>>> That is correct description of the reason why it does not work. >>>> >>>>> >>>>> $ ldapsearch -Y GSSAPI -b cn=users,cn=accounts,dc=example,dc=nl >>>>> "ipaNTSecurityIdentifier=*" uid ipaNTSecurityIdentifier >>>>> SASL/GSSAPI authentication started >>>>> SASL username: admin(a)EXAMPLE.COM >>>>> SASL SSF: 256 >>>>> SASL data security layer installed. >>>>> # extended LDIF >>>>> # >>>>> # LDAPv3 >>>>> # base <cn=users,cn=accounts,dc=example,dc=com> with scope subtree >>>>> # filter: ipaNTSecurityIdentifier=* >>>>> # requesting: uid ipaNTSecurityIdentifier >>>>> # >>>>> >>>>> # admin, users, accounts, example.com >>>>> dn: uid=admin,cn=users,cn=accounts,dc=example,dc=com >>>>> uid: admin >>>>> ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440-500 >>>>> >>>>> # search result >>>>> search: 4 >>>>> result: 0 Success >>>>> >>>>> # numResponses: 2 >>>>> # numEntries: 1 >>>>> >>>>> Out of the ~200 or so users only the admin user has a >>>>> ipaNTSecurityIdentifier, but I don't know if it's correct... >>>>> I can't run `ipa config-mod --enable-sid --add-sids`, since my ipa CLI >>>>> is broken. I do still have LDAP access fortunately. >>>> >>>> You can run it, see below. If you'd run, do you have any error messages in >>>> the dirsrv errors log related to sidgen plugin? >>>> >>>>> >>>>> I tried to set `disable_pac = true` in /var/kerberos/krb5kdc/kdc.conf, >>>>> but that results in the exact same error. Setting ipaKrbAuthzData=None >>>>> in cn=ipaConfig also has no effect. >>>> >>>> No, one cannot disable PAC globally in FreeIPA. S4U operations >>>> require PAC presence since last year, so for any real Kerberos service >>>> that uses S4U (like IPA API or web UI) one cannot disable PAC >>>> enforcement. >> >>This is useful information :) >> >>>> >>>> Look at your ID range and SID configuration. You can avoid admin issue >>>> currently by running 'ipa' tool on IPA server as root with '-e >>>> in_server=true' option. This will force the tool to simulate direct >>>> access (as if it is running within httpd) and talk directly to LDAPI >>>> socket. >>>> >>>> Something like below: >>>> >>>> # KRB5CACHE=/dev/null ipa -e in_server=true trustconfig-show >>>> ipa: WARNING: API Version number was not sent, forward compatibility not >>>> guaranteed. Assuming server's API version, 2.253 >>>> Domain: ipa1.test >>>> Security Identifier: S-1-5-21-790702333-3825749031-3739951824 >>>> NetBIOS name: IPA1 >>>> Domain GUID: 529fcbe9-3e34-436d-a541-6ffa88e7dac1 >>>> Fallback primary group: Default SMB Group >>>> IPA AD trust agents: master1.ipa1.test >>>> IPA AD trust controllers: master1.ipa1.test >> >>KRB5CACHE=/dev/null ipa -e in_server=true trustconfig-show >>ipa: ERROR: : trust configuration not found > >Ok, let's try differently. Can you provide output of > ># ldapsearch -Y EXTERNAL -H ldapi://%2Frun%2Fslapd-EXAMPLE-COM.socket \ > -b cn=ad,cn=etc,dc=example,dc=com > >(replace EXAMPLE-COM and dc=example,dc=com by your domain data) > >dn: cn=ad,cn=etc,dc=example,dc=com >objectClass: nsContainer >objectClass: top >cn: cn >cn: ad >> >> >>>> >>>> # KRB5CACHE=/dev/null ipa -e in_server=true idrange-find >>>> ipa: WARNING: API Version number was not sent, forward compatibility not >>>> guaranteed. Assuming server's API version, 2.253 >>>> ---------------- >>>> 5 ranges matched >>>> ---------------- >>>> Range name: IPA1.TEST_id_range >>>> First Posix ID of the range: 1055600000 >>>> Number of IDs in the range: 200000 >>>> First RID of the corresponding RID range: 1000 >>>> First RID of the secondary RID range: 100000000 >>>> Range type: local domain range >>>> >>>> ... [ skip ] ... >>>> >>>> >> >>ipa: WARNING: API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.251 >>---------------- >>2 ranges matched >>---------------- >> Range name: EXAMPLE.COM_id_range >> First Posix ID of the range: 1000 >> Number of IDs in the range: 4000 >> Range type: local domain range > >This one is definitely not configured to handle SIDs. Also, see my >comment at the bottom of this email. > >> >> Range name: EXAMPLE.COM_subid_range >> First Posix ID of the range: 2147483648 >> Number of IDs in the range: 2147352576 >> First RID of the corresponding RID range: 2147479648 >> Domain SID of the trusted domain: S-1-5-21-738065-838566-2966017632 >> Range type: Active Directory domain range >>---------------------------- >>Number of entries returned 2 >>---------------------------- >> >>> >>>In my testing you can't run config-mod without a principal, and running >>>in-server does not have a principal. >>> >>># KRB5CACHE=/dev/null ipa -e in_server=true config-mod --add-sids >>>--enable-sid >>>[snip] >>> File "/usr/lib/python3.11/site-packages/ipaserver/plugins/config.py", >>>line 701, in pre_callback >>> self._enable_sid(ldap, options) >>> File "/usr/lib/python3.11/site-packages/ipaserver/plugins/config.py", >>>line 512, in _enable_sid >>> if not principal_has_privilege(self.api, context.principal, privilege): >>> ^^^^^^^^^^^^^^^^^ >>>AttributeError: '_thread._local' object has no attribute 'principal' >>>ipa: ERROR: an internal error has occurred >> >>Thank you, Rob. I did not check that part. >> >>On IPA master one can run the oddjobd-activated script directly: >> >># /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids >> >>$ /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --add-sids >>Configuring SID generation >> [1/8]: creating samba domain object >> [error] TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None) >>('Tuple_to_LDAPMod(): expected a byte string in the list', None) >>The ipa-enable-sid command failed. See /var/log/ipaserver-enable-sid.log for more information >> >>Python traceback from the log: >>2023-10-26T13:24:21Z DEBUG Traceback (most recent call last): >> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation >> run_step(full_msg, method) >> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step >> method() >> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 485, in __create_samba_domain_object >> api.Backend.ldap2.add_entry(entry) >> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1893, in add_entry >> super(LDAPCache, self).add_entry(entry) >> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1659, in add_entry >> self.conn.add_s(str(entry.dn), list(attrs.items())) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s >> return self.add_ext_s(dn,modlist,None,None) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 221, in add_ext_s >> msgid = self.add_ext(dn,modlist,serverctrls,clientctrls) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 218, in add_ext >> return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls)) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call >> result = func(*args,**kwargs) >>TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None) >> >>2023-10-26T13:24:21Z DEBUG [error] TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None) >>2023-10-26T13:24:21Z DEBUG Destroyed connection context.ldap2_140617190554016 >>2023-10-26T13:24:21Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 180, in execute >> return_value = self.run() >> File "/usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid", line 68, in run >> smb.create_instance() >> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 913, in create_instance >> self.start_creation(show_service_name=False) >> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 686, in start_creation >> run_step(full_msg, method) >> File "/usr/lib/python3.9/site-packages/ipaserver/install/service.py", line 672, in run_step >> method() >> File "/usr/lib/python3.9/site-packages/ipaserver/install/adtrustinstance.py", line 485, in __create_samba_domain_object >> api.Backend.ldap2.add_entry(entry) >> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1893, in add_entry >> super(LDAPCache, self).add_entry(entry) >> File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1659, in add_entry >> self.conn.add_s(str(entry.dn), list(attrs.items())) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s >> return self.add_ext_s(dn,modlist,None,None) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 221, in add_ext_s >> msgid = self.add_ext(dn,modlist,serverctrls,clientctrls) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 218, in add_ext >> return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls)) >> File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call >> result = func(*args,**kwargs) >> >>2023-10-26T13:24:21Z DEBUG The ipa-enable-sid command failed, exception: TypeError: ('Tuple_to_LDAPMod(): expected a byte string in the list', None) >> >> >>I still need to see ID range and trustconfig-show output to understand >>the state of this deployment. Also, dirsrv errors log would be helpful >>if there was an attempt to run sidgen in past. >> >>I went through the dirsrv logs, and found the following: >>[24/Oct/2023:10:25:34.071341978 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 194]: Sidgen task starts ... >>[24/Oct/2023:10:25:34.300104111 +0000] - ERR - find_sid_for_ldap_entry - [file ipa_sidgen_common.c, line 522]: Cannot convert Posix ID [52021] into an unused SID. >>[24/Oct/2023:10:25:34.300266490 +0000] - ERR - do_work - [file ipa_sidgen_task.c, line 154]: Cannot add SID to existing entry. >>[24/Oct/2023:10:25:34.303536359 +0000] - ERR - sidgen_task_thread - [file ipa_sidgen_task.c, line 199]: Sidgen task finished [32]. > >You have a range that defines UID/GID space of [1000...5000] but IDs are >outside this range. This is pretty much wrong regardless of whether we >enforce SIDs or not ;) > >You need to create a separate ID range that would cover your existing >IDs. Before that, we need to create a configuration to be used for SID >generation -- if the ldapsearch above would show us that the entry in >cn=ad,cn=etc,$SUFFIX does not exist. > >Since ipa-enable-sid has failed, probably the entry indeed does not exist and >it would be easier to construct it with ipa-ldap-updater tool: > >---- >dn: cn=${DOMAIN},cn=ad,cn=etc,${SUFFIX} >default:objectClass: ipaNTDomainAttrs >default:objectClass: nsContainer >default:objectClass: top >default:cn: ${DOMAIN} >default:ipaNTFlatName: NETBIOSNAME >default:ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440 >default:ipaNTDomainGUID: 529fcbe9-3e34-3122-a541-6786236014c1 >default:ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,${SUFFIX} >---- > >Change 'NETBIOSNAME' above to some name. By default that would be a >first part of your Kerberos realm, e.g. for IPA1.TEST that would be >IPA. > >The SID value (S-1-5-21-...) is the one that your admin user has, >without the last part (relative identifier, RID, which is -500 for >administrator case). > >Save this to a file named '90-somefile.update' and run as root > ># ipa-ldap-updater ./90-somefile.update > > >Alright, it said "update successful". The ldapsearch above now produces: ># ad, etc, example.com >dn: cn=ad,cn=etc,dc=example,dc=com >objectClass: nsContainer >objectClass: top >cn: cn >cn: ad > ># example.com, ad, etc, example.com >dn: cn=example.com,cn=ad,cn=etc,dc=example,dc=com >objectClass: ipaNTDomainAttrs >objectClass: nsContainer >objectClass: top >cn: example.com >ipaNTFlatName: MYNETBIOSNAME >ipaNTSecurityIdentifier: S-1-5-21-3777974847-1414448952-306354440 >ipaNTDomainGUID: 529fcbe9-3e34-3122-a541-6786236014c1 >ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,dc=example,dc=com > >-- >/ Alexander Bokovoy >Sr. Principal Software Engineer >Security / Identity Management Engineering >Red Hat Limited, Finland > -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2023