September 2023 - FreeIPA-users - Fedora mailing-lists

Certs expired, CA Unreachable
by Evan G 15 Sep '23

15 Sep '23

Good afternoon. We currently have FreeIPA v4.6.8 running on CentOS7. We have tried many of the solutions posted on this mailer however none have helped us bring the environment back online. Our current situation is as follows: - We have a single master / single CA with a total of 4 FreeIPA (2 in each site) servers in production. - Replication is not working between the master and secondaries. - The FreeIPA admin account password is working and we are able to kinit as admin - We can bring the IPA services online by rolling the clock back to before the HTTP cert expired, however the CA refuses to sign any of our cert requests -- giving a Kerberos authentication error when CURL'd - We are able to login to the HTTP interface with the services up and date rolled back, however we are unable to issue a new cert, we receive a 500 error in reaching the CA Happy to provide any other requested info but we've been troubleshooting this for 3 days straight and we're coming up empty on every avenue.

4 10

FreeIPA UID/GID Integration with Storage & Trusts
by Jeremy Tourville 14 Sep '23

14 Sep '23

We are running IPA ver 4.9.11 We are trying to integrate our storage system (from a large, well known vendor who shall be nameless) with our existing AD/IPA setup. We presently have a one way trust established with AD and it's working well. All of our user objects are in AD. We need the ability have synchronized UID/GID across all systems so that permissions do not cause issues or problems for our users. We'd like to know if creating a two way trust could enable IPA to write back UID/GID attributes to AD? We also know another approach is to create POSIX attributes in AD for every user and establish an AD trust with POSIX attributes. We also have a few other options to make this work but wanted to exhaust any possibilities within IPA first as they would be the easiest to implement. Thanks for feedback!

1 0

Anonymous vs authenticated LDAP queries to IDM
by Super Tony 13 Sep '23

13 Sep '23

Hi, I have an app that determines user access level by querying the IDM server for user group membership. I have been using anonymous bind, but that means I had to relax the ACI to allow that kind of query. By default if I query the IDM server for user's group membership using anonymous bind, I only get top level containers without the group membership details. What is the recommended way to approach this issue if I am trying to move away from anonymous bind but I also don't want to hard code user ID and password for making an authenticated query? Thanks in advance!

3 2

Re: A-record creation in during ipa-client-install
by Edward Valley 11 Sep '23

11 Sep '23

1 0

AIX - IPA group membership
by Ronald Wimmer 11 Sep '23

11 Sep '23

I can and use IPA users on an AIX client. As well as groups. But somehow group membership does not seem to be configured correctly... # id y179768 uid=1246660005(y179768) gid=1246660005(y179768) # lsgroup -R LDAP ipa-aix-g ipa-aix-g id=1246690508 users= registry=LDAP Anyone has a hint what could be misconfigured?

4 15

Unable to compile class for JSP during CA installation
by Konstantin Sapozhnikov 11 Sep '23

11 Sep '23

Hello! We cant't install IPA Replica on Oracle Linux Server 8.8. When I try to install ipa-ca-install receive in ipareplica-ca-install.log: Unable to compile class for JSPDescription The server encountered an unexpected condition that prevented it from fulfilling the request.Exception<pre>org.apache.jasper.JasperException: org.apache.jasper.JasperException: Unable to compile class for JSP Ok, I tried to install new ipa server and receive same problem at /var/log/ipaserver-install.log: [error] RuntimeError: CA configuration failed and Unable to compile class for JSP About 2 month ago I succesfully instaled IPA on same server with OEL 8, but now I can't. Also on server, that I used to month ago I see java-1.8.0-openjdk.x86_64, but on new server: java-1.8.0-openjdk.x86_64 and java-11-openjdk.x86_64 (selected). I tried choose java-1.8.0^ but no result...

2 2

IPA and cron(d)
by Ronald Wimmer 11 Sep '23

11 Sep '23

Hi, we found out that the behavior on our OL9 servers differs from the older ones. If a user should be able to use cron on a specific host (service in HBAC rule) this works on <OL8 servers. But on our OL9 servers an entry containing the respective user needs to exist in /etc/cron.allow on the server itself. Is this the desired behavior? Cheers, Ronald

2 1

[SSSD] Announcing SSSD 2.9.2
by Pavel Březina 07 Sep '23

07 Sep '23

# SSSD 2.9.2 The SSSD team is announcing the release of version 2.9.2 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.2 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.2.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users ## Highlights SSSD 2.9 branch is now in long-term maintenance (LTM) phase. ### General information * `libkrb5-1.21` can now be used to build PAC plugin. * `sssctl cert-show` and `cert-show cert-eval-rule` can now be run as non-root user. ### Important fixes * SSSD does no longer crash if PIN is introduced but the tactile trigger isn't pressed during passkey authentication. * SSSD can now recover if memory-cache files under `/var/lib/sss/mc` where truncated while SSSD is running. * Chaining of identical D-Bus requests that run in parallel to avoid multiple backend queries works again. ### Configuration changes * New option `local_auth_policy` is added to control which offline authentication methods will be enabled by SSSD. This option is relevant for authentication methods which have online, and offline capability such as passkey, and smartcard authentication. The default value `match` sets the offline methods to their corresponding online value. This enables offline authentication when online kerberos pre-authentication such as PKINIT, or passkey is supported by the backend, note that online methods will still be attempted first. Option value `only` can be used to disable online authentication entirely, or the value `enable:method` to explicitly enable specific authentication methods, e.g. `enable:passkey`.

1 0

2FA only for certain hosts/host groups
by Ronald Wimmer 04 Sep '23

04 Sep '23

Is it possible to enforce the second factor for a user only when trying to login to specific hosts/host groups? List here says yes... https://blog.delouw.ch/2016/10/16/freeipa-selective-2fa-authentication-indi… I'm gonna give it a try. Cheers, Ronald

2 4

dyndns update question
by alexey safonov 04 Sep '23

04 Sep '23

Hi, I'm not sure if it's related to freeipa or not, but we have home users, who are using forticlient VPN. And everytime they are connected forti generates new ifname with name like vpn0086432eee / vpn0001d1e094 /etc. Would it be possible to change sssd to use dyndns_ifname with wildcard? like vpn* Alex

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2023