Re: Create IPA user via LDAP
by Ronald Wimmer
On 08.01.24 17:58, Alexander Bokovoy wrote:
> On Пан, 08 сту 2024, Ronald Wimmer wrote:
>> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote:
>>> On 02.01.24 16:27, Rob Crittenden wrote:
>>>> Ronald Wimmer via FreeIPA-users wrote:
>>>>>
>>>>>
>>>>> On 14.12.23 14:42, Alexander Bokovoy wrote:
>>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote:
>>>>>>> In our company we do have an IAM tool for user management. We
>>>>>>> need to
>>>>>>> create IPA users via this particular tool. I am aware of all IPA
>>>>>>> commands or API calls to create/modify or delete a user.
>>>>>>>
>>>>>>> As the tool does not support FreeIPA yet they asked if there is a
>>>>>>> way
>>>>>>> to manage users by using LDAP only. Could that work? What about
>>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber?
>>>>>>
>>>>>> Learn about lifecycle management. This is your way of integrating
>>>>>> with
>>>>>> such tools bvy creating staged users:
>>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/...
>>>>>>
>>>>>
>>>>> I followed the instructions from the documentation.
>>>>>
>>>>> How could I possibly overcome
>>>>>
>>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]:
>>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid
>>>>>
>>>>> I need to set passwords from the external system.
>>>>
>>>> You need to enable migration mode (ipa config-mod --enable-migration
>>>> true).
>>>>
>>>> By default a pre-hashed password can only be set once: during the user
>>>> add operation.
>>>
>>> Ok. So this would not work for a password change. So if we need to
>>> set an initial password and change that particular password in some
>>> point in time the only feasible way is the IPA API, right?
>>>
>>> Can the immediate password expiration be overridden?
>>
>> As we have an upcoming please allow me to ask if I got the point here.
>>
>> I appreciate your support in this matter!
>>
>
> I was looking over the code. The only way to accept pre-hashed passwords
> is when they also have Kerberos keys set. This means you cannot use
> external LDAP modify/add for that as you cannot create the Kerberos key
> without knowing a Kerberos master key.
>
> So the only other option is to submit a clear-text password:
>
> userPassword: {CLEAR}text-password
>
> That will be accepted and if bind DN that performed this change is
> either a cn=Directory Manager or a one from the passsync managers, it
> would also not be marked for expiration immediately.
>
So. Am I right that our options are to use LDAP with a cleartext
passwort or use the IPA API?
3 months, 3 weeks
web login failed after upgrade
by 彭勇
when we upgrade ipa-server-4.9.12-9 to ipa-server-4.9.12-11 on RHEL 8, we
can't login to web. the web give me message: “Your session has expired.
Please log in again.”
we check the error_log
[Thu Jan 18 21:56:42.535394 2024] [auth_gssapi:error] [pid 11025:tid
139639453087488] [client 118.184.176.67:30891] Failed to unseal session
data!, referer: https://id1.netegn.com/ipa/xml
[Thu Jan 18 21:56:43.113937 2024] [wsgi:error] [pid 11021:tid
139639621613312] [remote 118.184.176.67:30891] ipa: INFO: 401 Unauthorized:
Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified
GSS failure. Minor code may provide more information (Credential cache is
empty)
[Thu Jan 18 21:56:43.611962 2024] [wsgi:error] [pid 11023:tid
139639621613312] [remote 118.184.176.67:30893] ipa: INFO: 401 Unauthorized:
Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified
GSS failure. Minor code may provide more information (Credential cache is
empty)
all three ipa server failed. we can't resolve the problem, we restore the
snapshot and it recovery.
we install RHEL 9.3 with ipa-server-4.10.2-5,set it as replicator of master
ipa server, it has same problem.
--
Peng Yong
3 months, 3 weeks
Freeipa sudo
by Dmitry Krasov
Hello.
The FreeIpa user has sudo rights on a Ubuntu 2204 desktop machine that is in the FreeIpa Linux domain. It can do sudo su, sudo apt install…
But when starting some services and basic installation of applications from the market (in general, when it comes to gui admin rights), it asks the local administrator password.
How can I fix this so the user’s password was requested from FreeIpa or not at all?
3 months, 3 weeks
Is there any way to disable TOTP watermark support?
by Heo Paul
I use the core server (fedora 39, ipa-version : 4.11.0)
I know that freeipa server adds TOTP watermark support since 4.1 version.
But for some reason, I need to reuse otp-code from generated with TOPT for short time to login but it fails with otp watermark.
Are there any ways to disable the feature from server side?
Thanks in advance.
3 months, 3 weeks
Redundancy and failover practices
by Justin Sanderson
I have built a 4 node environment in which all 4 servers have CA and domain
replication via a tight-cell topology.
I have some questions about redundancy and failover.
1. How are user logins affected if my master dies?
2. I understand that sssd has some built-in failover capabilities but is
there anything that I need to do on the DNS SRV records for ldap and
kerberos?
3. Is failover even a thing for krb5/ldap services since they're
replicating?
Overall, I would like some detail about what to do and how, when my master
goes down? I see a decent amount of information about how to set it all up
but how do I actually make use of it in the event of server failure?
Any in-depth docs/info on this topic would be appreciated.
Thanks in advance.
3 months, 3 weeks
Bind9/named 4.10.2 segfaults under dnssec load, ISC points to lib version mismatches.
by Harry G Coin
Under opendnssec processing load, bind9 segfaults under v 4.10.2. The
only mitigation was to add systemd restart override.
Details here: https://gitlab.isc.org/isc-projects/bind9/-/issues/4533
Coredumps available.
The ISC devs closed the issue with this comment:
"Yeah, SoftHSM2 is pretty much broken with OpenSSL 3. If you want this
to work, you need to compile both BIND 9 and SoftHSM2 to be compiled
with OpenSSL 1.1. (The worst you can do is to compile one with OpenSSL 3
and second with OpenSSL 1.1, SoftHSM2 leaks symbols into the address space.)
There’s also a libnss file provider that can be used as alternative. But
combining old and new will not work here. SoftHSM2 is basically in
maintained as of not.
There’s nothing we can do here on BIND 9 side. There will be support for
OpenSSL 3 providers in future, but not in the version near EOL."
Looks like the freeipa team has some choices to make re:
named-bind/opendnssec/softhsm2/pcks11/openssl !
Thanks
Harry
3 months, 3 weeks
Old Home Folders and Free ipa users
by Alper AYKUT
Hello I have 5 servers. The users of all servers are created locally. All
users have Home. Now I will connect the Servers to the Free ipa server to
enable them to log in with the Users I have created in Free IPA. However,
how will the users' home folders that were created in the past match the
User created in Free ipa? Or will the users need to delete their home
folders to be created again.
If I need to delete the Home folders of the users, I will need to back up
the data of all users. This is a huge workload.
Thankyou for support.
3 months, 3 weeks
[SSSD] Announcing SSSD 2.9.4
by Pavel Březina
# SSSD 2.9.4
The SSSD team is announcing the release of version 2.9.4 of the
System Security Services Daemon. The tarball can be downloaded from:
https://github.com/SSSD/sssd/releases/tag/2.9.4
See the full release notes at:
https://sssd.io/release-notes/sssd-2.9.4.html
RPM packages will be made available for Fedora shortly.
## Feedback
Please provide comments, bugs and other feedback via the sssd-devel
or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
# SSSD 2.9.4 Release Notes
## Highlights
### Important fixes
* Fixes a crash when PAM passkey processing incorrectly handles
non-passkey data.
* A workaround was implemented to handle gracefully misbehaving
applications that destroy internal state of SSSD client librarires. A
particular example of such application is described in
https://github.com/TigerVNC/tigervnc/issues/1709.
* An error when rotating KCM's logs was fixed. When KCM's logs were
rotated by logrotate, KCM would still use the old file (renamed
sssd_kcm.log.1). Only after KCM was restarted (either manually or
automatically) the new log file would be used. This problem is now
solved and KCM uses the new file immediately.
* Fixed group membership handling when members are coming from
different forest domains and using ldap token groups is prohibited.
* Files provider was erroneously taking into consideration
`local_auth_policy` config option, thus breaking smartcard
authentication of local user in setups that didn't explicitly specify
this option. This is now fixed.
3 months, 3 weeks