Re: Upgrade to FreeIPA 4.9.12 on RHEL 8.9 caused web UI login and ipa command to stop working
by Oliver Nixon
Hi,
I'm encountering the same issue after upgrading to 4.9.12.
I had previously imported users from another FreeIPA deployment and their UIDs were outside of the defined ID ranges.
I've created a new ID range to encompass these and run the following but the SIDs still don't get generated:
]# /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --netbios-name DOMAIN-NAME --add-sids
Configuring SID generation
[1/8]: creating samba domain object
Samba domain object already exists
[2/8]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
[3/8]: adding RID bases
RID bases already set, nothing to do
[4/8]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
[5/8]: activating sidgen task
Sidgen task plugin already configured, nothing to do
[6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
[7/8]: adding fallback group
Fallback group already set, nothing to do
[8/8]: adding SIDs to existing users and groups
This step may take considerable amount of time, please wait..
Done.
2 months, 3 weeks
Requiring OTP thru PAM+LDAP
by G H
I am using SSSD in LDAP-only mode (no kerberos at all), communicating with FreeIPA. For certain hosts, I want to require sssd to demand OTP.
Right now, they are allowing password OR password+OTP. But my 'ipa show-host' output for the hosts in question have "Authentication Indicators: otp". What do I need to do for sssd to only accept password+OTP ?
Thank you.
2 months, 3 weeks
setup trusted Realm between two freeIPAs
by Farshad Allahdadi
Hi,
I'm going to transfer data between two Hadoop clusters kerberizd/joined to separate freeIPAs using distcp. The distcp command or any tool requires to authenticate to both freeIPAs (grant permission to read from one server and write to other).
My priority is to make the least possible changes to source cluster/freeIPA which is in production, so I tried to setup trusted real between these but failed, it seems that trusted realm is only possible (or documented) between AD and freeIPA. Is it possible to setup trusted Realm between two freeIPAs(and if yes how to)? What are the other options to do the job with less impact on source freeIPA?
Also making freeIPAs to be replica for each other is not a good option for me, because i need to separate them later.
Thanks in advance
2 months, 3 weeks
automount timeouts
by Steve Berg
Does IPA do anything to set a timeout on an nfs automount? I'm seeing
some strange behavior on a few automounts and want to make sure I look
in the right places to look up and/or set a timeout for those filesystems.
--
//- Fixer of that which is broke -//
//- Home = sberg(a)mississippi.com -//
//- Sinners can repent, but stupid is forever. -//
2 months, 3 weeks
ldap bind user, getting "invalid credentials"
by slek kus
Hi, can't get an application to work with FreeIPA (4.10.2).
Created a bind users as per manual (https://www.freeipa.org/page/HowTo/LDAP) but keep getting invalid creds.
Created the user as below:
-----
[root@idm01 log]# ldapmodify -x -D 'cn=Directory Manager' -W
Enter LDAP Password:
dn: uid=bndldapansibleforms,cn=sysaccounts,cn=etc,dc=linux,dc=bogus,dc=local
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: bndldapansibleforms
userPassword: S3cr3t!
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0
adding new entry "uid=bndldapansibleforms,cn=sysaccounts,cn=etc,dc=linux,dc=bogus,dc=local"
-----
In the app I have:
-----
Server: idm01.linux.bogus.local
Port: 389
Search base: dc=linux,dc=bogus,dc=local
Bind User distinguished name: bndldapansibleforms
Bind User Password: S3cr3t!
Username Attribute: sAMAccountName
Groups Attribute: memberOf
-----
Also tried with a normal user, but that prints the same invalid credentials error.
How do I do this correctly?
Cheers, slekkus.
2 months, 3 weeks
Re: Create IPA user via LDAP
by Ronald Wimmer
On 08.01.24 17:58, Alexander Bokovoy wrote:
> On Пан, 08 сту 2024, Ronald Wimmer wrote:
>> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote:
>>> On 02.01.24 16:27, Rob Crittenden wrote:
>>>> Ronald Wimmer via FreeIPA-users wrote:
>>>>>
>>>>>
>>>>> On 14.12.23 14:42, Alexander Bokovoy wrote:
>>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote:
>>>>>>> In our company we do have an IAM tool for user management. We
>>>>>>> need to
>>>>>>> create IPA users via this particular tool. I am aware of all IPA
>>>>>>> commands or API calls to create/modify or delete a user.
>>>>>>>
>>>>>>> As the tool does not support FreeIPA yet they asked if there is a
>>>>>>> way
>>>>>>> to manage users by using LDAP only. Could that work? What about
>>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber?
>>>>>>
>>>>>> Learn about lifecycle management. This is your way of integrating
>>>>>> with
>>>>>> such tools bvy creating staged users:
>>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/...
>>>>>>
>>>>>
>>>>> I followed the instructions from the documentation.
>>>>>
>>>>> How could I possibly overcome
>>>>>
>>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]:
>>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid
>>>>>
>>>>> I need to set passwords from the external system.
>>>>
>>>> You need to enable migration mode (ipa config-mod --enable-migration
>>>> true).
>>>>
>>>> By default a pre-hashed password can only be set once: during the user
>>>> add operation.
>>>
>>> Ok. So this would not work for a password change. So if we need to
>>> set an initial password and change that particular password in some
>>> point in time the only feasible way is the IPA API, right?
>>>
>>> Can the immediate password expiration be overridden?
>>
>> As we have an upcoming please allow me to ask if I got the point here.
>>
>> I appreciate your support in this matter!
>>
>
> I was looking over the code. The only way to accept pre-hashed passwords
> is when they also have Kerberos keys set. This means you cannot use
> external LDAP modify/add for that as you cannot create the Kerberos key
> without knowing a Kerberos master key.
>
> So the only other option is to submit a clear-text password:
>
> userPassword: {CLEAR}text-password
>
> That will be accepted and if bind DN that performed this change is
> either a cn=Directory Manager or a one from the passsync managers, it
> would also not be marked for expiration immediately.
If I try to set the userPassword attribute to some value with an LDAP
browser and chose "plaintext" the value gets hashed immediately. I do
see {PBKDF2_SHA256}. As a consequence the user cannot be activated.
What am I doing wrong?
I tried to enable migration mode and wanted to try it again but now I
cannot connect to IPA's LDAP directory at all anymore...
[root@tipa01 ~]# ipa config-mod --enable-migration=true
Maximum username length: 32
Maximum hostname length: 64
Home directory base: /home
Default shell: /bin/sh
Default users group: ipausers
Default e-mail domain: ipatest.mydomain.at
Search time limit: 2
Search size limit: 100
User search fields: uid,givenname,sn,telephonenumber,ou,title
Group search fields: cn,description
Enable migration mode: True
Certificate Subject base: O=IPATEST.MYDOMAIN.AT
Password Expiration Notification (days): 4
Password plugin features: AllowNThash, KDC:Disable Last Success
SELinux user map order:
guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
Default SELinux user: unconfined_u:s0-s0:c0.c1023
Default PAC types: MS-PAC, nfs:NONE
IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at
IPA master capable of PKINIT: tipa01.ipatest.mydomain.at,
tipa02.ipatest.mydomain.at
IPA CA servers: tipa01.ipatest.mydomain.at
IPA CA renewal master: tipa01.ipatest.mydomain.at
Domain resolution order: org.mydomain.at:ipatest.mydomain.at
[root@tipa01 ~]# ipa config-mod --enable-migration=false
ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may
provide more information, Minor (2529638972): KDC returned error string:
PROCESS_TGS
2 months, 3 weeks
Re: reliability of external radius
by Alexander Bokovoy
On Пан, 12 лют 2024, Charles Hedrick via FreeIPA-users wrote:
>Currently our department uses passwords in IPA, with a few users using
>OTP. I'm considering using a University radius server for most users.
>Are there reliability implications? My concern is what happens if the
>radius server is slow to respond or even is down. I'd like users with
>accounts in IPA to still work, and I'd hope things would survive
>conditions of slow response.
There is one potential issue that we fixed recently in MIT Kerberos:
https://github.com/krb5/krb5/pull/1318
It is not yet part of any release. If you have RHEL subscription, making
it known to RHEL support organization might help to get this fix out
faster.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 months, 3 weeks
Re: Installing CA certificate isuue
by mskaraca@yahoo.com
Hi
I just wanted to say thank you to this list and especially to Rob Crittenden..
I could not log in to freeipa-users, there may be a problem in logging in with social network accounts. So I am sending this as an email..
Firstly My issue was freeIpa was refusing to install my comodo certificate with a signature algorithm complain.
I am writing how I solved this issue with a complete CLI
#recommended by Rob and significant milestone in solving my problemupdate-crypto-policies --set DEFAULT:SHA1#I received ca-bundle from my CA with my CRT file sudo ipa-cacert-manage -t C,, install my-domain.ca-bundle sudo ipa-certupdate #pem file incudes all the certificate authority chain.. sudo ipa-server-certinstall --http --dirsrv mydomain.key mydomain.pem
I have only one questionWhy didIı need to add this ca file to my freeIPA server? I mean it is already sgined with a public CA? web servers can easily see and do not throw any error when I install this certificate. but same is not true when I install this certificate in IDM or in anyting other than a web server.. so why do they not know my CA automaticaly?
is it because this is especially designed for HTTPS connections? Do I need to request something different or from another vendor, such as verisgn?
Thanks again..
2 months, 3 weeks
idrange problem
by Steve Berg
For a few weeks now I've been seeing a problem getting authenticated to
my ipa domain. I can get command line and web UI stuff done by using
the admin user but if I get a ticket using my account which is in the
admins group I get the following on the web UI:
Your session has expired. Please log in again.
On the command line any ipa commands I've tried so far give me:
ipa: ERROR: Insufficient access: SASL(-1): generic failure: GSSAPI
Error: Unspecified GSS failure. Minor code may provide more information
(Credential cache is empty)
Getting a ticket as admin on command line lets me run ipa commands with
no problem. I think I've got all pertinent certificates loaded up
properly. Gonna try a reboot on one of the servers shortly. I have 4
servers on r different vlans, replication between seems to be working
properly.
I think the problem is most of the user ID's we use on this domain are
not in the ID range configured. We let the install choose a default
range when we first set this up. Most of our users have a UID based on
their EDIPI # which is a 32-bit ID assigned when a user first gets a DoD
CAC. They're usually 10 digits long.
For instance the lowest EDIPI based UID we have currently is something
like 1004201873 and the largest is 1658224121. (I made those but
they're close to the actual UIDs.)
ipa idrange-find show me this, (did some masking of the info):
Range name: domain_id_range
First Posix ID of the range: 824xxx000
Number of IDs in the range: 200000
First RID of the corresponding RID range: 1000
First RID of the secondary RID range: 100000000
Range name: domain_subid_range
First Posix ID of the range: 214xxx3648
Number of IDs in the range: 214xxx2576
First RID of the corresponding RID range: 214xxx3648
Domain SID of the trusted domain: S-1-5-21-xxxxxx-83xx66-82xxx729
Range type: Active Directory domain range
Should I adjust the range that's already there or add a third that
encompasses the likely range of numbers I'm gonna see in the future? I
started to add a range with appropriate values but when it wanted the
primary and secondary RID base values I was not sure how to figure that
out or estimate.
--
//- Fixer of that which is broke -//
//- Home =sberg(a)mississippi.com -//
//- Sinners can repent, but stupid is forever. -//
2 months, 3 weeks