September 2024 - FreeIPA-users - Fedora mailing-lists

How does RBAC work?
by Francis Augusto Medeiros-Logeay 08 Oct '24

08 Oct '24

Ok, I am not sure how this works: I created this user, called biding. I want it to be able to create users on FreeIPA, mailing by biding Keycloak to it. So I created the role: [francis@freeipa]~% ipa role-show Role name: Keycloak biding Role name: Keycloak biding Member users: biding Privileges: User Administrators, Group Administrators, Stage User Administrators, Stage User Provisioning, Modify Users and Reset passwords, Modify Group membership, Keycloak admin Yes, too many roles, because it simply wasn’t doing it. Keycloak would fail saying the user didn’t have permissions. So what I did was to add this user to the admin group. Then it created users. But not even my admin user can delete those users created that way. Why isn’t this working? And why when giving it permissions it is creating objects that simply can’t be read by my previous biding users? Best, Francis

3 9

Can't login after creating a user account
by Kris C 04 Oct '24

04 Oct '24

Not sure if anyone is experiencing this or not and apologize if it's already answered, but I've created an FreeIPA account and with a random password using the command line (ipa user-add user1 --uid=6543 --random). I then, within the WebUI, have the admin account reset user1's password to something more human friendly. I then, as user1, attempt to log into the WebUI to set the final password. I provide the user1 username and the more human friendly password and I can't log in. I've created the user through the WebUI and reset the password and it works just like I want it to. The reason I'm creating the accounts using the CLI is to migrate accounts from an old LDAP instance into FreeIPA via script. I want to then have an admin reset the users password so the user can then log in and set their final password in FreeIPA's WebUI. Thoughts? Thank you!

3 12

Removal & clean up certificates from o=ipaca
by David Goudet 30 Sep '24

30 Sep '24

Hello all, I have to clean up lot of useless certificate in dirsrv database. Because of resubmit loop on Certmonger client, i have 99,9% of certificate in dirsrv database that are useless and not obsolete (expiration in 2020) (it represent ~85 000 certificates). These useless certificates produce some issues on FreeIPA: - decrease FreeIPA performances on CLI and GUI - increase the LDAP size - increase size and time of FreeIPA backup ... Is it possible to purge these certificates in dirsrv database and how? I found two branches in LDAP directory about these certificates: dn: cn=xxx,ou=ca,ou=requests,o=ipaca dn: cn=yyy,ou=certificateRepository,ou=ca,o=ipaca I can remove all requests and certificates entry from dirsrv database but how it is supported by PKI manager Dogtag (CRL, certificate generation, OCSP)? (This topic has already been discuss on https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…) Thank you for you help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574

4 7

Replication between Fedora 39 and 41 Beta does not work
by Dirk Streubel 30 Sep '24

30 Sep '24

Hello, I have the following problem, maybe one of you has a solution and can tell me where to look to solve the problem. Here on site I have two Raspberry Pi 4, one Fedora 39 and one Fedora 41 Server Beta, both equipped with the latest Freeipa packages. Both have identical IPA versions installed: “ssh ipa1 -t ipa --version VERSION: 4.12.1, API_VERSION: 2.254 Connection to ipa1 closed.” “ssh ipa9 -t ipa --version VERSION: 4.12.1, API_VERSION: 2.254 Connection to ipa9 closed.” Replication from ipa1 to ipa9 with : “ipa-replica-install --setup-ca --setup-kra --setup-dns --forwarder=1.1.1.1 --setup-adtrust --add-agents” works fine, an ‘ipa-replica-manage re-initialize --from ipa1.linux.schnell.er" also works, I can also access via the web frontend. After a reboot of ipa9 does not work anymore, I get the following error message: “ipa-replica-manage re-initialize --from ipa1.linux.schnell.er Re-run /usr/sbin/ipa-replica-manage with --verbose option to get more information Unexpected error: cannot connect to 'ldaps://ipa9.linux.schnell.er:636': error:0A000086:SSL routines::certificate verify failed (certificate is not yet valid)” I then installed Fedora41 Server Beta again to rule out an error, but that didn't help. What I do not understand, it is a “fresh” installation and after a reboot or restart of Fedora 41 nothing works anymore :( Am I doing something wrong? Kind regards Dirk

2 2

Client's credentials have been revoked
by Dungan, Scott A. 27 Sep '24

27 Sep '24

We see random user permission denied issues on RHEL8 client, that resolves itself after about 10 minutes. In this case, the user is authenticating using the remote desktop software NoMachine (nx). journalctl: Sep 26 12:41:35 server1.id.int nxexec[3011890]: pam_sss(nx:auth): authentication failure; logname= uid=969 euid=0 tty= ruser= rhost=192.168.55.202 user=rsmith Sep 26 12:41:35 server1.id.int nxexec[3011890]: pam_sss(nx:auth): received for user rsmith: 6 (Permission denied) Sep 26 12:41:47 server1.id.int krb5_child[3011927]: Client's credentials have been revoked Sep 26 12:41:47 server1.id.int krb5_child[3011927]: Client's credentials have been revoked Sep 26 12:41:47 server1.id.int nxexec[3011925]: pam_sss(nx:auth): authentication failure; logname= uid=969 euid=0 tty= ruser= rhost=192.168.55.202 user=rsmith Sep 26 12:41:47 server1.id.int nxexec[3011925]: pam_sss(nx:auth): received for user rsmith: 6 (Permission denied) Sep 26 12:42:11 server1.id.int krb5_child[3011965]: Client's credentials have been revoked Sep 26 12:42:11 server1.id.int krb5_child[3011965]: Client's credentials have been revoked Sep 26 12:42:11 server1.id.int nxexec[3011963]: pam_sss(nx:auth): authentication failure; logname= uid=969 euid=0 tty= ruser= rhost=192.168.55.202 user=rsmith Sep 26 12:42:11 server1.id.int nxexec[3011963]: pam_sss(nx:auth): received for user rsmith: 6 (Permission denied) Sep 26 12:43:35 server1.id.int nxexec[3012022]: pam_sss(nx:auth): authentication success; logname= uid=969 euid=0 tty= ruser= rhost=192.168.55.202 user=rsmith Sep 26 12:45:15 server1.id.int systemd-logind[4695]: New session 526 of user rsmith. Sep 26 12:45:15 server1.id.int systemd[1]: Started Session 526 of user rsmith. Sep 26 12:45:15 server1.id.int nxexec[3012073]: pam_unix(nx:session): session opened for user rsmith by (uid=969) krb5_child.log: (2024-09-26 12:41:24): [krb5_child[3011820]] [map_krb5_error] (0x0020): [RID#12745] 2399: [-1765328366][Client's credentials have been revoked] (2024-09-26 12:41:35): [krb5_child[3011892]] [get_and_save_tgt] (0x0020): [RID#12751] 2270: [-1765328366][Client's credentials have been revoked] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-09-26 12:41:35): [krb5_child[3011892]] [main] (0x0400): [RID#12751] krb5_child started. * (2024-09-26 12:41:35): [krb5_child[3011892]] [unpack_buffer] (0x1000): [RID#12751] total buffer size: [124] * (2024-09-26 12:41:35): [krb5_child[3011892]] [unpack_buffer] (0x0100): [RID#12751] cmd [241 (auth)] uid [866900186] gid [2070] validate [true] enterprise principal [false] offline [false] UPN [rsmith(a)ID.INT] * (2024-09-26 12:41:35): [krb5_child[3011892]] [unpack_buffer] (0x0100): [RID#12751] ccname: [KCM:] old_ccname: [KCM:] keytab: [/etc/krb5.keytab] * (2024-09-26 12:41:35): [krb5_child[3011892]] [switch_creds] (0x0200): [RID#12751] Switch user to [866900186][2070]. * (2024-09-26 12:41:35): [krb5_child[3011892]] [switch_creds] (0x0200): [RID#12751] Switch user to [0][0]. * (2024-09-26 12:41:35): [krb5_child[3011892]] [k5c_check_old_ccache] (0x4000): [RID#12751] Ccache_file is [KCM:] and is active and TGT is valid. * (2024-09-26 12:41:35): [krb5_child[3011892]] [k5c_setup_fast] (0x0100): [RID#12751] Fast principal is set to [host/server1.id.int(a)ID.INT] * (2024-09-26 12:41:35): [krb5_child[3011892]] [find_principal_in_keytab] (0x4000): [RID#12751] Trying to find principal host/server1.id.int(a)ID.INT<mailto:host/server1.id.int@ID.INT> in keytab. * (2024-09-26 12:41:35): [krb5_child[3011892]] [match_principal] (0x1000): [RID#12751] Principal matched to the sample (host/server1.id.int(a)ID.INT<mailto:host/server1.id.int@ID.INT>). * (2024-09-26 12:41:35): [krb5_child[3011892]] [check_fast_ccache] (0x0200): [RID#12751] FAST TGT is still valid. * (2024-09-26 12:41:35): [krb5_child[3011892]] [become_user] (0x0200): [RID#12751] Trying to become user [866900186][2070]. * (2024-09-26 12:41:35): [krb5_child[3011892]] [main] (0x2000): [RID#12751] Running as [866900186][2070]. * (2024-09-26 12:41:35): [krb5_child[3011892]] [set_lifetime_options] (0x0100): [RID#12751] No specific renewable lifetime requested. * (2024-09-26 12:41:35): [krb5_child[3011892]] [set_lifetime_options] (0x0100): [RID#12751] No specific lifetime requested. * (2024-09-26 12:41:35): [krb5_child[3011892]] [set_canonicalize_option] (0x0100): [RID#12751] Canonicalization is set to [true] * (2024-09-26 12:41:35): [krb5_child[3011892]] [main] (0x0400): [RID#12751] Will perform auth * (2024-09-26 12:41:35): [krb5_child[3011892]] [main] (0x0400): [RID#12751] Will perform online auth * (2024-09-26 12:41:35): [krb5_child[3011892]] [tgt_req_child] (0x1000): [RID#12751] Attempting to get a TGT * (2024-09-26 12:41:35): [krb5_child[3011892]] [get_and_save_tgt] (0x0400): [RID#12751] Attempting kinit for realm [ID.INT] * (2024-09-26 12:41:35): [krb5_child[3011892]] [get_and_save_tgt] (0x0020): [RID#12751] 2270: [-1765328366][Client's credentials have been revoked] ********************** BACKTRACE DUMP ENDS HERE ********************************* Any help would be appreciated.

2 1

multi domain support
by Marco Naimoli 27 Sep '24

27 Sep '24

Hello, I've setup freeipa for domain and realm mydomain.com I would like to manage, with the same instance, subdomains like staff.mydomain.com guests.mydomain.com and people should authenticate using accounts like: user1(a)staff.mydomain.com user2(a)guests.mydomain.com I see I can add realms, under "IPA server" -> "Realm domain" and I've added the new realms staff.mydomain.com and guests.mydomain.com, but when I create a new user user, it is created under mydomain.com and I cannot change it So is it possibile to create and manage multiple domains under a single freeipa instance ? If not, is there a way to manage multiple domains (e.g. using a freeipa instance for every realm and create a trust among them) so that clients can be configured to permit user login from all of the subdomains ? I have found a multi tenancy documentation, but it's not very clear Thank you Marco

2 2

sssd: disable password cache?
by Harald Dunkel 24 Sep '24

24 Sep '24

Hi folks, is there some way to disable sssd's password cache? Everytime a colleague changes his password, he has problems with our dovecot server, because it runs into a permission denied, until some privileged user runs "sss_cache -u name" or "sss_cache -E" or similar. AFAIU the password is stored for 5400 seconds. Apparently thats too long. Caching passwords while sssd is connected to LDAP and Kerberos might be considered a bad idea, anyway. There is an undocumented option krb5_store_password_if_offline in sssd.conf. Maybe there are other undocumented options as well? Regards Harri

2 4

"Correct way" to do service accounts?
by Schrock, Chad - 0336 - MITLL 23 Sep '24

23 Sep '24

Hi -- We have been using IdM/FreeIPA for a while, and as these things tend to happen, we have a process to create “service accounts” in the domain that is quite cumbersome and was what “just worked” at the time so it is what we have been doing. Currently using IdM/FreeIPA 4.9.13 on RHEL 8.10. (When I say “service accounts” I mean an account that an application would use to bind to the LDAP domain, read records, and do something like allow the user to use the application.) What is the ‘suggested’ or preferred method to create this kind of user in IdM? Is “system account” the better name? I found: * https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… * https://www.freeipa.org/page/HowTo/LDAP * https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… * https://github.com/noahbliss/freeipa-sam Which all seem good, especially freeipa-sam. But they are also all pretty old. Thanks, Chad -- Chad Schrock, he/him Supporting MIT Lincoln Laboratory, Lexington, MA chad.schrock(a)ll.mit.edu

2 2

Problems with ipa-ods-exporter
by Yavor Marinov 20 Sep '24

20 Sep '24

Hello all, Last few weeks I've been having issues with ipa-ods-export because it's failing to start. Our infra is not impacted by the problem but will be glad to know what could be the issue as I've tried to regenerate the keytab /etc/ipa/dnssec/ipa-ods-exporter.keytab Below is the error message ipa-ods-exporter[487019]: Traceback (most recent call last): ipa-ods-exporter[487019]: File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1096, in error_handler ipa-ods-exporter[487019]: yield ipa-ods-exporter[487019]: File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1672, in add_entry ipa-ods-exporter[487019]: self.conn.add_s(str(entry.dn), list(attrs.items())) ipa-ods-exporter[487019]: File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 236, in add_s ipa-ods-exporter[487019]: return self.add_ext_s(dn,modlist,None,None) ipa-ods-exporter[487019]: File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 222, in add_ext_s ipa-ods-exporter[487019]: resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout) ipa-ods-exporter[487019]: File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 543, in result3 ipa-ods-exporter[487019]: resp_type, resp_data, resp_msgid, decoded_resp_ctrls, retoid, retval = self.result4( ipa-ods-exporter[487019]: File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 553, in result4 ipa-ods-exporter[487019]: ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop) ipa-ods-exporter[487019]: File "/usr/lib64/python3.9/site-packages/ldap/ldapobject.py", line 128, in _ldap_call ipa-ods-exporter[487019]: result = func(*args,**kwargs) ipa-ods-exporter[487019]: ldap.INSUFFICIENT_ACCESS: {'msgtype': 105, 'msgid': 9, 'result': 50, 'desc': 'Insufficient access', 'ctrls': []} ipa-ods-exporter[487019]: During handling of the above exception, another exception occurred: ipa-ods-exporter[487019]: Traceback (most recent call last): ipa-ods-exporter[487019]: File "/usr/libexec/ipa/ipa-ods-exporter", line 719, in <module> ipa-ods-exporter[487019]: master2ldap_master_keys_sync(ldapkeydb, localhsm) ipa-ods-exporter[487019]: File "/usr/libexec/ipa/ipa-ods-exporter", line 346, in master2ldap_master_keys_sync ipa-ods-exporter[487019]: ldapkeydb.import_master_key(mkey) ipa-ods-exporter[487019]: File "/usr/lib/python3.9/site-packages/ipaserver/dnssec/ldapkeydb.py", line 375, in import_master_key ipa-ods-exporter[487019]: self.ldap.add_entry(new_key.entry) ipa-ods-exporter[487019]: File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1672, in add_entry ipa-ods-exporter[487019]: self.conn.add_s(str(entry.dn), list(attrs.items())) ipa-ods-exporter[487019]: File "/usr/lib64/python3.9/contextlib.py", line 137, in __exit__ ipa-ods-exporter[487019]: self.gen.throw(typ, value, traceback) ipa-ods-exporter[487019]: File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1122, in error_handler ipa-ods-exporter[487019]: raise errors.ACIError(info=info) ipa-ods-exporter[487019]: ipalib.errors.ACIError: Insufficient access:

2 5

Re: Error upgrading to version 4.11.0
by flo＠redhat.com 19 Sep '24

19 Sep '24

The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list.

3 11

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users September 2024