On pe, 18 joulu 2020, Kiselev Mikhail via FreeIPA-users wrote:
Hello.
My specs:
cat /etc/system-release
CentOS Linux release 7.8.2003 (Core)
rpm -qa ipa-server
ipa-server-4.6.6-11.el7.centos.x86_64
We migrated users from openLDAP. These users do not have a attribute
ipaNThash:
ldapsearch -h ipareplica2.opentech.local -D "cn=Directory Manager" -x
-LLL -W -b 'cn=users,cn=accounts,dc=opentech,dc=local' 'uid=mkiselev'
ipaNTHash
Enter LDAP Password:
dn: uid=mkiselev,cn=users,cn=accounts,dc=opentech,dc=local
Changing the user's password doesn't help
If a new user is created in FreeIPA, then the attribute is:
ldapsearch -h ipareplica2.opentech.local -D "cn=Directory Manager" -x
-LLL -W -b 'cn=users,cn=accounts,dc=opentech,dc=local' 'uid=test'
ipaNTHash
Enter LDAP Password:
dn: uid=test,cn=users,cn=accounts,dc=opentech,dc=local
ipaNTHash:: xaI3t+nY5wjYQ2thSKJfoQ==
What could be the problem?
As I answered already in the FreeIPA ticket you created, the issue is
within the content of your migrated user's entry.
In order to allow creating ipaNTHash attribute:
- IPA configuration should allow storing NT hashes
- LDAP entry should already have objectclass ipaNTUserAttrs or samSambaAccount
- user have to change the password
As IPA users already have ipaNTHash, the first two conditions are
satisfied (globally and for the specific user object). IPA users are
required to change their password before use, so third condition is
satisfied as well.
For migrated users, the most likely situation is that they have no
ipaNTUserAttrs objectclass. You cannot easily add yourself because
ipaNTUserAttrs object class requires ipaNTSecurityIdentifier attribute
which value (SID) is autogenerated and tightly connected to the ID
ranges associated with the IPA deployment.
In order to add SIDs to users/groups that don't have them requires use
of 'ipa-adtrust-install --add-sids' on IPA server that has Trust
Controller role.
Running 'ipa-adtrust-install --add-sids' might still not produce SIDs
for some users and groups because their UIDs/GIDs might be out of the ID
range associated with IPA deployment. This is a common issue for users
migrated from a different LDAP server with 'ipa migrate-ds' because
those accounts most likely have UIDs/GIDs from completely different
range.
Either they need UIDs/GIDs to be allocated from IPA ID range or a new ID
range should be created to cover their UIDs/GIDs range. The latter
requires understanding how ID ranges are organized. I'd recommend you to
read 'ipa help idrange' carefully.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland