I have not changed anything manually. All the config files are the way the application has
configured them when I run ipa-client-install
The content of /etc/ldap/ldap.conf is the following
# File modified by ipa-client-install
# We do not want to break your existing configuration, hence:
# URI, BASE and TLS_CACERT have been added if they were not set.
# In case any of them were set, a comment with trailing note
# "# modified by IPA" note has been inserted.
# To use IPA server with openLDAP tools, please comment out your
# existing configuration for these options and uncomment the
# corresponding lines generated by IPA.
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI
ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
# TLS certificates (needed for GnuTLS)
#TLS_CACERT /etc/ipa/ca.crt # modified by IPA
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
URI ldaps://vmfripa-1c.redcapcloud.local
BASE dc=redcapcloud,dc=local
On 19 Feb 2019, at 17:18, Florence Blanc-Renaud
<flo(a)redhat.com> wrote:
On 2/19/19 2:45 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
> I can see this line about 10-15 lines before the lines I already posted
> [18/Feb/2019:17:21:25.961763243 +0000] conn=2 op=0 BIND dn="cn=Directory
Manager" method=sasl version=3 mech=EXTERNAL
>
I am surprised to see sasl mechanism = EXTERNAL. Did you configure
/etc/openldap/ldap.conf with the setting
SASL_MECH EXTERNAL
before calling ipa-replica-install?
What is the content of this file on the replica?
flo
>> On 19 Feb 2019, at 15:19, Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com>> wrote:
>>
>> On 2/19/19 1:25 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>>> Here are the outputs of the two commands:
>>> dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>> ipaAllowedTarget:
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>> ipaAllowedTarget:
cn=ipa-cifs-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>> memberPrincipal: HTTP/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:HTTP/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>> memberPrincipal: HTTP/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:HTTP/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>> cn: ipa-http-delegation
>>> objectClass: ipaKrb5DelegationACL
>>> objectClass: groupOfPrincipals
>>> objectClass: top
>>> dn:
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>> memberPrincipal: ldap/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>> memberPrincipal: ldap/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>> cn: ipa-ldap-delegation-targets
>>> objectClass: groupOfPrincipals
>>> objectClass: top
>>> And in the access log the result of the search:
>>> [18/Feb/2019:17:21:36.259672879 +0000] conn=6 fd=64 slot=64 connection from
local to /var/run/slapd-REDCAPCLOUD-LOCAL.socket
>>> [18/Feb/2019:17:21:36.260597395 +0000] conn=6 AUTOBIND dn="cn=Directory
Manager"
>>> [18/Feb/2019:17:21:36.260604747 +0000] conn=6 op=0 BIND dn="cn=Directory
Manager" method=sasl version=3 mech=EXTERNAL
>>> [18/Feb/2019:17:21:36.260656509 +0000] conn=6 op=0 RESULT err=0 tag=97
nentries=0 etime=0.0000462749 dn="cn=Directory Manager"
>>> [18/Feb/2019:17:21:36.260806067 +0000] conn=6 op=1 MOD dn="cn=Auto
Membership Plugin,cn=plugins,cn=config"
>>> [18/Feb/2019:17:21:36.265134066 +0000] conn=6 op=1 RESULT err=0 tag=103
nentries=0 etime=0.0004388316
>>> [18/Feb/2019:17:21:36.265232071 +0000] conn=6 op=2 UNBIND
>>> [18/Feb/2019:17:21:36.265247421 +0000] conn=6 op=2 fd=64 closed - U1
>>> [18/Feb/2019:17:21:36.267548186 +0000] conn=2 op=10 SRCH
base="cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local"
scope=0 filter="(objectClass=*)" attrs="memberPrincipal"
>>> [18/Feb/2019:17:21:36.267674095 +0000] conn=2 op=10 RESULT err=32 tag=101
nentries=0 etime=0.1760815055
>>> [18/Feb/2019:17:21:36.425570348 +0000] conn=2 op=11 UNBIND
>>
>> This shows that the entry is not found on the replica (err=32 = no such object),
could either be because the replication did not replicate yet or because access rights
prevent the user from seeing the entry. Do you see a line with
>> conn=2 op=<something> BIND ...
>> earlier in the log? It would help understand which user is performing the
search.
>>
>> flo
>>
>>>> On 19 Feb 2019, at 14:15, Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com>> wrote:
>>>>
>>>> On 2/19/19 12:29 PM, Peter Zoltan Keresztes via FreeIPA-users wrote:
>>>>> After setting the $BASEDN I am getting the following:
>>>>> dn:
cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=redcapcloud,dc=local
>>>>> memberPrincipal: ldap/vmfripa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:ldap/vmfripa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>> memberPrincipal: ldap/vmcaipa-1c.redcapcloud.local(a)REDCAPCLOUD.LOCAL
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
<mailto:ldap/vmcaipa-1c.redcapcloud.local@REDCAPCLOUD.LOCAL>
>>>>> cn: ipa-ldap-delegation-targets
>>>>> objectClass: groupOfPrincipals
>>>>> objectClass: top
>>>> Ok, so the entry exists on the master. Did you also check
cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$BASEDN and the access log on the replica as I
explained in a previous mail [1]?
>>>>
>>>> Thanks,
>>>> flo
>>>>
>>>> [1]
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>
>>>>>> On 19 Feb 2019, at 12:25, Florence Blanc-Renaud
<flo(a)redhat.com <mailto:flo@redhat.com> <mailto:flo@redhat.com>> wrote:
>>>>>>
>>>>>> /etc/ipa/default.conf
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
>>>>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>>>> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>> Fedora Code of
Conduct:https://getfedora.org/code-of-conduct.html
>>> List
Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
>>> List
Archives:https://lists.fedorahosted.org/archives/list/freeipa-users@lists...
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...