Hello,
thank you for your fast investigation;
we are on centos 8 and we have the following packages:
- name: install freeipa packages
dnf:
name:
- ipa-server
- ipa-server-dns
- ipa-server-trust-ad
- ipa-idoverride-memberof-plugin
state: installed
yes, im sorry for that idiotic formatting, my mail client somehow removed the newlines i
was just able to see it after i already sent it ..
we got it working by the link you provided:
ipa group-add-member u0-erdberg-verwaltung --idoverrideusers=ad_user(a)ad.example.com
so really thank you for your help, just one LAST question:
is this somehow possible on group basis? (id override group?) we dont want to have to
manage all of our ad users we want to manage some groups in which are assigned to the
users?
best regards,
--
ÖAMTC I BAUMGASSE 129 I 1030 WIEN
Elias Rami | Devops Engineer
M +43 664 613 1346
elias.rami(a)oeamtc.at |
www.oeamtc.at<http://www.oeamtc.at/> | ÖAMTC ZVR 7300335108
On 2019-12-19 17:11:29+01:00 Alexander Bokovoy wrote:
Hi Rami,
On to, 19 joulu 2019, Rami Elias (TECH V) via FreeIPA-users wrote:
&gt;Freeipa Problem
&gt;we have a freeipa --&gt; ad setup (one way trust)
&gt;our problem is we cant get external ad user // groups to work
(your mail client did terrible formatting)
The issue you have is that external groups in IPA aren't used for ACI
handling in LDAP. So any access to vaults is not granted even by
assigning roles to the group that has external member.
If you are using RHEL 8.x, you should do
yum module install idm:DL1/adtrust
this will bring ipa-idoverride-memberof package which provide a plugin
to add ID overrides from the Default trust view as members of IPA groups
for the purpose of LDAP ACI checks. See the following documentation
section for details:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
&gt;what we did:
&gt;we added the trust:
&gt;Trust Settings
&gt;Realm name
&gt;domain.at
&gt;Domain NetBIOS name
&gt;DOMAIN
&gt;Domain Security Identifier
&gt;S-1-5-21-2435101603-3558199190-xxxxxxx
&gt;Trust direction
&gt;Trusting forest
&gt;Trust type
&gt;Active Directory domain
&gt;we have trusted domains:
&gt;domain.at
&gt;Enabled
&gt;DOMAIN
&gt;S-1-5-21-2435101603-3558199190-xxxxxxx
&gt;the global trust config looks like:
&gt;Domain
&gt;lx.domain.at
&gt;Security Identifier
&gt;S-1-5-21-3255425601-626398459-xxxxxx
&gt;NetBIOS name
&gt;LX
&gt;Domain GUID
&gt;671b2faa-5129-4a5c-a410-xxxxxxx
&gt;Fallback primary group
&gt;Default SMB Group
&gt;IPA AD trust agents
&gt;ipa-ihs-prod-c81.lx.domain.at
&gt;ipa-ihs-prod-c82.lx.domain.at
&gt;ipa-ihs-test-c81.lx.domain.at
&gt;ipa-ihs-test-c82.lx.domain.at
&gt;ipa-web-prod-c81.lx.domain.at
&gt;ipa-web-prod-c82.lx.domain.at
&gt;ipa-web-test-c81.lx.domain.at
&gt;ipa-web-test-c82.lx.domain.at
&gt;IPA AD trust controllers
&gt;ipa-ihs-prod-c81.lx.domain.at
&gt;ipa-ihs-prod-c82.lx.domain.at
&gt;ipa-ihs-test-c81.lx.domain.at
&gt;ipa-ihs-test-c82.lx.domain.at
&gt;ipa-web-prod-c81.lx.domain.at
&gt;ipa-web-prod-c82.lx.domain.at
&gt;ipa-web-test-c81.lx.domain.at
&gt;ipa-web-test-c82.lx.domain.at
&gt;we have those id ranges:
&gt;LX.DOMAIN.AT_id_range
&gt;224200000
&gt;200000
&gt;local domain range
&gt;DOMAIN.AT_id_range
&gt;800000000
&gt;200000
&gt;Active Directory domain range
&gt;we executed following commands for external group like described in
https://www.freeipa.org/page/Active_Directory_trust_setup#Allow_access_fo...
&gt;ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung_ext
--external
&gt;ipa group-add --desc='u0-erdberg' u0-erdberg-verwaltung
&gt;u0-erdberg-verwaltung
&gt;224200005
&gt;u0-erdberg
&gt;ipa group-add-member u0-erdberg-verwaltung_ext --external
'DOMAIN\u0-erdberg-verwaltung'
&gt;ipa group-add-member u0-erdberg-verwaltung --groups
u0-erdberg-verwaltung_ext
&gt;now i login to a freeipa managed host or an ipa server with
&gt;ssh -l ad_user(a)domain.at server.lx.domain.at
&gt;and check my groups i get:
&gt;224200005(u0-erdberg-verwaltung) which is the freeipa group
&amp;gt;800089798(u0-erdberg-verwaltung(a)domain.at) which is the ad group
&gt;now i added roles to the ipa group and the ipa ext group:
&gt;User Group: u0-erdberg-verwaltung
&gt;Role name
&gt;helpdesk
&gt;Enrollment Administrator
&gt;vault_admin
&gt;Smart Proxy Host Manager
&gt;IT Specialist
&gt;Security Architect
&gt;IT Security Specialist
&gt;User Administrator
&gt;User Group: u0-erdberg-verwaltung_ext
&gt;Role name
&gt;IT Security Specialist
&gt;vault_admin
&gt;Smart Proxy Host Manager
&gt;User Administrator
&gt;Security Architect
&gt;IT Specialist
&gt;helpdesk
&gt;Enrollment Administrator
&gt;now the fail happens:
&gt;ipa vault-add test --type=standard
&gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at' .
&gt; },
&gt; "id": 0,
&gt; "principal": "ad_user(a)DOMAIN.AT",
&gt; "result": null,
&gt; "version": "4.7.1"
&gt;}
&gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
&amp;gt;[ad_user@domain.at(a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test
--type=standard
&gt;ipa: INFO: Request: {
&gt; "id": 0,
&gt; "method": "ping",
&gt; "params": [
&gt; [],
&gt; {}
&gt; ]
&gt;}
&gt;ipa: INFO: Response: {
&gt; "error": null,
&gt; "id": 0,
&gt; "principal": "ad_user(a)DOMAIN.AT",
&gt; "result": {
&gt; "messages": [
&gt; {
&gt; "code": 13001,
&gt; "data": {
&gt; "server_version": "2.230"
&gt; },
&gt; "message": "API Version number was not sent,
forward compatibility not guaranteed. Assuming server's API version, 2.230",
&gt; "name": "VersionMissing",
&gt; "type": "warning"
&gt; }
&gt; ],
&gt; "summary": "IPA server version 4.7.1. API version
2.230"
&gt; },
&gt; "version": "4.7.1"
&gt;}
&gt;ipa: INFO: Request: {
&gt; "id": 0,
&gt; "method": "vault_add_internal/1",
&gt; "params": [
&gt; [
&gt; "test"
&gt; ],
&gt; {
&gt; "ipavaulttype": "standard",
&gt; "version": "2.230"
&gt; }
&gt; ]
&gt;}
&gt;ipa: INFO: Response: {
&gt; "error": {
&gt; "code": 2100,
&gt; "data": {
&gt; "info": "Insufficient 'add' privilege to
add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
&gt; },
&gt; "message": "Insufficient access: Insufficient
'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
&gt; "name": "ACIError"
&gt; },
&gt; "id": 0,
&gt; "principal": "ad_user(a)DOMAIN.AT",
&gt; "result": null,
&gt; "version": "4.7.1"
&gt;}
&gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
&amp;gt;[ad_user@domain.at(a)ipa-ihs-test-c81 ~]$ ipa -vv vault-add test
--type=standard
&gt;ipa: INFO: Request: {
&gt; "id": 0,
&gt; "method": "ping",
&gt; "params": [
&gt; [],
&gt; {}
&gt; ]
&gt;}
&gt;ipa: INFO: Response: {
&gt; "error": null,
&gt; "id": 0,
&gt; "principal": "ad_user(a)DOMAIN.AT",
&gt; "result": {
&gt; "messages": [
&gt; {
&gt; "code": 13001,
&gt; "data": {
&gt; "server_version": "2.230"
&gt; },
&gt; "message": "API Version number was not sent,
forward compatibility not guaranteed. Assuming server's API version, 2.230",
&gt; "name": "VersionMissing",
&gt; "type": "warning"
&gt; }
&gt; ],
&gt; "summary": "IPA server version 4.7.1. API version
2.230"
&gt; },
&gt; "version": "4.7.1"
&gt;}
&gt;ipa: INFO: Request: {
&gt; "id": 0,
&gt; "method": "vault_add_internal/1",
&gt; "params": [
&gt; [
&gt; "test"
&gt; ],
&gt; {
&gt; "ipavaulttype": "standard",
&gt; "version": "2.230"
&gt; }
&gt; ]
&gt;}
&gt;ipa: INFO: Response: {
&gt; "error": {
&gt; "code": 2100,
&gt; "data": {
&gt; "info": "Insufficient 'add' privilege to
add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'."
&gt; },
&gt; "message": "Insufficient access: Insufficient
'add' privilege to add the entry
'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.",
&gt; "name": "ACIError"
&gt; },
&gt; "id": 0,
&gt; "principal": "ad_user(a)DOMAIN.AT",
&gt; "result": null,
&gt; "version": "4.7.1"
&gt;}
&gt;ipa: ERROR: Insufficient access: Insufficient 'add' privilege to add
the entry 'cn=test,cn=ad_user,cn=users,cn=vaults,cn=kra,dc=lx,dc=domain,dc=at'.
&gt;--
&gt;ÖAMTC I BAUMGASSE 129 I 1030 WIEN
&gt;Elias Rami | Devops Engineer
&gt;M +43 664 613 1346
&amp;gt;elias.rami(a)oeamtc.at |
www.oeamtc.at<http:
www.oeamtc.at=""></http:> | ÖAMTC ZVR 7300335108
&gt;
&gt;
________________________________
Schenken Sie ein gutes Gefühl!
Jetzt online ÖAMTC Wertgutschein kaufen,
z.B. für Schutzbrief, Autobahnvignette, Reisen, Fahrtechnik, uvm.
www.oeamtc-gutschein.at<https://www.oeamtc-gutschein.at>
________________________________
Wichtiger Hinweis/Important Information:
Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen via E-Mail
sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung samt
firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in
vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten
Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen
verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder
Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt
dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen
Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail
von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet.
This e-mail and any attachment (“e-mail”) serves information purposes only. Statements via
e-mail are not legally binding but require written confirmation including the signatures
of the required number of managing directors under statutory provisions. We are not liable
for the accuracy and sufficiency of the provided information/data, for any transmission
error, misdirection, loss or delay of an e-mail. Electronic reading receipts are no
confirmation for receipt of an e-mail. This e-mail is confidential. If you are not the
addressee or his representative, please notify the sender immediately and delete this
e-mail from your system. Any disclosure or use is prohibited.
________________________________
________________________________
&gt;
&gt;Schenken Sie ein gutes Gefühl!
&gt;Jetzt online ÖAMTC Wertgutschein kaufen,
&gt;z.B. für Schutzbrief, Autobahnvignette, Reisen, Fahrtechnik, uvm.
&gt;www.oeamtc-gutschein.at<https:
www.oeamtc-gutschein.at="">
&gt;
&gt;
&gt;________________________________
&gt;Wichtiger Hinweis/Important Information:
&gt;
&gt;Dieses E-Mail samt Anlagen („E-Mail“) dient nur zur Information. Erklärungen
via E-Mail sind nicht rechtsverbindlich, sondern bedürfen der schriftlichen Bestätigung
samt firmenmäßiger/statutenmäßiger Unterfertigung durch Mitglieder der Geschäftsleitung in
vertretungsbefugter Anzahl. Für die Richtigkeit oder Vollständigkeit der übermittelten
Informationen/Daten, für Übermittlungsfehler, für fehlgeleitete E-Mails oder für einen
verspäteten Empfang wird nicht gehaftet. Eigene elektronische Empfangs- oder
Lesebestätigungen gelten nicht als Bestätigung für den Erhalt eines E-Mails. Der Inhalt
dieses E-Mails ist vertraulich. Wenn Sie nicht der angegebene Adressat oder dessen
Vertreter sind, informieren Sie bitte umgehend den Absender und löschen Sie dieses E-Mail
von Ihrem System. Die unerlaubte Weitergabe oder Nutzung ist nicht gestattet.
&gt;
&gt;This e-mail and any attachment (“e-mail”) serves information purposes only.
Statements via e-mail are not legally binding but require written confirmation including
the signatures of the required number of managing directors under statutory provisions. We
are not liable for the accuracy and sufficiency of the provided information/data, for any
transmission error, misdirection, loss or delay of an e-mail. Electronic reading receipts
are no confirmation for receipt of an e-mail. This e-mail is confidential. If you are not
the addressee or his representative, please notify the sender immediately and delete this
e-mail from your system. Any disclosure or use is prohibited.
&gt;
&gt;________________________________
&gt;_______________________________________________
&gt;FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
&gt;To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
&gt;Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
&gt;List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
&gt;List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
</https:>