Thank you for the assistance. I tried running the oddjob without specifying a NetBIOS
name, and it gave a return code of 1, no output, and didn't seem to do anything. Then
I saw your NetBIOS comment.
First I checked to see if we already had a NetBIOS name configured, and I didn't find
anything (I used ldapsearch because the ipa command was still not working):
ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W
'(ipaNTFlatName=*)'
ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W
'(objectClass=ipaNTTrustedDomain)'
ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W
'(objectclass=ipaNTDomainAttrs)'
So I tried the oddjob with the NetBIOS name option, formatted as you recommended:
/usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid --netbios-name SEMI
--add-sids
This still had no output, but it did do good things. I can now find the NetBIOS name using
ldapsearch. Many users and groups now have the ipaNTSecurityIdentifier attribute:
ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W
'(ipaNTSecurityIdentifier=*)'
However, some users were skipped, like mine. The admin user got the
ipaNTSecurityIdentifier attribute, so I tried running the ipa command as that user, hoping
to modify the skipped users:
[root(a)ipa01.semi.example.net ~]
# kinit admin
Password for admin(a)SEMI.EXAMPLE.NET:
[root(a)ipa01.semi.example.net ~]
# ipa config-mod --enable-sid --add-sids
Maximum username length: 32
Maximum hostname length: 64
Home directory base: /home
Default shell: /bin/bash
Default users group: ipausers
Default e-mail domain:
semi.example.net
Search time limit: 2
Search size limit: 500
User search fields: uid,givenname,sn,telephonenumber,ou,title
Group search fields: cn,description
Enable migration mode: False
Certificate Subject base:
O=SEMI.EXAMPLE.NET
Password Expiration Notification (days): 4
Password plugin features: AllowNThash, KDC:Disable Last Success
SELinux user map order:
guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
Default SELinux user: unconfined_u:s0-s0:c0.c1023
Default PAC types: MS-PAC, nfs:NONE
IPA masters:
ipa01.semi.example.net,
ipa02.semi.example.net
IPA master capable of PKINIT:
ipa01.semi.example.net,
ipa02.semi.example.net
IPA CA servers:
ipa01.semi.example.net,
ipa02.semi.example.net
IPA CA renewal master:
ipa02.semi.example.net
The skipped users still have no ipaNTSecurityIdentifier. But at least I can run ipa
commands now.
I've tried looking for patterns in which users were skipped. It's not all users in
the admins group. Maybe it's older users, who I think were migrated from a previous
FreeIPA version 3 cluster which crashed and burned years ago? I'm going to keep
looking for some pattern in which users did not get the ipaNTSecurityIdentifier, but if
you have any ideas, please let me know.