On Срд, 17 сту 2024, Paul Nickerson via FreeIPA-users wrote:
>I have two FreeIPA servers in a cluster, both running on RHEL 8.9. They
>started on RHEL 8.0 I believe, and have been upgrading in-place since
>then. I recently restarted the FreeIPA services, which triggered an
>ipa-server-upgrade to upgrade from 4.9.11 to 4.9.12. When that ran, it
>errored out on some expired certificates, which I fixed with
>ipa-cert-fix, and then the ipa-server-upgrade's finished successfully.
>
>Now, when I or any of my users try to log on to the web UI, we get the error
"Your session has expired. Please log in again."
>Also, when I try to run any ipa command on the command line, I get the error:
>ipa: ERROR: cannot connect to 'any of the configured servers':
https://ipa01.semi.example.net/ipa/session/json,
https://ipa02.semi.example.net/ipa/session/json
>
>I've traced down lots of errors, and I think this one is the most relevant:
>401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Credential cache is
empty)
>I see it in /var/log/httpd/error_log, in the body of the HTTP response from
https://ipa01.semi.example.net/ipa/session/json in my web browser, and in the output from
the command ipa --debug
>
>Also, in /var/log/krb5kdc.log, I see:
>Jan 17 01:14:47
ipa01.semi.example.net krb5kdc[55855](info): TGS_REQ (6 etypes
{aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19),
aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26),
camellia128-cts-cmac(25)}) 172.16.121.5: S4U2PROXY_EVIDENCE_TKT_WITHOUT_PAC: authtime
1705454084, etypes {rep=UNSUPPORTED:(0)} HTTP/ipa01.semi.example.net(a)SEMI.EXAMPLE.NET for
ldap/ipa01.semi.example.net(a)SEMI.EXAMPLE.NET, KDC policy rejects request
>
>I have krb5 1.18.2 installed. disable_pac is not present in
>/var/kerberos/krb5kdc/kdc.conf.
>
>I think I'm experiencing the same issue seen in the recent thread at
>https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/DLYLL54LBTT4FVJLIFFWVAPQOEU4GWW7/
>(subject line "api authorization stopped working after upgrade to
>4.9.12-11 on RHEL8").
>
>I don't think any of my users or groups have an SID
>(ipantsecurityidentifier). This FreeIPA cluster was installed on RHEL
>8.0 (or thereabouts), and the servers have been upgraded in-place since
>then. We've never integrated with any Active Directory or Microsoft
>product.
FreeIPA generates SIDs by default since FreeIPA 4.9.8. It is configured
to do so on new installations even when integration with AD is not
considered, due to tightened requirements to process constrained
delegation in Kerberos.
>
>This command has no output, showing that even the admin user does not have an SID:
>ldapsearch -H ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory
Manager" -W -b cn=users,cn=accounts,dc=semi,dc=example,dc=net uid=admin '*' +
| grep -i ipantsecurityidentifier
>
>The solution from the other thread, and from
>https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_idm_users_groups_hosts_and_access_control_rules/assembly_strengthening-kerberos-security-with-pac-information_managing-users-groups-hosts#proc_enabling-security-identifiers-sids-in-idm_assembly_strengthening-kerberos-security-with-pac-information,
>does not work for me, since the ipa command doesn't work, not even for
>the admin user:
>
>[root(a)ipa01.semi.example.net ~]
># kinit admin
>Password for admin(a)SEMI.EXAMPLE.NET:
>[root(a)ipa01.semi.example.net ~]
># ipa config-mod --enable-sid --add-sids
>ipa: ERROR: cannot connect to 'any of the configured servers':
https://ipa01.semi.example.net/ipa/json,
https://ipa02.semi.example.net/ipa/json
>
>I found an alternative method at
https://freeipa.readthedocs.io/en/latest/designs/adtrust/sidconfig.html#t...,
but this also does not work for me:
>
>[root(a)ipa01.semi.example.net ~]
># ldapmodify -H ldapi://%2Frun%2Fslapd-SEMI-EXAMPLE-NET.socket -f
/tmp/ipa-sidgen-task-run.ldif
>SASL/GSSAPI authentication started
>SASL username: admin(a)SEMI.EXAMPLE.NET
>SASL SSF: 256
>SASL data security layer installed.
>adding new entry "cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config"
>ldap_add: No such object (32)
>
>I think ipa-sidgen-task does not exist in my LDAP directory, but I'm
>not sure if I understand how this is supposed to work. I don't see
>ipa-sidgen-task or anything like it from this search: ldapsearch -H
>ldap://ipa01.semi.example.net:389/ -x -D "cn=Directory Manager" -W -b
>cn=config | grep cn=tasks
>
>Can anyone help me here? I think if I could get a
>ipantsecurityidentifier attribute properly set up on my user or on the
>admin user, then I would be able to use the ipa command to get SID's
>enabled and created everywhere.
You'd need to enable SID generation first, then run those tasks. Without
sidgen plugins enabled, one cannot initiate SID generation.
Please follow the command Rob pointed you to. If that one fails, please provide
^^ make sure to pass '--netbios-name NAME' option too. There is
currently a bug that the tool does not derive NetBIOS name for the
domain properly.
E.g.
# /usr/libexec/ipa/oddjob/org.freeipa.server.config-enable-sid \
--netbios-name EXAMPLE \
--add-sids
Where NetBIOS name (EXAMPLE) is typically a first part of your realm
name (
-> EXAMPLE). DO NOT USE full realm/domain name here,
it is known to cause a lot of issues later when a trust would be
established (be it with AD or, in future, with another IPA deployment),
to the point of not being able to upgrade.
more details about your configuration, including ID ranges you have.
You
can operate IPA API on IPA master as root with
# ipa -e in_server=True ...
This would use LDAPI connection as root and would map you into a
'cn=Directory Manager' in LDAP. Not all calls would work (some check
presence of Kerberos tickets) but at least 'idrange-find' should work.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
--
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland