January 2018 - FreeIPA-users - Fedora mailing-lists

API 3005 Unknown option: <myAttrName>
by Matt . 24 Jan '18

24 Jan '18

HI Guys, I have added my own userattribute which works perfectly fine from the webgui and the cli but not using the API where I get this error from as response: 3005 Unknown option: <myAttrName> I thought this would lineup easily, what goes wrong ? Thanks, Matt

1 1

Re: Request for input on installing IPA onto ARM/SoC boards
by Andrew Meyer 24 Jan '18

24 Jan '18

For the most part, yes. Its cheap, low-power. I actually have tried to do this w/ a Fedora build. It overloaded the RasPi 2 & or 3. I can't remember to be honest. But I feel like if i'm able to run something that does IDM on that, i'm good to go. I think it is probably just the hobbyist in me that wants to do this. But it looks like the storage is not a high enough calibur. I wouldn't be upset if I had to buy something that was Atom processor and throw a SSD in it. More to come as I think about it. On Tuesday, January 23, 2018 7:45 AM, Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: Andrew Meyer via FreeIPA-users wrote: > Agreed. I would love to run this on a raspberry pi or better. But why? Is it because the hardware is so cheap? Is it better/easier/cheaper than running it in a VM on an existing box? Is it merely for the "fun" factor (and I'm not disparaging it, I do lots of things just to see if it can be done). rob > > Get Yahoo Mail for Mobile > <https://go.onelink.me/107872968?pid=InProduct&c=MailPP_sig_Dec17⁡_sub1=E-ma…> > > On Mon, Jan 22, 2018 at 14:25, Alex Corcoles via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org> wrote: > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org

2 1

Request for input on installing IPA onto ARM/SoC boards
by Rob Crittenden 24 Jan '18

24 Jan '18

We get questions periodically on installing IPA onto SoC boards, mostly ARM and usually a Pi (Banana or Raspberry). We'd like to add a wiki page or howto with tips on known workarounds. We'd also like to get some use cases on why you'd want to run IPA on something like this. Is it just an experiment, using it on a home network with just a few nodes, something else? I'll take all the input and create a wiki page on it. Note that up to now we don't recommend doing such an install. Maybe the user stories will change our mind. thanks rob

4 6

user_add post_callback doesn't seem to be called.
by Bryce Larson 24 Jan '18

24 Jan '18

We have function that are supposed to be called in a plugin from a post_callback It's registered with: user.user_add.register_post_callback(useradd_postcallback) The plugin is at /usr/lib/python2.7/site-packages/ipaserver/plugins/csAccount.py It doesn't seem to be called at all, it used to. I'm not sure if it was upgrading from 4.3 to 4.4, or from 4.4 to 4.5 that it stopped working, but I think it was the upgrade from 4.4 to 4.5. I'm pretty sure the pre_callback is still working. Does anyone know why a post_callback would just stop working after upgrading? This is the documentation that we found that covers post_callbacks: https://abbra.fedorapeople.org/guide.pdf

2 3

BUG REPORT nss/sssd looking up root user on cent 7.4 and sssd 1.15.2 with AD_User_Short_Names
by email＠ml.jacobdevans.com 23 Jan '18

23 Jan '18

Hey All, Having some major issues with sudo and it appears the root cause is the time it takes sssd to resolve root as a local user when domain-resolution-order is enabled in ipa4.5, I do not have filter_users or filter_groups defined, so the default root user should be used (https://jhrozek.fedorapeople.org/sssd/1.15.2/man/sssd.conf.5.html) Manually adding this value has no effect. Versions: IPA 4.5 SSSD 1.15.2 Centos 7.4 Currently it takes `time id root` about 8-16 seconds to finish depending on caches and firewalls. I have (2) forest trusts, a total of 7 domains + ipa itself, 3 of them listed in domain-resolution-order Thank You, -Jake

3 2

(no subject)
by jcccb 23 Jan '18

23 Jan '18

some new log insights from the client when a mount from the /storage/ fails: Jan 23 19:41:10 ubuntu_client automount[825]: parse_mount: parse(sun): core of entry: options=, loc=NFS_Server.ipa.mydomain.example:/storage/media Jan 23 19:41:10 ubuntu_client automount[825]: sun_mount: parse(sun): mounting root /storage, mountpoint media, what NFS_Server.ipa.mydomain.example:/storage/media, fstype nfs, options (null) Jan 23 19:41:10 ubuntu_client automount[825]: mount_mount: mount(nfs): root=/storage name=media what=NFS_Server.ipa.mydomain.example:/storage/media, fstype=nfs, options=(null) Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: called with host NFS_Server.ipa.mydomain.example(IP_OF_UBUNTU_CLIENT) proto 6 version 0x30 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: nfs v3 rpc ping time: 0.000000 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: nfs v2 rpc ping time: 0.000000 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: host NFS_Server.ipa.mydomain.example cost 0 weight 0 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: called with host NFS_Server.ipa.mydomain.example(IP_OF_UBUNTU_CLIENT) proto 17 version 0x30 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: nfs v3 rpc ping time: 0.000000 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: nfs v2 rpc ping time: 0.000000 Jan 23 19:41:10 ubuntu_client automount[825]: get_nfs_info: host NFS_Server.ipa.mydomain.example cost 0 weight 0 Jan 23 19:41:10 ubuntu_client automount[825]: prune_host_list: selected subset of hosts that support NFS3 over TCP Jan 23 19:41:10 ubuntu_client automount[825]: mount_mount: mount(nfs): calling mkdir_path /storage/media Jan 23 19:41:10 ubuntu_client automount[825]: mount_mount: mount(nfs): calling mount -t nfs NFS_Server.ipa.mydomain.example:/storage/media /storage/media Jan 23 19:41:10 ubuntu_client automount[825]: >> mount.nfs: access denied by server while mounting NFS_Server.ipa.mydomain.example:/storage/media Jan 23 19:41:10 ubuntu_client automount[825]: mount(nfs): nfs: mount failure NFS_Server.ipa.mydomain.example:/storage/media on /storage/media Jan 23 19:41:10 ubuntu_client automount[825]: ioctl_send_fail: token = 41 Jan 23 19:41:10 ubuntu_client automount[825]: failed to mount /storage/media this brings no errors up on the NFS_Server logs > Is it possible to try with apparmor disabled (or the equivalent of > `setenforce 0`)? That might help narrow down where the problem is. > dont think apparmor is involved in this, because a mount of my home folders are working fine on the client

1 0

ipa-client-install changed SELinux Booleans
by Eric Scholwin 23 Jan '18

23 Jan '18

I was wondering if anyone noticed while installing FreeIPA on any of their machines, whether or not their SELinux Booleans were affected? I installed this in a test environment and nothing broke. However, when installed in my production environment, an important SEBoolean was changed: "authlogin_nsswitch_use_ldap --> on" This particular boolean was changed to off, breaking logins for an application running on the server that required connecting to an ldap server. i've figured out what broke, now I'm just trying to figure out what caused it to change. Is this something FreeIPA would normally change? I only ask because I've installed this on about 30 systems and only this one was affected, but ldap also isn't used on many of the other servers. Any insight would be appreciated. Thanks

3 3

ipa-restore: a bytes-like object is required, not 'str'
by Matt . 23 Jan '18

23 Jan '18

On a fresh installed IPA server where I do a backup and restore right after installation I get: a bytes-like object is required, not 'str' The ipa-restore command failed. See /var/log/iparestore.log for more information 2018-01-23T04:05:29Z DEBUG stderr= 2018-01-23T04:05:29Z DEBUG Creating log directories for dogtag 2018-01-23T04:05:29Z INFO Restoring from userRoot in MY-DOMAIN-TLD 2018-01-23T04:05:29Z DEBUG File "/usr/lib/python3.6/site-packages/ipapython/admintool.py", line 174, in execute return_value = self.run() File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_restore.py", line 396, in run self.ldif2db(instance, backend, online=options.online) File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_restore.py", line 554, in ldif2db ldif_parser.parse() File "/usr/lib64/python3.6/site-packages/ldif.py", line 470, in parse return self.parse_entry_records() # parse() File "/usr/lib64/python3.6/site-packages/ldif.py", line 460, in parse_entry_records self.handle(dn,entry) File "/usr/lib/python3.6/site-packages/ipaserver/install/ipa_restore.py", line 130, in handle self.writer.unparse(dn, entry) File "/usr/lib64/python3.6/site-packages/ldif.py", line 210, in unparse self._unparseAttrTypeandValue('dn', dn) File "/usr/lib64/python3.6/site-packages/ldif.py", line 158, in _unparseAttrTypeandValue self._unfold_lines(': '.join([attr_type, attr_value.decode('ascii')])) File "/usr/lib64/python3.6/site-packages/ldif.py", line 121, in _unfold_lines self._output_file.write(line) 2018-01-23T04:05:29Z DEBUG The ipa-restore command failed, exception: TypeError: a bytes-like object is required, not 'str' 2018-01-23T04:05:29Z ERROR a bytes-like object is required, not 'str' 2018-01-23T04:05:29Z ERROR The ipa-restore command failed. See /var/log/iparestore.log for more information What goes wrong here ?

3 4

Freeipa / IDM on a VM
by Grace Thompson 23 Jan '18

23 Jan '18

Anybody running their freeipa / IDM cluster on a 100% virtualized environment? We are running the full stack - DNS, ldap, Certs etc and I’m wondering if we can run it all on a VM environment. My concern is the chicken/egg scenario in case of a full DC recovery. Thoughts? Thanks.

3 2

Private PEN for OID not accepted
by Matt . 22 Jan '18

22 Jan '18

HI guys. I'm having an issue with my private PEN when I want to add an objectclass and an attribute with the following ldif (99999 is a replacement for my private PEN registered at Iana) The following output is what I get: modifying entry "cn=schema" ldap_modify: Invalid syntax (21) additional info: attribute type myAttributeName: Unknown attribute syntax OID "1.3.6.1.4.1.99999.1.1.2.2.1" modifying entry "cn=schema" ldap_modify: Invalid syntax (21) additional info: object class ( 1.1.2.1.1 NAME 'customPerson' SUP top SYNTAX 1.3.6.1.4.1.99999.1.1.2.1.1 AUXILIARY MAY ( myAttributeName ) X-ORIGIN 'Extending FreeIPA' ): Failed to parse objectclass, error(2) at ( 1.3.6.1.4.1.99999.1.1.2.1.1 AUXILIARY MAY ( myAttributeName ) X-ORIGIN 'Extending FreeIPA' )) And this is the (as far as I know) good ldif: dn: cn=schema changetype: modify add: attributeTypes attributeTypes: ( 1.1.2.2.1 NAME 'myAttributeName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.99999.1.1.2.2.1 X-ORIGIN 'Extending FreeIPA' ) dn: cn=schema changetype: modify add: objectClasses objectClasses: ( 1.1.2.1.1 NAME 'customPerson' SUP top SYNTAX 1.3.6.1.4.1.99999.1.1.2.1.1 AUXILIARY MAY ( myAttributeName ) X-ORIGIN 'Extending FreeIPA' ) This should work as far as I know and discussed on IRC and I also read it here: https://www.redhat.com/archives/freeipa-users/2017-January/msg00222.html I hope someone can explain what could be going wrong. Thanks, Matt

2 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2018