October 2019 - FreeIPA-users - Fedora mailing-lists

FreeIPA: Cannot login to AD User from IPA client, login from server works
by Danijel Bojic 31 Oct '19

31 Oct '19

Hi dear freeipa-users :D I am currently testing FreeIPA in a Windows Active Directory environment. The goal is to use this as a productive secondary domain with a one-way trust from AD to FreeIPA. (We have lots of developers that work with Linux clients (Fedora and CentOS) aswell as want to profit from their already existing user account in the AD environment. This will also make it easier for the IT to track which clients/vms etc. are domain joined and which are not and would allow us to restrict them slightly on our systems.) I did the installation following the manual on the Freeipa page. After that i had to troubleshoot why AD users are not getting correct UID/GID assigned from AD --> https://www.reddit.com/r/linuxadmin/comments/dcb1xh/freeipa_and_windows_ad_… I fixed that by doing the said thing by deleting established trust, re-adding trust with correct parameters, deleting sssd cache. Now im facing something else that gives me a headache since a few days. I am unable to login to AD users from IPA joined Client. ipa-client-install etc. done. and should be fine. But im unable to su to user, or ssh, or get infos with ID or getent passwd user. I can kinit into said user though from client, thats why im guessing that ipa-client install worked. And from ipa server off, im also able to login to the user like intended (ssh, su, getent, id works all fine). I added debug_level 9 to sssd but im unable to identify the problem. I pasted down below said log file aswell as the krb5.conf and sssd.conf if there is anything wrong. AD domain is: domain.ad IPA domain is: domain.test User: user I hope someone can help me here :) Best regards, Dani sssd.conf [domain/domain.test] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = domain.test id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = ipa-client.domain.test chpass_provider = ipa ipa_server = _srv_, ipa.domain.test ldap_tls_cacert = /etc/ipa/ca.crt debug_level = 9 [sssd] services = nss, sudo, pam, ssh domains = domain.test debug_level = 9 [nss] homedir_substring = /home debug_level = 9 [pam] debug_level = 9 [sudo] debug_level = 9 [autofs] [ssh] debug_level = 9 [pac] [ifp] [secrets] [session_recording] krb5.conf #File modified by ipa-client-install includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = domain.TEST dns_lookup_realm = true dns_lookup_kdc = true rdns = false dns_canonicalize_hostname = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid} [realms] domain.TEST = { pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem auth_to_local = RULE:[1:$1@$0](^.*@DOMAIN.AD$)s/@DOMAIN.AD/@domain.ad/ auth_to_local = DEFAULT } [domain_realm] .domain.test = domain.TEST domain.test = domain.TEST ipa-client.domain.test = domain.TEST .DOMAIN.ad = domain.AD domain.ad = domain.AD ad-test.domain.ad = domain.AD Logfile: /var/log/sssd/sssd_domain (Fri Oct 25 15:08:15 2019) [sssd[be[domain.test]]] [ldb] (0x4000): commit ldb transaction (nesting: 0) (Fri Oct 25 15:08:15 2019) [sssd[be[domain.test]]] [ipa_sudo_full_refresh_done] (0x0400): Successful full refresh of sudo rules (Fri Oct 25 15:08:15 2019) [sssd[be[domain.test]]] [be_ptask_done] (0x0400): Task [SUDO Full Refresh]: finished successfully (Fri Oct 25 15:08:15 2019) [sssd[be[domain.test]]] [be_ptask_schedule] (0x0400): Task [SUDO Full Refresh]: scheduling task 21600 seconds from last execution time [1572030495] (Fri Oct 25 15:08:15 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[(nil)], ldap[0x55a487f688d0] (Fri Oct 25 15:08:15 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_dispatch] (0x4000): dbus conn: 0x55a487f6a870 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_dispatch] (0x4000): Dispatching. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=user(a)domain.ad] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_attach_req] (0x0400): DP Request [Account #4]: New request. Flags [0x0001]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.ad is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.ad is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaUserOverride)(uid=user))]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_print_server] (0x2000): Searching 192.168.14.60:389 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=user))][cn=Default Trust View,cn=views,cn=accounts,dc=domain,dc=test]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 18 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_add] (0x2000): New operation 18 timeout 6 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[0x55a487f7e000], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_destructor] (0x2000): Operation 18 finished (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaUserOverride)(uid=user))]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.ad is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [user] to IPA server (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 19 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_add] (0x2000): New operation 19 timeout 6 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[0x55a487fac5d0], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[0x55a487fac5d0], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_EXTENDED] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_destructor] (0x2000): Operation 19 finished (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55a487f92830 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55a487f92900 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Running timer event 0x55a487f92830 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f92900 "ltdb_timeout" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f92830 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_search_by_name] (0x0400): No such entry (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost=user(a)domain.ad)) (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55a487f7d500 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55a487f7d5d0 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Running timer event 0x55a487f7d500 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f7d5d0 "ltdb_timeout" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f7d500 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_cache_search_groups] (0x2000): No such entry (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_done] (0x4000): releasing operation connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_destroy] (0x4000): releasing operation connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_done] (0x0400): DP Request [Account #4]: Request handler finished [0]: Success (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [_dp_req_recv] (0x0400): DP Request [Account #4]: Receiving request data. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #4]: Finished. Success. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_reply_std] (0x1000): DP Request [Account #4]: Returning [Success]: 0,0,Success (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1::domain.ad:name=user@domain.ad] from reply table (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_destructor] (0x0400): DP Request [Account #4]: Request removed. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[(nil)], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_dispatch] (0x4000): dbus conn: 0x55a487f6a870 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_dispatch] (0x4000): Dispatching. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=user(a)domain.ad] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_attach_req] (0x0400): DP Request [Account #5]: New request. Flags [0x0001]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_search_user_next_base] (0x0400): Searching for users with base [cn=accounts,dc=domain,dc=test] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_print_server] (0x2000): Searching 192.168.14.60:389 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(|(krbPrincipalName=user@domain.ad)(mail=user@domain.ad)(krbPrincipalName=user\\@domain.ad@domain.TEST))(objectclass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))][cn=accounts,dc=domain,dc=test]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uidNumber] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gecos] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [homeDirectory] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginShell] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPrincipalName] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [memberOf] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUniqueID] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaNTSecurityIdentifier] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [entryUSN] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowLastChange] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMin] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowMax] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowWarning] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowInactive] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowExpire] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [shadowFlag] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbLastPwdChange] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [krbPasswordExpiration] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [pwdAttribute] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [authorizedService] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [accountExpires] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userAccountControl] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [nsAccountLock] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [host] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginDisabled] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginExpirationTime] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [loginAllowedTimeMap] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaSshPubKey] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [ipaUserAuthType] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userCertificate;binary] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x1000): Requesting attrs: [mail] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 20 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_add] (0x2000): New operation 20 timeout 6 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[0x55a487f7dc70], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_destructor] (0x2000): Operation 20 finished (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_search_user_process] (0x0400): Search for users, returned 0 results. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_search_user_process] (0x2000): Retrieved total 0 users (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_done] (0x4000): releasing operation connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55a487f97290 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55a487f97360 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Running timer event 0x55a487f97290 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f97360 "ltdb_timeout" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f97290 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_search_by_name] (0x0400): No such entry (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_cache_search_groups] (0x2000): Search groups with filter: (&(objectCategory=group)(ghost=user(a)domain.ad)) (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55a487f96800 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55a487f968d0 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Running timer event 0x55a487f96800 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f968d0 "ltdb_timeout" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f96800 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_cache_search_groups] (0x2000): No such entry (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_delete_user] (0x0400): Error: 2 (No such file or directory) (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55a487f72da0 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55a487f72e70 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Running timer event 0x55a487f72da0 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f72e70 "ltdb_timeout" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f72da0 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [user(a)domain.ad] found. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_id_get_account_info_orig_done] (0x0080): Object not found, ending request (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_done] (0x0400): DP Request [Account #5]: Request handler finished [0]: Success (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [_dp_req_recv] (0x0400): DP Request [Account #5]: Receiving request data. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #5]: Finished. Success. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_reply_std] (0x1000): DP Request [Account #5]: Returning [Success]: 0,0,Success (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:U:domain.test:name=user@domain.ad] from reply table (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_destructor] (0x0400): DP Request [Account #5]: Request removed. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[(nil)], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_dispatch] (0x4000): dbus conn: 0x55a487f6a870 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_dispatch] (0x4000): Dispatching. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_message_handler] (0x2000): Received SBUS method org.freedesktop.sssd.dataprovider.getAccountInfo on path /org/freedesktop/sssd/dataprovider (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_get_account_info_handler] (0x0200): Got request for [0x1][BE_REQ_USER][name=user(a)domain.ad] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_attach_req] (0x0400): DP Request [Account #6]: New request. Flags [0x0001]. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_attach_req] (0x0400): Number of active DP request: 1 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.ad is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.ad is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.test is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sss_domain_get_state] (0x1000): Domain domain.ad is Active (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_get_acct_info_send] (0x0400): Sending request_type: [REQ_FULL_WITH_MEMBERS] for trust user [user(a)domain.ad] to IPA server (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 21 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_add] (0x2000): New operation 21 timeout 6 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[0x55a487f7d750], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_EXTENDED] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null). (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_op_destructor] (0x2000): Operation 21 finished (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_callback": 0x55a487f97630 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Added timed event "ltdb_timeout": 0x55a487f97700 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Running timer event 0x55a487f97630 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f97700 "ltdb_timeout" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [ldb] (0x4000): Destroying timer event 0x55a487f97630 "ltdb_callback" (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [user(a)domain.ad] found. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_id_op_done] (0x4000): releasing operation connection (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_done] (0x0400): DP Request [Account #6]: Request handler finished [0]: Success (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [_dp_req_recv] (0x0400): DP Request [Account #6]: Receiving request data. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #6]: Finished. Success. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_reply_std] (0x1000): DP Request [Account #6]: Returning [Success]: 0,0,Success (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:U:domain.ad:name=user@domain.ad] from reply table (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_destructor] (0x0400): DP Request [Account #6]: Request removed. (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [dp_req_destructor] (0x0400): Number of active DP request: 0 (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: sh[0x55a487f69200], connected[1], ops[(nil)], ldap[0x55a487f688d0] (Fri Oct 25 15:08:44 2019) [sssd[be[domain.test]]] [sdap_process_result] (0x2000): Trace: end of ldap_result list

4 6

ipa-replica-install
by Joseph, Matthew 30 Oct '19

30 Oct '19

Hello, I'm currently running into an issue when trying to do the ipa-replica-install. I did the ipa-replica-prepare command and copied the replica gpg file to the new replica server and run the following command to do the install Ipa-replica-install -setup-ca -setup-dns -no-forwarders /var/lib/ipa/replica-info-server.domain.ca.gpg I get the following error part way through the process; DatabaseError: Server is unwilling to perform: modification of attribute nsds5replicaleasetimeout is not allowed in replica entry I looked at the log and saw the following' DEBUG The ipa-replica-install command failed, exception: DatabaseError: Server is unwilling to perform: Modification of attribute nsds5replicaleasetimeout is not allowed in replica entry ERROR Server is unwilling to perform: modification of attribute nsds5replicaleasetimeout is not allowed in replica entry I did a search and could not find the nsds5replicaleasetimeoute entry in LDAP. Is this something I can add myself? Or is there something else that needs to be done? I don't see much information on this error when searching. I had a replica before and removed it so I'm not quite sure what is going on with this. The only difference I can see between the 2 replica's is this new one is running a slightly newer version of RHEL, IPA and 389. Master Server information: RHEL 7.1 IPA version 4.1.0-18 389-ds 1.3.3.1-13 Replica Server Information: RHEL 7.7 IPA Version 4.6.5-11 389-ds 1.3.9.1-18 Thanks, Matt

2 1

Freeipa homedir overrides
by Matthias Salzmann 30 Oct '19

30 Oct '19

Hello together I'am a newby in Freeipa I have a ( one-side ) cross-forrest trust with an Active Directory Domain. AD user are able to login with ssh on the linux server. That works fine. With sssd i am able to override the homedir. (override_homedir = /home/%u) Unfortunately it is not possible to override the homedir with an additional variable. Example: /home/%g/%u ( %g = $group ) The default group of each user should be included in homedir like /home/merchandising/paul In FreeIpa server i am able to override a user homedir with ID views but only for a single user. Does it anyone knows how i can override the homedir for a special group? Many Thanks Matthias

2 2

Re: Can't resolve external users on clients, but I can on servers
by TOULMONDE Sébastien (SPC/DCS) 29 Oct '19

29 Oct '19

Hi Sumit, I'll try to search if there's any duplicates, but it seems unlikely... Nevertheless - this bug is only hit when the domain search order is null? Thanks, Seb. This e-mail cannot be used for other purposes than Proximus business use. See more on https://www.proximus.be/maildisclaimer

2 1

Re: Can't resolve external users on clients, but I can on servers
by TOULMONDE Sébastien (SPC/DCS) 29 Oct '19

29 Oct '19

Ok, so here’s the solution I found almost by accident… If I specify the domain search order to ‘ad.domain:ipa.domain’ -> the clients can now resolve the external users If, for whatever reason, the search order is empty, the clients are back to ipa-only resolve… Hope it helps someone 😊 Sébastien Toulmonde Linux Engineering | ITS Linux CC M +32 (0)475 49 81 45 [Proximus]<http://www.proximus.be/> Connect with us on: [Proximus Facebook]<https://www.facebook.com/proximusBe> [Proximus Twitter] <https://twitter.com/proximus> [Proximus YouTube] <https://www.youtube.com/proximus> [Proximus LinkedIn] <https://www.linkedin.com/company/proximus> This e-mail cannot be used for other purposes than Proximus business use. See more on https://www.proximus.be/maildisclaimer

2 1

Full Server backup fails with IPA version error
by Saurabh Garg 29 Oct '19

29 Oct '19

Background - We are trying to restore "full server" from an existing IPA server (with replication ON to another server) to a newly created IPA Server from the same golden image as all other servers. Source IPA Server: Red Hat Enterprise Linux Server release 7.7 (Maipo) # ipa-server-install --version 4.6.4 Destination IPA Server: Red Hat Enterprise Linux Server release 7.7 (Maipo) # ipa-server-install --version 4.6.4 Problem Statement - While running "ipa-restore" (exact command: # ipa-restore /root/backup/) on the new IPA server for full server backup, system throws the following error lines in iparestore.log: 2019-10-25T08:19:26Z DEBUG stderr=IPA version error: data needs to be upgraded (expected version '4.6.4-10.el7_6.6', current version '4.6.4-10.el7_6.3') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Automatic upgrade failed: Update complete Upgrading the configuration of the IPA services [Verifying that root certificate is published] [Migrate CRL publish directory] Publish directory already set to new location [Verifying that CA proxy configuration is correct] IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. CA did not start in 300.0s The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again Aborting ipactl 2019-10-25T08:19:26Z INFO Restoring umask to 23 2019-10-25T08:19:26Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_restore.py", line 428, in run run(['ipactl', 'start']) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) 2019-10-25T08:19:26Z DEBUG The ipa-restore command failed, exception: CalledProcessError: Command 'ipactl start' returned non-zero exit status 1 2019-10-25T08:19:26Z ERROR Command 'ipactl start' returned non-zero exit status 1 2019-10-25T08:19:26Z ERROR The ipa-restore command failed. See /var/log/iparestore.log for more information In case you are aware of its fix/workaround, kindly share the steps. Thanks, sgarg

3 4

DNS - IPA masters' own PTR records in a classless subnet
by lejeczek 29 Oct '19

29 Oct '19

2 5

Re: Full Server backup fails with IPA version error
by Saurabh Garg 29 Oct '19

29 Oct '19

Thanks Angus for the reply. In my case, original IPA server is completely damaged / deleted, and now I am attempting to create an exactly similar server using "full-server" backup. Do you have any suggestions for such a scenario? Thanks sgarg On Fri, Oct 25, 2019 at 6:05 PM Angus Clarke <post(a)angusclarke.com> wrote: > Hi > > An alternative approach would be to setup your new server as an IPA client > and then to promote it. > > On new server: > # ipa-client-install > > Followed by > # ipa-replica-install > > Check the man pages for options suitable to your environment, otherwise I > specify --setup-ca for all our new IPA instances. > > I use this process for rolling out new IPA servers when we add new > environments. > > Regards > Angus > > ------------------------------ > *From:* Saurabh Garg via FreeIPA-users < > freeipa-users(a)lists.fedorahosted.org> > *Sent:* Friday, October 25, 2019 11:55:40 AM > *To:* freeipa-users(a)lists.fedorahosted.org < > freeipa-users(a)lists.fedorahosted.org> > *Cc:* Saurabh Garg <saurabh.grg(a)gmail.com> > *Subject:* [Freeipa-users] Full Server backup fails with IPA version error > > Background - > We are trying to restore "full server" from an existing IPA server (with > replication ON to another server) to a newly created IPA Server from the > same golden image as all other servers. > > Source IPA Server: Red Hat Enterprise Linux Server release 7.7 (Maipo) > # ipa-server-install --version > 4.6.4 > > Destination IPA Server: Red Hat Enterprise Linux Server release 7.7 (Maipo) > # ipa-server-install --version > 4.6.4 > > Problem Statement - > While running "ipa-restore" (exact command: # ipa-restore /root/backup/) > on the new IPA server for full server backup, system throws the following > error lines in iparestore.log: > > > 2019-10-25T08:19:26Z DEBUG stderr=IPA version error: data needs to be > upgraded (expected version '4.6.4-10.el7_6.6', current version > '4.6.4-10.el7_6.3') > Automatically running upgrade, for details see /var/log/ipaupgrade.log > Be patient, this may take a few minutes. > Automatic upgrade failed: Update complete > Upgrading the configuration of the IPA services > [Verifying that root certificate is published] > [Migrate CRL publish directory] > Publish directory already set to new location > [Verifying that CA proxy configuration is correct] > IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command > ipa-server-upgrade manually. > CA did not start in 300.0s > The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for > more information > > See the upgrade log for more details and/or run > /usr/sbin/ipa-server-upgrade again > Aborting ipactl > > 2019-10-25T08:19:26Z INFO Restoring umask to 23 > 2019-10-25T08:19:26Z DEBUG File > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in > execute > return_value = self.run() > File > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_restore.py", line > 428, in run > run(['ipactl', 'start']) > File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, > in run > raise CalledProcessError(p.returncode, arg_string, str(output)) > > 2019-10-25T08:19:26Z DEBUG The ipa-restore command failed, exception: > CalledProcessError: Command 'ipactl start' returned non-zero exit status 1 > 2019-10-25T08:19:26Z ERROR Command 'ipactl start' returned non-zero exit > status 1 > 2019-10-25T08:19:26Z ERROR The ipa-restore command failed. See > /var/log/iparestore.log for more information > > In case you are aware of its fix/workaround, kindly share the steps. > > Thanks, > sgarg > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo… > List Guidelines: > https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro… > List Archives: > https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed… >

2 1

Fedora -> CentOS, 4.7.2 -> 4.7.1
by David Harvey 28 Oct '19

28 Oct '19

Dear FreeIPA users, TL:DR *any* way of moving from 4.7.2->4.7.1? I've managed to get into a situation.. On realising the support for Debian/Ubuntu was a bit ropey, I successfully made Fedora replicas and promoted them a year or so ago. These run OK, but wanting to be off the treadmill of Fedora upgrades, the promise of CentOS8 beckoned. With seeing the release notes for 4.7.2 pointing to Redhat 8 relates patches I was quite confident that 4.7.2 would be included, allowing another hop over to a longer term supported OS. So the short version is, that I'm on 4.7.2 very much wanting to get to CentOS8 where 4.7.1 is currently. I understand the replica installer will let you create against the same or older than itself, but are there any actual LDAP schema differences between these versions? Might it be possible to tweak what 4.7.2 reports in order to force it to allow a 4.7.1 replica? Is there a backup and restore process that might allow the moving back by 0.0.1 versions!? Given that FreeIPA call out Redhat and Fedora support but not CentOS, would I actually be better off on the Fedora frequent update path? Many thanks in advance, David

2 3

Upgrade 389-ds-base
by Dirk Streubel 28 Oct '19

28 Oct '19

Hello, after Updating my FreeIPA Machine with the following Packages 389-ds-base-1.4.1.8-4.fc30.x86_64 and 389-ds-base-libs-1.4.1.8-4.fc30.x86_64 my IPAServer will not start because of a Dirsrv Error: [28/Oct/2019:15:24:33.197006547 +0100] - INFO - main - 389-Directory/1.4.1.8 B2019.288.179 starting up [28/Oct/2019:15:24:33.305073561 +0100] - INFO - main - Setting the maximum file descriptor limit to: 524288 [28/Oct/2019:15:24:34.015432996 +0100] - INFO - PBKDF2_SHA256 - Based on CPU performance, chose 2048 rounds [28/Oct/2019:15:24:34.148313874 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [28/Oct/2019:15:24:34.183483952 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [28/Oct/2019:15:24:34.216059053 +0100] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [28/Oct/2019:15:24:34.249251920 +0100] - NOTICE - ldbm_back_start - found 2034812k physical memory [28/Oct/2019:15:24:34.271787887 +0100] - NOTICE - ldbm_back_start - found 627800k available [28/Oct/2019:15:24:34.305153307 +0100] - NOTICE - ldbm_back_start - cache autosizing: db cache: 50870k [28/Oct/2019:15:24:34.346820319 +0100] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (3 total): 65536k [28/Oct/2019:15:24:34.380215639 +0100] - NOTICE - ldbm_back_start - cache autosizing: userRoot dn cache (3 total): 65536k [28/Oct/2019:15:24:34.413883565 +0100] - NOTICE - ldbm_back_start - cache autosizing: ipaca entry cache (3 total): 65536k [28/Oct/2019:15:24:34.446900772 +0100] - NOTICE - ldbm_back_start - cache autosizing: ipaca dn cache (3 total): 65536k [28/Oct/2019:15:24:34.480404651 +0100] - NOTICE - ldbm_back_start - cache autosizing: changelog entry cache (3 total): 65536k [28/Oct/2019:15:24:34.513586337 +0100] - NOTICE - ldbm_back_start - cache autosizing: changelog dn cache (3 total): 65536k [28/Oct/2019:15:24:34.545455448 +0100] - NOTICE - ldbm_back_start - total cache size: 444326133 B; [28/Oct/2019:15:24:34.660654207 +0100] - INFO - dblayer_start - Resizing db cache size: 82532761 -> 41672949 [28/Oct/2019:15:24:35.305068723 +0100] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES [28/Oct/2019:15:24:35.346977418 +0100] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [28/Oct/2019:15:24:35.389013473 +0100] - ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES [28/Oct/2019:15:24:35.430350643 +0100] - ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. [28/Oct/2019:15:24:35.472051056 +0100] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. [28/Oct/2019:15:24:35.712098113 +0100] - ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! [28/Oct/2019:15:24:35.767825035 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.847642467 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.889335963 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.906058664 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.922645682 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.939342751 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.973017877 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:35.997578015 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.047582540 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.122682002 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.175397700 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.222712999 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.255979639 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.400353621 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.464434060 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.570672924 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.638393241 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.697648930 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipatest,dc=intranet,dc=xxx,dc=de does not exist [28/Oct/2019:15:24:36.839033805 +0100] - WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild membership,cn=tasks,cn=config does not exist [28/Oct/2019:15:24:36.903400951 +0100] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=ipatest,dc=intranet,dc=xxx,dc=de--no CoS Templates found, which should be added before the CoS Definition. [28/Oct/2019:15:24:37.113354944 +0100] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa4.ipatest.intranet.XXX.de(a)IPATEST.INTRANET.XXX.DE] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [28/Oct/2019:15:24:37.132921236 +0100] - ERR - set_krb5_creds - Could not get initial credentials for principal [ldap/ipa4.ipatest.intranet.XXX.de(a)IPATEST.INTRANET.XXX.DE] in keytab [FILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm) [28/Oct/2019:15:24:37.152041659 +0100] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 389 for LDAP requests [28/Oct/2019:15:24:37.165159407 +0100] - INFO - slapd_daemon - Listening on All Interfaces port 636 for LDAPS requests [28/Oct/2019:15:24:37.184192580 +0100] - INFO - slapd_daemon - Listening on /var/run/slapd-IPATEST-INTRANET-XXX-DE.socket for LDAPI requests [28/Oct/2019:15:24:37.249042042 +0100] - ERR - schema-compat-plugin - schema-compat-plugin tree scan will start in about 5 seconds! [28/Oct/2019:15:24:42.261321976 +0100] - ERR - schema-compat-plugin - warning: no entries set up under cn=ng, cn=compat,dc=ipatest,dc=intranet,dc=XXX,dc=de [28/Oct/2019:15:24:42.336666961 +0100] - ERR - schema-compat-plugin - warning: no entries set up under cn=computers, cn=compat,dc=ipatest,dc=intranet,dc=XXX,dc=de [28/Oct/2019:15:24:42.381915111 +0100] - ERR - schema-compat-plugin - Finished plugin initialization. [28/Oct/2019:15:51:27.596490424 +0100] - INFO - op_thread_cleanup - slapd shutting down - signaling operation threads - op stack size 3 max work q size 4 max work q stack size 4 [28/Oct/2019:15:51:27.885286001 +0100] - INFO - slapd_daemon - slapd shutting down - closing down internal subsystems and plugins This IPA Server is one of my replica setup here at work at the other works fine. At home after the update i have the same problems, Any Help? Regards Dirk

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2019