FreeIPA-users February 2019

freeipa-users@lists.fedorahosted.org

56 participants
78 discussions

DNS A record for IPA server is not created
by Dmitry Perets 04 Feb '19

04 Feb '19

Hi, With ipa-server 4.6.4-10.el7_6.2 on RHEL7, I see the following issue.... My host name is a bit long, of a form: idm01.site01.poc.my.network.com I am installing a fresh new IPA server on this host, with DNS server. Running ipa-server-install without arguments. During installation I can specify the DNS zone to create. If I specify poc.my.network.com, then I get the following error: ipapython.dnsutil: ERROR DNS query for idm01.site01.poc.my.network.com. 1 failed: All nameservers failed to answer the query idm01.site01.poc.my.network.com. IN A: Server 127.0.0.1 UDP port 53 answered SERVFAIL I can see that the A record for the IPA server itself (idm01.site01) wasn't created during installation. But if I leave the default DNS zone (site01.poc.my.network.com), then everything works fine, the record is created (the record name in that case is just idm01). Of course, I can create the record manually, and it seems to work fine. But is it expected? Any other issues that I should expect with my non-default zone...? -- Regards, Dmitry Perets. "The more one knows, the less opinions he shares" -- Wilhelm Schwebel

2 2

external ocsp ?
by veer Schlansky 04 Feb '19

04 Feb '19

My company's PIV/AD credintial is user(a)example.com. We set up our IPA credintial as user(a)linux.example.com example.com and linux.example.com are completedly seperated domain/realms, no trust or interaction whatsoever. I took the user and CA certs on the PIV card and put them into ipa. I was able to authenticate to ipa webui with my PIV card. My question is does ipa do online certificate status protocol check for the user(a)example.com cert? Any way to verify that? Thanks.

6 7

Error: "has a RID that is larger than the ldap_idmap_range_size"
by SOLER SANGUESA Miguel 04 Feb '19

04 Feb '19

Hello again, I have resolved the problem myself. Following https://access.redhat.com/solutions/659243 the sssd cache must be erased using: service sssd stop; rm -f /var/lib/sss/db/*; service sssd start seems that the way I used "sss_cache -E" doesn't work on this. Thanks & Regards. From: SOLER SANGUESA Miguel Sent: Monday, February 04, 2019 12:46 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Subject: Error: "has a RID that is larger than the ldap_idmap_range_size" hello, I have a IDM cluster (Master + Replica) verison 4.5.4 on REHL 7.4. I have created a trust with an AD 2016 domain AD.COMPANY.ORG. Some users are working properly, but I created a new AD user and it is not working. Checking on the sssd logs I found: [sdap_idmap_sid_to_unix] (0x0040): Object SID [S-1-5-21-XXXXXXXXX-2674911608-YYYYYYYY-208726] has a RID that is larger than the ldap_idmap_range_size. See the "ID MAPPING" section of sssd-ad(5) for an explanation of how to resolve this issue. [sdap_idmap_sid_to_unix] (0x0080): Could not convert objectSID [S-1-5-21-XXXXXXXXX-2674911608-YYYYYYYY-208726] to a UNIX ID [sssd[be[ipa.AD.COMPANY.ORG]]] [sdap_save_user] (0x0020): Failed to save user [user(a)AD.COMPANY.ORG] [sssd[be[ipa.AD.COMPANY.ORG]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. I've googled it and I found that the range for default has 200000 size, and as the last number of the SID (in this case 208726) is the used for the ID, it is bigger than the range so it is normal the error. The problem is that I have modified the range size: # ipa idrange-mod --range-size=600000 Range name: AD.COMPANY.ORG_id_range ------------------------------------------- Modified ID range "AD.COMPANY.ORG_id_range" ------------------------------------------- Range name: AD.COMPANY.ORG_id_range First Posix ID of the range: 1467600000 Number of IDs in the range: 600000 First RID of the corresponding RID range: 0 Domain SID of the trusted domain: S-1-5-21-185866794-2674911608-285463921 Range type: Active Directory domain range I have restarted IPA service, reset sssd cache and I get the same error. Any idea why it is still failling? Thanks & Regards.

1 0

Error: "has a RID that is larger than the ldap_idmap_range_size"
by SOLER SANGUESA Miguel 04 Feb '19

04 Feb '19

hello, I have a IDM cluster (Master + Replica) verison 4.5.4 on REHL 7.4. I have created a trust with an AD 2016 domain AD.COMPANY.ORG. Some users are working properly, but I created a new AD user and it is not working. Checking on the sssd logs I found: [sdap_idmap_sid_to_unix] (0x0040): Object SID [S-1-5-21-XXXXXXXXX-2674911608-YYYYYYYY-208726] has a RID that is larger than the ldap_idmap_range_size. See the "ID MAPPING" section of sssd-ad(5) for an explanation of how to resolve this issue. [sdap_idmap_sid_to_unix] (0x0080): Could not convert objectSID [S-1-5-21-XXXXXXXXX-2674911608-YYYYYYYY-208726] to a UNIX ID [sssd[be[ipa.AD.COMPANY.ORG]]] [sdap_save_user] (0x0020): Failed to save user [user(a)AD.COMPANY.ORG] [sssd[be[ipa.AD.COMPANY.ORG]]] [sdap_save_users] (0x0040): Failed to store user 0. Ignoring. I've googled it and I found that the range for default has 200000 size, and as the last number of the SID (in this case 208726) is the used for the ID, it is bigger than the range so it is normal the error. The problem is that I have modified the range size: # ipa idrange-mod --range-size=600000 Range name: AD.COMPANY.ORG_id_range ------------------------------------------- Modified ID range "AD.COMPANY.ORG_id_range" ------------------------------------------- Range name: AD.COMPANY.ORG_id_range First Posix ID of the range: 1467600000 Number of IDs in the range: 600000 First RID of the corresponding RID range: 0 Domain SID of the trusted domain: S-1-5-21-185866794-2674911608-285463921 Range type: Active Directory domain range I have restarted IPA service, reset sssd cache and I get the same error. Any idea why it is still failling? Thanks & Regards.

1 0

DHCP + FreeIPA: How to ensure DHCP only servers those IP's NOT defined in FreeIPA DNS?
by TomK 03 Feb '19

03 Feb '19

Hey All, Would like to ensure that if a DHCP server issues an IP, that it also checks the FreeIPA (DNS) to ensure that IP hasn't been defined before. Anyway to do that? Currently if a virtual host has been offline for a while, the DHCP serves it's IP to new hosts being built. -- Cheers, Tom K. ------------------------------------------------------------------------------------- Living on earth is expensive, but it includes a free trip around the sun.

2 2

ca-error 1: Invalid Credential
by Torsten Harenberg 01 Feb '19

01 Feb '19

Dear all, we are running a pair of IPA servers. Our master seems to run fine. It had some certificate expired, but we could solve this by setting the time back, renewing all certificates and getting him back to today. Now the "slave" server has also some expired certificates: [root@ipa ca]# getcert list |grep expires expires: 2021-01-14 08:53:15 UTC expires: 2019-01-29 08:07:57 UTC expires: 2019-01-29 08:07:17 UTC expires: 2035-03-19 07:41:20 UTC expires: 2019-01-29 08:06:57 UTC expires: 2020-08-09 11:55:16 UTC expires: 2020-08-31 11:55:19 UTC expires: 2020-08-31 11:55:38 UTC [root@ipa ca]# So we tried the same receipe and could update the first of those certificates, but now starting the 2nd one, we got stuck. ipa-cacert-manage renew failes and also the other certificates cannot be updated with Request ID '20170505060648': status: MONITORING ca-error: Server at "https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=PLEIADES.UNI-WUPPERTAL.DE subject: CN=OCSP Subsystem,O=PLEIADES.UNI-WUPPERTAL.DE expires: 2019-01-29 08:07:57 UTC eku: id-kp-OCSPSigning pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes a getcert resubmit -i 20170505060648 brings up the same error message soon after. In the logs we found: /var/log/pki/pki-tomcat/ca/debug [25/Jan/2019:10:12:24][http-bio-8443-exec-7]: CertUserDBAuthentication: cannot map certificate to any user [25/Jan/2019:10:12:24][http-bio-8443-exec-7]: SignedAuditEventFactory: create() message created for eventType=AUTH_FAIL /var/log/messages Jan 25 10:12:24 ipa certmonger: 2019-01-25 10:12:24 [2829] Server at "https://ipa.pleiades.uni-wuppertal.de:8443/ca/agent/ca/profileProcess" replied: 1: Invalid Credential. Any hint would be really appreciated. Thanks a lot Torsten -- Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de Bergische Universitaet Fakultät 4 - Physik Tel.: +49 (0)202 439-3521 Gaussstr. 20 Fax : +49 (0)202 439-2811 42097 Wuppertal

2 2

ipa-replica-install error - no-such-object ldap
by Arjen Heidinga 01 Feb '19

01 Feb '19

Dear all, Perhaps someone could shed some light on what is amiss here. I am trying to install a IPA replica to an ancient freeipa server, which has always run standalone. I have attached the logs for you to read. It seems there is missing something in de ldap tree. Server and replica-to-be are running Fedora 29, freeipa 4.7.2. The (i suppose) relevant stacktrace is here: 2019-01-21T13:17:44Z DEBUG [28/41]: setting up initial replication 2019-01-21T13:17:45Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-PLATYPUSNET-ORG.socket conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f03f2114710> 2019-01-21T13:17:45Z DEBUG Destroyed connection context.ldap2_139654961964256 2019-01-21T13:17:45Z DEBUG Starting external process 2019-01-21T13:17:45Z DEBUG args=['/bin/systemctl', '--system', 'daemon-reload'] 2019-01-21T13:17:46Z DEBUG Process finished, return code=0 2019-01-21T13:17:46Z DEBUG stdout= 2019-01-21T13:17:46Z DEBUG stderr= 2019-01-21T13:17:46Z DEBUG Starting external process 2019-01-21T13:17:46Z DEBUG args=['/bin/systemctl', 'restart', 'dirsrv(a)PLATYPUSNET-ORG.service'] 2019-01-21T13:17:51Z DEBUG Process finished, return code=0 2019-01-21T13:17:51Z DEBUG stdout= 2019-01-21T13:17:51Z DEBUG stderr= 2019-01-21T13:17:51Z DEBUG Restart of dirsrv(a)PLATYPUSNET-ORG.service complete 2019-01-21T13:17:51Z DEBUG Created connection context.ldap2_139654961964256 2019-01-21T13:17:52Z DEBUG Fetching nsDS5ReplicaId from master [attempt 1/5] 2019-01-21T13:17:52Z DEBUG retrieving schema for SchemaCache url=ldap://starkey.platypusnet.org:389 conn=<ldap.ldapobject.SimpleLDAPObject object at 0x7f03f28c7668> 2019-01-21T13:17:52Z DEBUG Successfully updated nsDS5ReplicaId. 2019-01-21T13:17:52Z DEBUG Add or update replica config cn=replica,cn=dc\=platypusnet\,dc\=org,cn=mapping tree,cn=config 2019-01-21T13:17:52Z DEBUG Unhandled LDAPError: OPERATIONS_ERROR: {'desc': 'Operations error'} 2019-01-21T13:17:52Z DEBUG Traceback (most recent call last): File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1023, in error_handler yield File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1517, in find_entries raise e File "/usr/lib/python3.7/site-packages/ipapython/ipaldap.py", line 1477, in find_entries result = self.conn.result3(id, 0) File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 749, in result3 resp_ctrl_classes=resp_ctrl_classes File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 756, in result4 ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop) File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 329, in _ldap_call reraise(exc_type, exc_value, exc_traceback) File "/usr/lib64/python3.7/site-packages/ldap/compat.py", line 44, in reraise raise exc_value File "/usr/lib64/python3.7/site-packages/ldap/ldapobject.py", line 313, in _ldap_call result = func(*args,**kwargs) ldap.NO_SUCH_OBJECT: {'desc': 'No such object'} Kind Regards, Arjen Heidinga

2 3

light sub-cas crl / ocsp urls
by Natxo Asenjo 31 Jan '19

31 Jan '19

hi, at work I am testing using a light sub-ca with openvpn to limit the scope of hosts that can auto request a certificate. So far so good, really impressed with how well it works. The question I cannot answer is: are there specific urls for crl/ocsp for sub-cas, or do the 'generic' crl/ocsp url apply to sub-cas as well? Thanks for your support. Regards, -- Groeten, natxo

3 2

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2019