March 2019 - FreeIPA-users - Fedora mailing-lists

python-freeipa library
by Ilja Livenson 30 Mar '19

30 Mar '19

Hi, this is a small advertisement about a library that we wrote for automating management of identities in FreeIPA - https://github.com/opennode/python-freeipa / https://python-freeipa.readthedocs.io/. It's been out for quite a while and we use it in production as well. MIT licensed and with only a single dependency - requests. Unfortunately couldn't find something like this when we needed, so perhaps library will save some hours for somebody else. PRs are welcome! Current feature list is: - Login to FreeIPA server using username and password. - Search for users. - Display information about a user. - Add, modify and delete a user. - Get lockout status of a user account. - Enable and disable a user account. - Search for groups. - Display information about a named group. - Add, modify and delete a group. - Add members to a group. - Remove members from a group. - Change user password. - Add, modify and delete automount locations, maps and keys. cheers, Ilya

1 0

Ubuntu 18, recovering borked installation
by Andreas Ericsson 28 Mar '19

28 Mar '19

VERSION: 4.6.90.pre1+git20180411, API_VERSION: 2.229 I'm having issues setting up upgrading and/or setting up replication for my freeipa-server running on ubuntu 18.04. The same problem exists on three separate installations, making me quite sure it's not a random user error causing it. All the installations are single-node, with DNS-services and a CA installed, although the CA isn't (yet) used to generate any certificates for use outside the FreeIPA servers' own mesh of services. The problem I consistently get essentially boils down to this: IPA Error 4016: RemoteRetrieveError Failed to authenticate to CA REST API No matter if I try to upgrade, create a replica or just click my way to "Authentication -> Certificate Authorities -> ipa" (strangely enough, just clicking "Certificate Authorities" also throws up an error, but after clicking "ok" the list populates and the only entry, "ipa" is clickable but never gets me anywhere). I'm confident that fixing this problem would at least get me along to the next step of the road. Insofar as I understand it, there was a bug (is, in the version I'm running) causing renewal of client certificates for the CMS to somehow fail. That's consistent with what I see when running the following (output last, for those interested): getcert list | grep -B1 -A11 CA_REJECTED The number of certificates listed varies from server to server, with the oldest installation sporting four rejected certificates. I've been attempting to work around the issue for several days, using every trick of every link I've found when searching for others with similar problems, the most promising of which seemed to be to allow the CMS to connect to ldap using username and password instead of a client certificate. That didn't work. Neither did "ipa-backup" followed by "ipa-restore" on a fresh container installed with identical IP and system configuration as the original one, so I'm currently at a loss. Does anyone have any idea how I can get things working again? Pointers to related issues would also be very helpful, or shortcuts to where I can at least get the system upgraded to a version that has some sort of proper documentation. Unsurprisingly, doing a fresh install and then immediately upgrading to 4.7.1 from the ubuntu freeipa staging ppa works flawlessly, while my systems fails. Request ID '20190321175220': status: CA_REJECTED stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: /usr/lib/ipa/certmonger/stop_pkicad post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190321175221': status: CA_REJECTED stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: /usr/lib/ipa/certmonger/stop_pkicad post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20190321175222': status: CA_REJECTED stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: /usr/lib/ipa/certmonger/stop_pkicad post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes -- Request ID '20190321175225': status: CA_REJECTED stuck: yes key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca' CA: dogtag-ipa-ca-renew-agent issuer: subject: expires: unknown pre-save command: /usr/lib/ipa/certmonger/stop_pkicad post-save command: /usr/lib/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes

1 0

resetting a password via the API
by Anthony Jarvis-Clark 28 Mar '19

28 Mar '19

Hello Everyone, I'm testing out a FreeIPA password reset app and was wondering about its use of an API call to reset the user's password. The code in question is at https://github.com/larrabee/freeipa-password-reset/blob/master/PasswordRese… and it's at line 61/62: api.Command.user_mod(uid=unicode(uid), userpassword=unicode(password)) api.Command.user_mod(uid=unicode(uid), setattr=unicode("krbPasswordExpiration={0}".format(date))) When using the API, do you need to manually set the password expiration date? The reason I ask is because while testing, that code raises an exception with the error message "Insufficient access: Insufficient 'write' privilege to the 'krbPasswordExpiration' attribute of entry 'uid=test,cn=users,cn=accounts,dc=dev,dc=example,dc=net'." I checked the permission "System: Change User Password" and it doesn't include krbPasswordExpiration as a writable attribute. I know that if you use ldapmodify to manually set the user's password, you do need to also modify the krbPasswordExpiration attribute, but I wasn't sure when modifying via the IPA API. I hope this makes sense, thank you to everyone who answers questions on this list, you really positively impact the open source community! Many Thanks, Anthony

2 2

User certs in the webUI
by Stephen Berg (Code 7309) 28 Mar '19

28 Mar '19

Just noticed that when I view a user in the web UI I cannot see their certificates. From a command line the certs show up just fine. I'm browsing with Firefox 66.0.2 on a RHEL 7.6 system, servers are on 4.6.4 and CentOS 7.5 or 7.6. I did try the latest google-chrome and it behaved the same. Used a windows desktop and firefox and the certs show up in the webUI just fine. What is it about browsers on Linux that keeps that field from showing up? -- Stephen Berg, IT Specialist, Oceanography Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162

2 2

User certs in the webUI
by Stephen Berg (Code 7309) 27 Mar '19

27 Mar '19

Just noticed that when I view a user in the web UI I cannot see their certificates. From a command line the certs show up just fine. I'm browsing with Firefox 66.0.2 on a RHEL 7.6 system, servers are on 4.6.4 and CentOS 7.5 or 7.6. I did try the latest google-chrome and it behaved the same. Used a windows desktop and firefox and the certs show up in the webUI just fine. What is it about browsers on Linux that keeps that field from showing up? -- Stephen Berg, IT Specialist, Oceanography Division, Code 7309 Naval Research Laboratory W: (228) 688-5738 DSN: (312) 823-5738 C: (228) 365-0162

1 0

Where does DNS server come from?
by Kat 27 Mar '19

27 Mar '19

Hi all, Another weird question to ponder. In a client, working perfectly, and DNS is defined in resolv.conf as the IPA master within the LOCATION (yes, using the location feature of IPA). If I try to upgrade this same client to a replica using ipa-replica-install it fails with ipaserver.install.server.replicainstall: ERROR Could not resolve hostname ipa-master.example.com using DNS. And here is the kicker - when you look at the log of the install you see that the reason it could noto resolve ipa-master.example.com is NOT because it was not defined, but because it was now attempting to use the IPA master running DNS from another location and it timed out because firewalls block DNS lookup across these locations (although the masters can talk to each other) So my question is - why does replica-install pass a different DNS server to do the lookup rather than what was in /etc/resolv.conf? It is like it is asking to the master - "Hey, why not give me a random DNS server I can use?" and not relying on defined LOCATIONS. BTW - location features work perfectly for everything else, and you do see the proper weighting to SRV records so clients are not trying to contact the wrong IPA master to work. This has me baffled and I am trying to understand how I can get ipa-replica-install to NOT use a random DNS server in another location. Any ideas? Thanks -K

2 3

Something amiss with my replication
by Bret Wortman 26 Mar '19

26 Mar '19

Looks like I've somehow managed to get my 3 IPA servers out of sync: [root@ipa3 ~]# ipa-replica-manage list ipa3.my.net: master ipa4.my.net: master ipa5.my.net: master [root@ipa3 ~]# ipa host-find solr14.my.net --------------- 0 hosts matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- On ipa4: [root@ipa3 ~]# ipa host-find solr14.my.net --------------- 1 hosts matched --------------- Host name: solr14.my.net ---------------------------- Number of entries returned 1 ---------------------------- On ipa5: [root@ipa3 ~]# ipa host-find solr14.my.net --------------- 1 hosts matched --------------- Host name: solr14.my.net Principal name: host/solr14.my.net(a)MY.NET (mailto:host/solr14.my.net@MY.NET) : : ---------------------------- Number of entries returned 1 ---------------------------- So they've obviously stopped talking. What's the right way to get them back in sync and ensure that they don't drift again? Is there a replication entry that's "stuck" and causing this? Bret Wortman Founder, Damascus Products, LLC 855-644-2783 (tel:855-644-2783) | bret(a)wrapbuddies.co (mailto:bret@wrapbuddies.co) http://wrapbuddies.co/ 70 Main St. Suite 23 Warrenton, VA 20186

3 8

Certificate renewal question
by Jeff Goddard 26 Mar '19

26 Mar '19

Hello everyone and thanks for providing the FreeIPA platform. I've got a situation where I have 4 FreeIPA peer servers, with 2 of them being CAs with replication configured. These are split into 2 physical locations with 1 CA per site. I was testing renewal of the "nickname='subsystemCert cert-pki-ca" certificate in one of my sites by issuing ipa-getcert resubmit -i [cert ID#]. Now this certificate seems to be stuck with a status of CA_Working. Since its been over 4 hours since I submitted the request I'm wondering if something went wrong and where I can begin looking to troubleshoot. I tried running ipa-certupdate to sync from the other CA master and it completed successfully. The original certificate was not expired and other than the "CA Working" status there are no apparent problems. The server is version 4.6.4 running on Centos 7.4. Do I have reason to be concerned or is this expected behavior? Thanks, Jeff

4 8

IPA 4.6.4 Error 32 Help Please
by Günther J. Niederwimmer 26 Mar '19

26 Mar '19

Hello, I found thousands of Errors in my "dirsrv Log" I mean after update to the last CentOS 7.6, or after I have to reinstall my secondary IPA Server ? What is the way to correct this mistake Problem? I have a second pair of IPA Server without this Problem and I can't say why this is now a Problem! The Errors are on the "oldest" Server, this Server is upgraded continuous from CentOS 7 to 7.6 Can any help or can say why I now have this Problem? The Log on the master/replica Server ipa.example.com I change the domain Name [16/Mar/2019:13:59:39.333399526 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:04:39.497505189 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:09:39.673523056 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:14:39.457745480 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:19:39.435129140 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:24:39.460920984 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [16/Mar/2019:14:29:39.687580220 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) Thank's for a answer, -- mit freundliche Grüßen / kind regards, Günther J. Niederwimmer

3 5

Replication issues, 3 servers not talking
by Bret Wortman 26 Mar '19

26 Mar '19

I've got 3 IPA servers, with replication agreements between the 3 as follows: [root@ipa3 ~]# ipa-replica-manage list ipa3.my.net: master ipa4.my.net: master ipa5.my.net: master [root@ipa3 ~]# ipa-replica-manage list ipa3.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) ipa4.my.net: (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) replica ipa5.my.net: (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) replica [root@ipa3 ~]# ipa-replica-manage list ipa4.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) ipa3.my.net: (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) replica [root@ipa3 ~]# ipa host-find solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) --------------- 0 hosts matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ipa4 ~]# ipa host-find solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) --------------- 1 hosts matched --------------- Host name: solr14.my.net ---------------------------- Number of entries returned 1 ---------------------------- [root@ipa5 ~]# ipa host-find solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) --------------- 1 hosts matched --------------- Host name: solr14.my.net (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) Principal name: host/solr14.my.net(a)MY.NET (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) : : ---------------------------- Number of entries returned 1 ---------------------------- So obviously something's gone awry. Did I somehow cause this? How can I prevent it in the future and how do I best go about getting 3 servers that agree with each other (short of picking one and re-replicating it to the others via re-initialize)? Bret Wortman Founder, Damascus Products, LLC 855-644-2783 (tel:855-644-2783) | bret(a)wrapbuddies.co (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) http://wrapbuddies.co/ (https://link.getmailspring.com/link/174919A3-6460-44D7-9328-2DE64BCCCDF6@ge…) 70 Main St. Suite 23 Warrenton, VA 20186

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019