March 2019 - FreeIPA-users - Fedora mailing-lists

unable to have ipa users only
by Albert Szostkiewicz 17 Mar '19

17 Mar '19

Now this might be more of a distro issue rather than IPA itself and I have already reported it on bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1688363) and tried to get any answers on ask fedora but no luck (https://ask.fedoraproject.org/en/question/133793/fresh-fedora-with-domain-o…). Long story short: 1. with fresh, new fedora 29 installation, instead of creating a user, i choose domain user 2. login as domain user, sessions starts and everything looks normal 3. after restart, i am being greet yet again with 'gnome-initial-setup' like no user exists 4. if i do create some some local user just for sake of not getting initial setup, and log-in as ipa domain user, any 'Administrator' authentication is asking for local user password (not the ipa user i am logged as). 5. if i would remove local user, i would get 'gnome-initial-setup' all over again So I was wondering if any of you had or heard about similar issues and ideas for solution. So far I've tried manually adding ipa user to wheel group but that did not help.

1 0

LDAP module configuration
by Boudjoudad Abdelkader 15 Mar '19

15 Mar '19

Hello Alexander and all, Can you someone please let me know what's the group object in LDAP 389 DS ? I have this path to search the groups but it's not returning results: In /etc/raddb/mods-enabled/ldap: ldap { server = 'freeipa.dc=server,dc=example,dc=com # port = 389 # identity = 'cn=admin,dc=server,dc=example,dc=com' # password = mypass base_dn = 'cn=users,cn=accounts,dc=server,dc=example,dc=com' ... } group { base_dn = 'cn=groups,cn=accounts,dc=server,dc=example,dc=com' dc=example,dc=com name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = memberOf ... } What i'm missing in group base_dn path ? Thanks,

2 4

No group membership attribute(s) found in user object
by Boudjoudad Abdelkader 15 Mar '19

15 Mar '19

Hi, I'm trying to check if user is in a given group name in LDAP but it doesn't work, here is the configuration: - vi /etc/raddb/mods-enabled/ldap ldap { ... base_dn = 'cn=users,cn=accounts,dc=server,dc=example,dc=com' ... } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' scope = 'sub' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = memberOf cacheable_name = 'yes' cacheable_dn = 'yes' # cache_attribute = 'LDAP-Cached-Membership' The result: rlm_ldap (ldap): Reserved connection (2) (0) Using user DN from request "uid=ttest2,cn=users,cn=accounts,dc=server,dc=example,dc=com" (0) Checking for user in group objects (0) EXPAND (&(cn=ipausers)(objectClass=posixGroup)(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))) (0) --> (&(cn=ipausers)(objectClass=posixGroup)(|(member=uid\3dttest2\2ccn\3dusers\2ccn\3daccounts\2cdc\3dserver\2cdc\3dexample\2cdc\3com)(memberUid=ttest2))) (0) Performing search in "cn=users,cn=accounts,dc=server,dc=example,dc=com" with filter "(&(cn=ipausers)(objectClass=posixGroup)(|(member=uid\3dttest2\2ccn\3dusers\2ccn\3daccounts\2cdc\3dserver\2cdc\3dexample\2cdc\3dcom)(memberUid=ttest2)))", scope "sub" (0) Waiting for search result... (0) Search returned no results (0) Checking user object's memberOf attributes (0) Performing unfiltered search in "uid=ttest2,cn=users,cn=accounts,dc=server,dc=example,dc=com", scope "base" (0) Waiting for search result... (0) No group membership attribute(s) found in user object What i'm missing ? Thanks,

2 10

Resolution issues (SERVFAIL)
by Dmitry Perets 15 Mar '19

15 Mar '19

Hi, I am experiencing a strange issue with DNS resolution between my replicas, could you please help me to figure it out? My topology is: rhel-ipa.ims.example.com => rhel-ipa-replica.ams.ims.example.com => rhel-ipa-newreplica.ams.ims.example.com All three are IPA servers with DNS. And I've created two zones: "ims.example.com" and "ams.ims.example.com". It worked fine while I had just two first IPA servers, both servers could resolve any host in any of the two zones. But now I added the third IPA server (rhel-ipa-newreplica), and that new host cannot resolve anything in the parent domain "ims.example.com"... $ dig rhel-ipa.ims.telekom.de ; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> rhel-ipa.ims.example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61092 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;rhel-ipa.ims.example.com. IN A ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Mar 14 18:02:46 CET 2019 ;; MSG SIZE rcvd: 52 What am I missing here...? As per my understanding, each IPA server should "feel" authoritative for each of the two zones, because they are replicated. So even forwarding should not take place here... Btw I tried to play with forwarder configuration, but so far - no luck. What am I missing for this setup to work...? How to make rhel-ipa-newreplica to resolve hosts from parent domain...? -- Regards, Dmitry Perets. "The more one knows, the less opinions he shares" -- Wilhelm Schwebel

1 1

error 32 (No such object)
by Günther J. Niederwimmer 15 Mar '19

15 Mar '19

Hello, I found on the logs this Error, but I can't say what it mean? I have a primary IPA Server (ipa.example.com) and a secondary IPA Server (ipa1.example.com) I mean this is running now a long time. But on the "older" primary now I have this Errors. [15/Mar/2019:09:55:36.268953631 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:00:36.523786880 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:05:36.658511034 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:10:36.262165631 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:15:36.375852651 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:20:36.318006003 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:25:36.443969376 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:30:36.431541771 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) [15/Mar/2019:10:35:36.411241412 +0100] - ERR - slapi_ldap_bind - Error: could not bind id [cn=Replication Manager cloneAgreement1-ipa1.example.com-pki- tomcat,ou=csusers,cn=config] authentication mechanism [SIMPLE]: error 32 (No such object) Can any please help for this Problem -- mit freundliche Grüßen / best regards, Günther J. Niederwimmer

1 0

Re: Configuring SSL Ciphers for FreeIPA / DogTag on port 8443
by Christopher Lamb 14 Mar '19

14 Mar '19

3 2

Configuring SSL Ciphers for FreeIPA / DogTag on port 8443
by Christopher Lamb 13 Mar '19

13 Mar '19

3 4

Sub-zone client fails to install, GSS authentication pre-auth issues
by Callum Smith 13 Mar '19

13 Mar '19

Dear IPA Gurus I have a client that's incapable of joining the FreeIPA realm, it's in a different DNS sub-zone but is in the same realm. I get the feeling that there's a kerberos principal missing somewhere to get this all to work, but I can't quite see where it might be. Simple authentication ldapsearch using cn=Directory Manager functions perfectly well to the ipa host in question, however anonymous binds are disabled. I'm not clear why this wouldn't be working. Regards, Callum -- Callum Smith Research Computing Core Wellcome Trust Centre for Human Genetics University of Oxford e. callum(a)well.ox.ac.uk<mailto:callum@well.ox.ac.uk>

2 30

problem access Linux shares from Windows "ticket is likely out of date"
by fujisan 13 Mar '19

13 Mar '19

I messed up somehow with my samba server. I'm trying to access a linux share from windows and the log on the linux server says: [Unspecified GSS failure. Minor code may provide more information: Request ticket server cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL kvno 8 not found in keytab; ticket is likely out of date] How can I fix this? Thank you. ----------------------------------------- # net ads keytab list Vno Type Principal 16 AES-256 CTS mode with 96-bit SHA-1 HMAC cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL 16 AES-128 CTS mode with 96-bit SHA-1 HMAC cifs/myserver.mydomain.local(a)MYDOMAIN.LOCAL ----------------------------------------- # net conf list [global] workgroup = MYDOMAIN.LOCAL netbios name = MYSERVER realm = MYDOMAIN.LOCAL kerberos method = dedicated keytab dedicated keytab file = /etc/samba/samba.keytab create krb5 conf = no security = user domain master = yes domain logons = yes log level = 1 max log size = 100000 log file = /var/log/samba/log.%m passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-MYDOMAIN-LOCAL.socket disable spoolss = yes ldapsam:trusted = yes ldap ssl = off ldap suffix = dc=mydomain,dc=local ldap user suffix = cn=users,cn=accounts ldap group suffix = cn=groups,cn=accounts ldap machine suffix = cn=computers,cn=accounts rpc_server:epmapper = external rpc_server:lsarpc = external rpc_server:lsass = external rpc_server:lsasd = external rpc_server:samr = external rpc_server:netlogon = external rpc_server:tcpip = yes rpc_daemon:epmd = fork rpc_daemon:lsasd = fork [scratch] path = /data/scratch comment = Scratch shared files create mask = 0644 invalid users = opera

3 12

nfsidmap/nss_getpwnam fails to resolve users with IPA/NFSv4+krb5
by Robert Sturrock 12 Mar '19

12 Mar '19

Hi All. We have IPA setup in an AD trust to support our Linux fleet. I’m running into a problem trying to get Ubuntu (16.04) clients to resolve names/ids on an NFS-mounted filesystem from an NFS server using NFSv4/krb5. Files and directories show up as ‘nobody’ or an incorrect numerical ID when listed with ‘ls’. RHEL7 clients seem to working fine with a very similar configuration (as far as I can tell). The particulars are: - AD forest has domains ‘localdomain’ and ‘student.localdomain’ (my user identity is ‘user@localdomain’) - IPA domain is ‘ipa.localdomain’ - The NFS server (RHEL7) and clients (Ubu16.04, RHEL7) are both enrolled to IPA (with 'Domain=ipa.localdomain’ in /etc/idmapd.conf). I have mounted the NFS volume on the clients with a simple: mount -t nfs4 nfs-server.ipa.localdomain:/export /mnt Listing my directory as myself (‘rns@localdomain’) on the Ubuntu client, I see: $ ls -ld rns drwx------ 18 nobody 4294967294 4096 Oct 25 15:18 rns .. with these corresponding nfsidmap messages: Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: key: 0x2c254c26 type: uid value: rns@localdomain@ipa.localdomain timeout 600 Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: calling nsswitch->name_to_uid Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nss_getpwnam: name 'rns@localdomain@ipa.localdomain' domain 'ipa.localdomain': resulting localname '(null)' Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nss_getpwnam: name 'rns@localdomain@ipa.localdomain' does not map into domain 'ipa.localdomain' Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: nsswitch->name_to_uid returned -22 Oct 25 16:49:42 ubuntu-16.04-client.sub.localdomain nfsidmap[6163]: nfs4_name_to_uid: final return value is -22 .. whereas on the RHEL7 client, I see: $ ls -ld rns drwx------. 18 rns@localdomain rns@localdomain 4096 Oct 25 15:18 rns Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: key: 0xf113fd2 type: uid value: rns@localdomain@ipa.localdomain timeout 600 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nfs4_name_to_uid: calling nsswitch->name_to_uid Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nss_getpwnam: name 'rns@localdomain@ipa.localdomain' domain 'ipa.localdomain': resulting localname 'rns@localdomain' Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nfs4_name_to_uid: nsswitch->name_to_uid returned 0 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30590]: nfs4_name_to_uid: final return value is 0 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: key: 0x2125a5d2 type: gid value: rns@localdomain@ipa.localdomain timeout 600 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: nfs4_name_to_gid: calling nsswitch->name_to_gid Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: nfs4_name_to_gid: nsswitch->name_to_gid returned 0 Oct 25 16:56:23 rhel-7-client.sub.localdomain nfsidmap[30592]: nfs4_name_to_gid: final return value is 0 Why does the Ubuntu client's nfsidmap think that my identity doesn’t map into ‘ipa.localdomain’ and therefore (presumably) returns the error code ‘-22’? (My identity resolves ok from the shell, using ‘id rns@localdomain’ and I can login and use local filesystems without issue). The idmapd.conf looks like this: [General] Verbosity = 4 Pipefs-Directory = /run/rpc_pipefs Domain = ipa.localdomain Local-Realms = LOCALDOMAIN, STUDENT.LOCALDOMAIN, IPA.LOCALDOMAIN [Mapping] Nobody-User = nobody Nobody-Group = nogroup [Translation] Method = nsswitch Any pointers appreciated! Regards, Robert.

3 5

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2019