April 2019 - FreeIPA-users - Fedora mailing-lists

RefererError: Missing or invalid HTTP Referer
by Manuki San 23 Apr '19

23 Apr '19

I have just installed FreeIPA. When opening the main page, I get a blank page (completely blank) with the following error in the console: Error: Couldn't receive translations app.js:3:14945 translations http://freeipa.home.lan/ipa/ui/js/freeipa/app.js?40702:3 I figured out that all files of the page were loaded correctly (loader.js, jsquery.js, dojo.js etc ..) except file /ipa/i18n_messages which failed with the following error: { "error": { "code": 911, "data": { "referer": "http://freeipa.home.lan/ipa/ui/" }, "message": "Missing or invalid HTTP Referer, http://freeipa.home.lan/ipa/ui/", "name": "RefererError" }, "id": null, "principal": "UNKNOWN", "result": null, "version": "4.7.2" } The request to fetch this particular file is built as the following: Host: freeipa.home.lan User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://freeipa.home.lan/ipa/ui/ Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 60 DNT: 1 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Now, when calling the same with Referer: https://freeipa.home.lan/ipa/ui/ (please not the "s" of https), I get what I suppose is the correct response, a json of size 13.68KB with different texts inside. QUESTION: Why is the loading of all components of the page with Referer: http://freeipa.home.lan/ipa/ui/ works correctly except for /ipa/i18n_messages ?

2 4

KDE administration not working for freeipa user
by Brian Watson | Watsontech.net 20 Apr '19

20 Apr '19

Hello, I have freeipa server (centos7) setup. I installed freeipa-client on my KDE Neon laptop. I can sign in with my freeipa user and am able to use sudo. But when asked for password whilst doing KDE administration, it does not work. Any logs I should check?

3 5

enable dns updates is applied but no dns updates
by Rob Verduijn 19 Apr '19

19 Apr '19

Hello, I have this laptop that is an ipa domain member. And the login/sudo/automount all works fine. However the dns entries of the laptop are not updated when the laptop starts up and gets a new ipaddress. I've looked in several configs and compared to other systems that work but can't seem to find it. Anybody got an idea where to look ? Rob my sssd.conf [domain/example.com] id_provider = ipa ipa_server = _srv_, freeipa01.example.com ipa_domain = example.com ipa_hostname = laptop.example.com auth_provider = ipa chpass_provider = ipa access_provider = ipa cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt dyndns_update = True dyndns_iface = * krb5_store_password_if_offline = True autofs_provider = ipa ipa_automount_location = laptop [sssd] services = nss, pam, ssh, sudo, autofs domains = example.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [secrets] [session_recording]

3 8

docker-compose and unnatended install
by Petar Kozić 19 Apr '19

19 Apr '19

Hi, does somebody know how can I do unnatended ipa-server-install with docker-compose ? I tried to add file ipa-server-install-options in /data (/var/lib/ipa-data) with this options: --realm=EXAMPLE.TEST --ds-password=The-directory-server-password --admin-password=The-admin-password as I saw here, but without success. https://hub.docker.com/r/freeipa/freeipa-server/ If someone do that before please can share info :) Thanks. *—* *Petar Kozić*

2 2

Scripting host certificate creation
by Ian Pilcher 18 Apr '19

18 Apr '19

I am trying to script the creation of a bunch of host certificates. Unlike the web UI, the CLI seems to require two separate steps to do this. (Please correct me if I'm wrong about this.) After I generate a key and CSR, I create a certificate with 'ipa cert-request'. I am using host/${HOSTNAME}@${REALM} as the principal, and I am saving the certificate with the --certificate-out option. Now I apparently need to use 'ipa host-add-cert' to add the certificate to the host, but this requires that the certificate be passed in base64 format on the command line. I'm sure I can figure out how to do this with some combination of sed, tr, etc., but this seems excessively painful. Is there really not a way to do this in a single step or feed a PEM-encoded certificate to 'ipa host-add-cert'? -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================

2 2

Logon returns Insufficient system resources exist to complete the requested service.
by Vex Mage 18 Apr '19

18 Apr '19

Hello, I've personally been using FreeIPA for some time and I love it immensely. I thought I'd start a post here due to the direction my troubleshooting has gone instead of the Samba mailing list. Allow me to explain what I've done, why I've done it and then the problem I'm having. I just recently started working for a school and the school has some Windows labs. A problem that has come to my attention is that the OpenLDAP to Samba3 NT4 domain they've been using for years is no longer compatible with Windows 10. To dispel any illusion, I'm not trying to get the NT4 domain working nice with Windows 10. Additionally Samba4 has changed its design structure such that OpenLDAP, or really any LDAP server except Samba4's internal LDAP server, will no longer work for the Active Directory. The school would like the Windows machines in the labs to authenticate students via their OpenLDAP credentials. I am open to alternatives but the closest thing I found was adding local users on each Windows workstation and having them authenticate to the FreeIPA server. The problem here is that users will continually be added and deleted. The Samba project would have us go all in with Samba4's internal LDAP server. While I'm not directly knocking that, since from my testing it seems to be quite functional, the upheaval would be tremendous. Fortunately we were already looking into switching to 389 before I came on so I've been touting the possibility of replacing OpenLDAP with FreeIPA before this Samba4 issue. A solution I thought should work is to use a trust between a FreeIPA (IPA) and a Samba4 Active Directory (AD). I've since configured both and have created that trust. I have a Windows 10 machine connected to the Samba4 domain. When I attempt to logon with an account from the IPA domain I am presented with "Insufficient system resources exist to complete the requested service." At first I took this message at face value and increased the memory of the workstation from which I'm trying to logon. There are few results from a Google search about this error without focusing on local memory. After reading and troubleshooting I believe this is a failure may be in the Kerberos InitializeSecurityContext function that's producing SEC_E_INSUFFICIENT_MEMORY, specifically on the Windows workstation and seemingly not coming from Samba4 AD. A couple things I've noticed; when I attempt to login as user@ipa if the password is wrong Windows tell me my password is incorrect. If I use the correct password I'm presented with that "Insufficient system resources exist to complete the requested service." The Event Viewer only shows me a generic logon error message. When I look at the Kerberos logs on both systems I see on AD that the 'Realm not local to KDC' and a 'No matching key in entry' but on IPA I see 'Additional pre-authentication required', then AS_REQ ISSUE and finally TGS_REQ ISSUE. I continued to do a tcpdump on port 88 to see who was directly communicating to the FreeIPA server and I found that the Windows workstation was making a direct Kerberos request. I then expanded my tcpdump to include all traffic from the workstation and upon another logon attempt only port 88 was used to communicate to FreeIPA. I therefore think that this is a Kerberos specific problem and not necessarily a Samba4 problem. Unfortunately I'm not knowledgeable enough in Kerberos to identify what's going on. I don't know what information I should present, such as configs or logs. Whatever is needed I can provide. I greatly appreciate any help, advice or potentially other non management nightmare solutions! Thank you all very much! [root@freeipa-dev log]# ipa trustdomain-find ad.school.edu Domain name: ad.school.edu Domain NetBIOS name: AD Domain Security Identifier: S-1-5-21-276971437-2632767696-819257926 Domain enabled: True ---------------------------- Number of entries returned 1 ---------------------------- -- Vex

3 3

AD Trust Integration Issue
by Henry Pelke 18 Apr '19

18 Apr '19

Good morning, I have recently setup an environment with FreeIPA 4.6.4-10 using CentOS 7 as the IPA Master. After setting up I joined the IPA master to the local AD and everything seemed to work fine. The issue I'm facing is that after adding the external and POSIX group's I can authenticate to the IPA Master as an AD user but the server with the IPA client doesn't appear to be able to authenticate AD users. The client server is unable to run getent or kinit against any ad user and returns 'Cannot find KDC for realm "<ad domain>"...' From the krb5kdc log I can see what looks to be an issue with the TGS request, and the errors TGS_REQ ISSUE: authtime as well as AS_REQ: NEEDED_PREAUTH additional preauth required. I have enabled debug logs for SSSD but nothing except sigterms has been logged so far. Please let me know if I can send any logs. Kind regards, HP

3 2

Directory manager password best practices
by Ian Pilcher 17 Apr '19

17 Apr '19

I am setting up a new IPA instance to provide DNS and CA services in a team lab. I have to decide what to use for the Directory Manager password — our standard, not very secure root password or something else, which no one will ever remember. Any thoughts? Is it still a major project to change the DM password? How hard is it to recover/reset it these days? (This will be IPA 4.6 on RHEL 7.) Thanks!

2 5

Password expired
by mustafa taha 17 Apr '19

17 Apr '19

Hi i want to ask , if there a way allows the admin to provide an account with password expired after certain of time. and after a certain time the password will not valid . i see there is field named " Password expiration" , how can i control it for specified user ?

4 3

Best practice backuping freeipa in docker
by Petar Kozić 17 Apr '19

17 Apr '19

Hi folks. I’m using freeipa in docker on one VM machine and for now, I satisfied how that works, but I worried about backup. Can someone tell me what is best practice for backup ipa which works in docker? Do I need to use backup scripts or some different method? Thank you in advance. *—* *Petar Kozić*

2 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2019