August 2019 - FreeIPA-users - Fedora mailing-lists

Create a virtual env python with ipa module included
by lune voo 26 Aug '19

26 Aug '19

Hello everyone. I was wondering if it is possible to embed ipa modules in a python virtual environment ? Or is it too tightly linked with the ipa-client installed on the system ? Best regards. Lune

2 6

Inactive users
by Boyd Ako 23 Aug '19

23 Aug '19

Is there any way to check when a user has last logged into any of the systems? I've tried `ipa user-show`, but the "Last Successful Authentication" is N/A.

4 6

kadmin principal for an IPA master, but not for slave.
by TomK 22 Aug '19

22 Aug '19

Hey All, The primary master I have has the kadmin principal for it: kadmin/ipa03.mws.mds.xyz(a)MWS.MDS.XYZ The slave (idmipa04) doesn't have a corresponding kadmin/... principal entry. Can't find these principals in the UI. 1) Should the slave installer have created the slave kadmin/... principal? 2) If I wanted to create one, should the pass be any random string or something specific? 3) Are there specific IPA commands to create the kadmin/... principals with? Thx for taking a look. -- Thx, TK.

2 3

Re: Add Subject Alternative Name of HA/LB host to LDAPS servers?
by Daniel Oetken 22 Aug '19

22 Aug '19

Why doesn’t terminating SSL on the proxy work with LDAPS? Because it should, and says so too here: https://www.mail-archive.com/haproxy@formilux.org/msg21657.html Though, I’m looking into the same thing to add SAN to the server certificate and wondering about similar questions. When you look at “ipa-getcert list” you should see the current certificates already, including their settings, so I was thinking to just stop tracking those old ones and create new ones like you did, except with the exact same options as the old ones (+ SAN). But yeah, I’m not sure if there is anything else involved, or if there is a better way. I only started using freeipa recently.

3 6

Re: Disabled user accounts
by Alexander Bokovoy 22 Aug '19

22 Aug '19

On to, 22 elo 2019, Angus Clarke via FreeIPA-users wrote: >Hi all > >Just an observation really, some of our users complained that their IdM >login names did not match other systems' - we saw IdM as the easiest >place to fix this (as opposed to modifying local accounts on hundreds >of none-IdM enabled *nix boxes around the estate) You can rename accounts with ipa user-mod --rename $ ipa user-mod some-user --rename=another-user ------------------------- Modified user "some-user" ------------------------- User login: another-user .... >Rightly or wrongly, the approach we took was to disable angusc account >and add new account aclarke using the same UID number. How did you disable it? 'ipa user-disable'? This just leaves this user in the tree and marks its account not possible to use for authentication. >One of our users spotted this happening occasionally: > > >[aclarke@orabledb ~]$ id >uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas) > >We're now deleting the disabled accounts from IdM. > >$ rpm -q ipa-server >ipa-server-4.6.4-10.0.1.el7_6.3.x86_64 -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

Disabled user accounts
by Angus Clarke 22 Aug '19

22 Aug '19

Hi all Just an observation really, some of our users complained that their IdM login names did not match other systems' - we saw IdM as the easiest place to fix this (as opposed to modifying local accounts on hundreds of none-IdM enabled *nix boxes around the estate) Rightly or wrongly, the approach we took was to disable angusc account and add new account aclarke using the same UID number. One of our users spotted this happening occasionally: [aclarke@orabledb ~]$ id uid=1234(angusc) gid=1234(aclarke) groups=1234(aclarke),2345(dbas) We're now deleting the disabled accounts from IdM. $ rpm -q ipa-server ipa-server-4.6.4-10.0.1.el7_6.3.x86_64 Regards Angus

1 0

Add Subject Alternative Name of HA/LB host to LDAPS servers?
by Jonathan Vaughn 22 Aug '19

22 Aug '19

I've seen some guides for doing reverse proxy of SSL using Apache/Nginx which seem to side step the SSL issue by terminating SSL in the proxy but that only works for actual HTTPS connections to the FreeIPA UI, not for LDAPS. I have got keepalived + HAProxy configured such that accessing ipa.example.com will go through HAProxy and on to FreeIPA for LDAP(S). LDAP works perfectly fine, LDAPS works if the client can ignore the SSL certificate name mismatch (since of course, the SSL certificate will be ipa-11.example.com or ipa-12.example.com or whatever the FreeIPA server actually is). We need this because Atlassian doesn't want to support multiple LDAP host names in configuration without paying for Crowd (which is a pretty redundant product when we have FreeIPA already). Additionally, I can't disable the hostname check for SSL either, which would at least work around the issue, so we need to get ipa.example.com into each FreeIPA LDAP server's SSL certificate. How can I add ipa.example.com as SAN to the SSL certificate used by 389DS in FreeIPA? At first I thought maybe I should start with adding HTTP/ipa.example.com as a principal alias to each HTTP/ipa-(server).example.com and then reissue the SSL but apparently I can only add the alias to a single principal (can't have it on multiple servers)... The basic layout is this: 10.0.0.10 : ipa.example.com (virtual IP / VRRP) 10.0.0.11 : ipa-11.example.com 10.0.0.12 : ipa-12.example.com HAproxy runs on both ipa-11 and ipa-12 and each instance of HAproxy is configured to sticky sessions. Keepalived runs on both ipa-11 and ipa-12, both configured as master but with ipa-11 set as a higher priority so that nominally all requests go to ipa-11 unless ipa-11 is down, in which case the virtual IP moves to the other server. When connecting to ipa.example.com, connection may end up at either of ipa-11.example.com or ipa-12.example.com, and we need them both to have ipa.example.com in addition to their real server name in the SSL certificate for LDAPS to work correctly. So the certificate for ipa-11.example.com should include in SAN both ipa-11.example.com and ipa.example.com, and the certificate for ipa-12.example.com should include in SAN both ip-12.example.com and ipa.example.com.

2 2

Unable to add managed entry
by yousif raed 20 Aug '19

20 Aug '19

Hello , a while ago I've migrated from an old freeipa server to a new server everything worked fine until about a week ago when i deleted a user to preserved then i moved the user to the stage and i tried to activate the user and an error occurred . the error is : - ERR - managed-entries-plugin - mep_add_managed_entry - Unable to add managed entry "cn=ittest1,cn=groups,cn=accounts,dc=example,dc=com" for origin entry "uid=ittest1,cn=users,cn=accounts,dc=example,dc=com" (Already exists). i searched the problem and it turns out that the private group is created but the user is not . and the user is stuck at the stage users and the only way to activate the user is by deleting the private group . thanks in advance

1 0

"NSS Certificate DB" certificate created in new directory after renewal, breaking httpd
by Thomas Kropeit 20 Aug '19

20 Aug '19

Over the weekend, my original "NSS Certificate DB" certificate expired. It was automatically renewed, however in a new location: # ipa-getcert list Number of certificates and requests being tracked: 10. Request ID '20180929060059': status: MONITORING stuck: no key pair storage: type=NSSDB,location='/etc/dirsrv/slapd-IPA-PHYSEC-DE',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/dirsrv/slapd-IPA-PHYSEC-DE certificate: type=NSSDB,location='/etc/dirsrv/slapd-IPA-PHYSEC-DE',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA.PHYSEC.DE subject: CN=master.ipa.physec.de,O=IPA.PHYSEC.DE expires: 2021-07-20 14:25:43 UTC principal name: ldap/master.ipa.physec.de(a)IPA.PHYSEC.DE key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_dirsrv IPA-PHYSEC-DE track: yes auto-renew: yes Request ID '20180929060107': status: MONITORING ca-error: Unable to determine principal name for signing request. stuck: no key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt' certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB' CA: IPA issuer: CN=Certificate Authority,O=IPA.PHYSEC.DE subject: CN=master.ipa.physec.de,O=IPA.PHYSEC.DE expires: 2019-08-17 12:45:50 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: /usr/libexec/ipa/certmonger/restart_httpd track: yes auto-renew: yes I managed to restart the FreeIPA service by adding `NSSEnforceValidCerts off` to `/etc/httpd/conf.d/nss.conf`. But logging into the webinterface still yields the following error in httpd: [Mon Aug 19 10:36:05.722736 2019] [:error] [pid 12798] ipa: INFO: 401 Unauthorized: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618) [Mon Aug 19 10:36:05.723894 2019] [:error] [pid 12802] SSL Library Error: -12269 The server has rejected your certificate as expired I have intentionally not copied the new certificate to `/etc/httpd/alias` as I am not aware of all the involved components and fear that this might break something. My system is running a fully patched CentOS 7.6, running FreeIPA 4.6.4-10.el7.centos.6. What should I do to resolve this issue, simply replacing the certificates, or is there a better method?

2 3

FreeIPA v4.5.0 install lost topology suffixes
by Gavin Williams 19 Aug '19

19 Aug '19

Afternoon all I’ve got a slightly strange one with one of our FreeIPA clusters, whereby the topology suffixes appear to have disappeared. From what I can see, this is causing replication issues between the hosts, which is causing us issues with bootstrapping new clients against FreeIPA. I’m not aware of any config changes that have happened on the FreeIPA hosts that could have caused this issue, so am a bit stumped atm. Is someone able to advise next steps on how to investigate the cause and correct the configuration? Regards Gavin

4 4

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2019