January 2021 - FreeIPA-users - Fedora mailing-lists

IPA compat mode
by Jacquelin Charbonnel 28 Jan '21

28 Jan '21

Hi folks, Overall, what is the goal of the IPA compat mode, and what are the consequences of enabling/disabling it ? And specifically, what's the differences between : # ipa migrate-ds --with-compat ... and # ipa-compat-manage disable # ipa migrate-ds ... Thanks on advance -- Jacquelin Charbonnel - (+33)2 4173 5397 CNRS Mathrice/LAREMA - Campus universitaire d'Angers

3 2

CRL Not Updating
by TC Johnson 26 Jan '21

26 Jan '21

The CRL being served by the CRL Master has not added a newly revoked certificate for 4 months. The CRL is updated and published as expected every four hours, just with no change to the list of revocations. Currently the CRL lists 34 certificates where as a query with ipa cert-find returns 40. The missing certificates are not expired. I do not see any errors in /var/log/pki/pki-tomcat/ca/debug* I've been through the steps at https://www.freeipa.org/page/Troubleshooting/PKI and checked the CRL settings per https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master The CRL files in /var/lib/ipa/pki-ca/publish/ are being generated/updated.

3 6

Questions about DNS client names in a FreeIPA / Active Directory trust
by White, Daniel E. (GSFC-770.0)[NICS] 26 Jan '21

26 Jan '21

OK, I know that the AD-DC and the IDM servers need matching Kerberos realm and DNS domain names Let's say AD.FOO.BAR.URP / IDM.FOO.BAR.URP for Kerberos and ad.foo.bar.urp / idm.foo.bar.urp for DNS I am using 4 labels to parallel the environment for which this is intended. The DNS domain for the environment is foo.bar.urp and there is currently no FOO.BAR.URP AD-DC, but we eventually expect one from "Upstream" and hope to make AD.FOO.BAR.URP a Kerberos sub-realm/domain of it AD.FOO.BAR.URP and ad.foo.bar.urp were created. IDM.FOO.BAR.URP and idm.foo.bar.urp will be created shortly and connected by a cross-forest trust. These, of course, will be sub-domains to AD.FOO.BAR.URP/ad.foo.bar.urp The confuzzlepation is about client domain names. Do Linux clients need to use the idm.foo.bar.urp DNS domain or can they just use foo.bar.urp ? Same question for non-Linux clients -- ad.foo.bar.urp DNS domain or can they just use foo.bar.urp ? And does the lack of the "parent" Kerberos realm/domain FOO.BAR.URP complicate the matter ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NASCOM Linux Engineer NASA Goddard Space Flight Center Science Applications International Corporation (SAIC) Office: (301) 286-6919 Mobile: (240) 513-5290

2 3

Removing old/stale KRA requests in FreeIPA 4.6.6
by Attila Salyi 25 Jan '21

25 Jan '21

Hi folks, We have been a big time IPA vault users and managed to accumulate a few hundred thousands KRA requests in our IPA LDAP. This had been going on before ephemeral KRA requests were enabled in our installations and now we have these requests sitting in LDAP. Is there any (preferably: a safe) way to remove these KRA requests? Even the newest ones are 6+ months old. Thank you for your help, Attila

1 0

SSO with only freeIPA
by Am Titan 25 Jan '21

25 Jan '21

Hi Folks, I wants to implement SSO I have freeIPA installed and working. Can I use cockpit for SSO, or do I have to use keykloack for SSO? Thanks on advance,

2 2

FreeIPA topology issues after clean install
by Am Titan 24 Jan '21

24 Jan '21

HI, I am facing a repeated phenomenon, I have installed one FreeIPA server and two replica FreeIPA servers. All are masters (roles are being assigned automatically). The problem i experience directly after fresh install is that the topology keep breaks or at least "disconnected" after left the servers off for few hours. The is literally no data on the servers and no changes are being made, first everything works ok, i even check the sync and all is working and syncing well, only after few hours that the serves are up again, the issues starts show up, here hare some paste from the servers: [root@ipa-server1 ~]# ipa topologysuffix-verify domain ======================================================== Replication topology of suffix "domain" contains errors. ======================================================== ------------------------ Topology is disconnected ------------------------ Server ipa-server1.ipa.example.com can't contact servers: ipa-server3.ipa.example.com Server ipa-dctrlv2.ipa.example.com can't contact servers: ipa-server3.ipa.example.com [root@ipa-server1 ~]# reboot Last login: Wed Jan 20 16:17:02 2021 from 192.168.2.100 [root@ipa-server1 ~]# ipa topologysuffix-show # display all managed hosts and segments Suffix name: all ipa: ERROR: all: suffix not found [root@ipa-server1 ~]# ipa topologysuffix-verify # check connectivity, missing connections, redundant connections Suffix name: dc=int,dc=example,dc=com ipa: ERROR: dc=int,dc=example,dc=com: suffix not found [root@ipa-server1 ~]# ipa topologysuffix-verify # check connectivity, missing connections, redundant connections Suffix name: domain ======================================================== Replication topology of suffix "domain" contains errors. ======================================================== ------------------------ Topology is disconnected ------------------------ Server ipa-server1.ipa.example.com can't contact servers: ipa-server3.ipa.example.com Server ipa-dctrlv2.ipa.example.com can't contact servers: ipa-server3.ipa.example.com [root@ipa-server1 ~]# ipa topologysegment-find domain Replication topology of suffix "domain" is in order. ==================================================== [root@ipa-server3 ~]# ipa-replica-manage re-initialize --from ipa-dctrlv2.ipa.example.com 'ipa-server3.ipa.example.com' has no replication agreement for 'ipa-dctrlv2.ipa.example.com' [root@ipa-server3 ~]# ipa topologysegment-find Suffix name: domain ------------------ 2 segments matched ------------------ Segment name: ipa-server1.ipa.example.com-to-ipa-dctrlv2.ipa.example.com Left node: ipa-server1.ipa.example.com Right node: ipa-dctrlv2.ipa.example.com Connectivity: both Segment name: ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com Left node: ipa-server1.ipa.example.com Right node: ipa-server3.ipa.example.com Connectivity: both ---------------------------- Number of entries returned 2 ---------------------------- [root@ipa-server3 ~]# ipa topologysegment-find^C [root@ipa-server3 ~]# pa topologysegment-del -bash: pa: command not found [root@ipa-server3 ~]# ipa topologysegment-del Suffix name: domain Segment name: ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com ipa: ERROR: Server is unwilling to perform: Removal of Segment disconnects topology.Deletion not allowed. [root@ipa-server3 ~]# ipa topologysegment-add ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com Left node: ipa-server1.ipa.example.com Right node: ipa-server3.ipa.example.com Segment name [ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com]: ipa: ERROR: invalid 'leftnode': left node (ipa-server1.ipa.example.com) does not support suffix 'ipa-server1.ipa.example.com-to-ipa-server3.ipa.example.com' [root@ipa-server3 ~]# Last login: Sat Jan 16 18:11:10 2021 from 192.168.2.100 [root@ipa-server3 ~]# Can someone please help understand why new installed servers with clean topology and no changes are breaking after few hours? Thanks on advance

3 6

Allow "sudo su - USER" to only the specified user
by Russ Long 22 Jan '21

22 Jan '21

I'm trying to come up with a Sudo rule that will allow a user to "su" to only a single specified user. I need to give a DBA access to the oracle user account. This serverfault article details exactly what I want to do, however this is not for FreeIPA. I've tried creating a sudo command that's "/usr/bin/su - USER" and other variations to no avail. I've also tried creating a sudo rule that allows all commands to be run as "USER".

4 9

Re: Jenkins FreeIPA LDAP integration
by Jonathan Langford 22 Jan '21

22 Jan '21

Hi, I can confirm that the computing for geeks link does work: https://computingforgeeks.com/how-to-configure-jenkins-freeipa-ldap-authent… When testing LDAP settings Jenkins does determine my group membership correctly however, I cannot see any IPA server groups appearing in the "User/group" column if I try to enable Matrix-based security. I've obviously missed something. Jonathan

1 0

chronyd support in freeipa server?
by Kent Brodie 21 Jan '21

21 Jan '21

I have found online docs proposing chronyd support for freeipa (target 4.7). I am running 4.8. Does support for using chronyd instead of ntpd exist yet? I have not founnd anything concrete yet to confirm this. IF this exists, is there a documented procedure to change? and if the support does not exist yet, does anyone have an insight as to when that might happen? Thank you all in advance.

4 7

ansible-freeipa in RHEL8.1
by Dominik Vogt 21 Jan '21

21 Jan '21

For the moment we're stuck with RHEL8.1. The ansible-freeipa package there (0.1.6-4) does not seem to include the "ipaconf" and "iparole" modules (maybe others). Are they missing, in a different package or do we need to upgrade to a newer RHEL version? Ciao Dominik ^_^ ^_^ -- Dominik Vogt

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2021