FreeIPA-users January 2021

freeipa-users@lists.fedorahosted.org

53 participants
77 discussions

ipa commands have 30 second delay
by Dominik Vogt 06 Jan '21

06 Jan '21

We've set up an ipa-server without DNS, using an /etc/hosts file, as was suggested in an older thread: https://www.mail-archive.com/freeipa-users@lists.fedorahosted.org/msg10991.… There's no DNS at all available, and /etc/nsswitch contains the defaults ("hosts: files dns myhostname", but it's the same if I change that to just "hosts: files" and remove /etc/rsolv.conf). Ipa commands all take 30 seconds, but fine eventually. E.g. $ ipa user-find --all Strace shows that the process is sending a request to the DNS port on the ip address configured in /etc/resolv.conf, or 127.0.0.1 if that file does not exist. he conents of nsswitch.conf are ignored. So, how can this be fixed? Do we have to set up DNS to run the ipa-server? Ciao Dominik ^_^ ^_^ -- Dominik Vogt

2 2

create new ca and new certs for
by Evg Hertz 05 Jan '21

05 Jan '21

IPA Error 4301: CertificateOperationError Certificate operation cannot be completed: EXCEPTION (You did not provide a valid certificate for this operation) Failed to authenticate to CA REST API Hello! I need create new CA cert and certs directory server, http server, KDC. How I can do that?

2 3

healthcheck errors
by Prasun Gera 05 Jan '21

05 Jan '21

I'm seeing the following two errors on running ipahealthcheck. This is on an up to date RHEL 8.3 system in a 2 server topology with self signed CA. DOMAIN.COM IPA CA not found, assuming 3rd party DOMAIN.COM IPA CA not found, assuming 3rd party [ { "source": "pki.server.healthcheck.meta.csconfig", "check": "CADogtagCertsConfigCheck", "result": "ERROR", "uuid": "da820035-6955-436f-9bf5-bde578b27920", "when": "20201221130025Z", "duration": "0.172261", "kw": { "key": "ca_signing", "nickname": "caSigningCert cert-pki-ca", "directive": "ca.signing.cert", "configfile": "/var/lib/pki/pki-tomcat/ca/conf/CS.cfg", "msg": "Certificate 'caSigningCert cert-pki-ca' does not match the value of ca.signing.cert in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg" } }, { "source": "ipahealthcheck.ipa.certs", "check": "IPACertTracking", "result": "ERROR", "uuid": "cfba0bf1-4e4b-40d6-9d26-455bab9c9057", "when": "20201221130027Z", "duration": "0.307626", "kw": { "key": "cert-database=/etc/pki/pki-tomcat/alias, cert-nickname=caSigningCert cert-pki-ca, ca-name=dogtag-ipa-ca-renew-agent, cert-presave-command=/usr/libexec/ipa/certmonger/stop_pkicad, cert-postsave-command=/usr/libexec/ipa/certmonger/renew_ca_cert \"caSigningCert cert-pki-ca\", template-profile=caCACert", "msg": "Missing tracking for cert-database=/etc/pki/pki-tomcat/alias, cert-nickname=caSigningCert cert-pki-ca, ca-name=dogtag-ipa-ca-renew-agent, cert-presave-command=/usr/libexec/ipa/certmonger/stop_pkicad, cert-postsave-command=/usr/libexec/ipa/certmonger/renew_ca_cert \"caSigningCert cert-pki-ca\", template-profile=caCACert" } }, ... ] 1. This is with a self-signed CA. So I don't know why it has that assuming 3rd party message. 2. I think this has something to do with the fact that /etc/pki/pki-tomcat/alias/ has two certs under the nickname of "caSigningCert cert-pki-ca", (one for each of the masters I presume), but somehow only 1 cert is tracked in other parts of the infrastructure. /var/lib/pki/pki-tomcat/ca/conf/CS.cfg lists a single certificate under ca.signing.cert and there is also a single entry in LDAP (which is the same as CS.cfg). Is something broken in my setup ? Thanks, Prasun

2 8

repair ca
by Evg Hertz 04 Jan '21

04 Jan '21

Hello I need to fix CA Failed to authenticate to CA REST API How I can reinstall/reconfigure only CA. or export users(with hash passwords)/groups. and import on new installation. Help me please.

4 12

Jenkins FreeIPA LDAP integration
by anilkumar panditi 04 Jan '21

04 Jan '21

Hi, I have freeipa running as a docker container, and don't have all the details with me. i was looking for a few details see attached for Jenkins FreeIPA LDAP integration. I am not sure where the Manager DN id and password is stored inside my freeipa docker container . Could you please help, i am really stuck Thanks, Anil

2 1

Access LOG Files / configuration - zip ?
by Karim Bourenane 04 Jan '21

04 Jan '21

Hello Team Its possible to know where the access log files in /var/log/dirsrv/slapd...../ are configured. Its possible to active the gzip process for this files ? Happy holidays Bien à vous Mr Karim Bourenane

2 1

Insufficient access
by Ivan Isakov 02 Jan '21

02 Jan '21

Hello, When I try to perform command after command kinit admin: ipa group-remove-member group --users=test I get next: Failed members: member user: test: Insufficient access: Insufficient 'write' privilege to the 'member' attribute of entry... How can I fix it? Help, please!

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2021