October 2020 - FreeIPA-users - Fedora mailing-lists

LDAP documentation
by Dominik Vogt 23 Oct '20

23 Oct '20

Hi Folks, whats the authoritative place to look for documentation of the ipa-server's LDAP database please? (The structure of the database.) Ciao Dominik ^_^ ^_^ -- Dominik Vogt

1 0

LDAP login using the poco library
by Dominik Vogt 23 Oct '20

23 Oct '20

Background: On an ipa-client, our customer wants to implement login to a custom made service using the poco c++ library. There's something about ldap authenticators on this page: pocoproject.org/pro/docs/00400-OSPAuth.html The customer already hat this implemented with a non-ipa LDAP setup, but we don't have access to the source code. Questions: 1) Is there any experience implementing ldap based authentication in an ipa ecosystem using poco? Examples, instructions, anything? 2) Is there some code example or even example program for ldap authentication without poco, in any language ( But C/C++ preferred)? Ciao Dominik ^_^ ^_^ -- Dominik Vogt

1 0

New IPA servers and existing trust
by Ronald Wimmer 23 Oct '20

23 Oct '20

Several months ago we set up two IPA servers for a separate department. We also set up a trust to AD. Then the project went on hold. Today I was told that they want to continue using IPA. The IPA servers are using CentOS 7.x. Regarding the trust setup, would it work to add two OL 8.1 servers and remove the old CentOS servers afterwards? Or is there a better way to do that? Cheers, Ronald

2 1

HBAC and external groups (AD trust)
by Giulio Casella 23 Oct '20

23 Oct '20

Hi, I have a IPA setup, in trust with active directory. I noticed a strange behaviour in HBAC. In details: I have a group ("extgroup"), defined as external, containing an active directory user ("user(a)ad.dom.ain"). I defined a HBAC rule ("allow_AD_ssh") to permit ssh to a host to users belonging to "extgroup", but the HBAC test (performed with "user(a)ad.dom.ain") fails. I'm sure the cause is the "Who" section of the HBAC rule (if I leave "Anyone" it works). So the HBAC is defined as: WHO: User group "extgroup" ACCESSING: host I want to give access to SERVICE: sshd I was pretty sure it was a incompatibility of HBAC rules with external user. But if I define a standard (POSIX) group (let say "intgroup"), make "extgroup" member of "intgroup" and use "intgroup" in the definition of the (section "who" of) HBAC rule, it works like a charm. Why direct use of external group is not working? Is it a bug? Or is there a reason I cannot see? TIA Cheers, Giulio

2 3

My FreeIPA Server as Domain for Windows
by rodentskie＠gmail.com 22 Oct '20

22 Oct '20

Good day, I have successfully deployed my own Freeipa server in my local network. Now I want to configure it as a local domain for our LAN. All the computers in our LAN has windows installed as OS. Is it possible? How to configure. Now, my Freeipa server DNS is "example.com". When I try to change the domain of the windows computer I get error. Please help.

1 0

FREEIPA - TLS - CN > 64 characters
by Krzysztof O 21 Oct '20

21 Oct '20

Hello, I'd like to ask of is there any workaround for issuing certificates that will have Common Name longer that 64 characters? For FREEIPA version less than 4.8.0 which is designated for RHEL 8, when we will have to stay with current version of RHEL 7. Regards, Krzysztof

5 8

Centralized Authentication and Authorisation System for Gmail and OpenVPN
by kaushalshriyan＠gmail.com 21 Oct '20

21 Oct '20

Hi, Is there a way to configure centralized Authentication and Authorization system for Gmail and OpenVPN users? For example, if any new employee joins I grant Gmail and OpenVPN service access. I look forward to hearing from you. Thanks in Advance. Best Regards, Kaushal

1 0

ipa-server-install (How to disable checking online DNS) ?
by rodentskie＠gmail.com 20 Oct '20

20 Oct '20

Hello, I'm currently configuring freeipa. When I run the command "ipa-server-install", I got these errors: Checking DNS domain biotechfarms.net., please wait ... ipapython.admintool: ERROR DNS zone biotechfarms.net. already exists in DNS and is handled by server(s): kiki.ns.cloudflare.com., dane.ns.cloudflare.com. ipapython.admintool: ERROR The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information My boss has this domain "biotechfarms.net" also in cloudflare. Please help.

2 2

Managing a certificate for a non-joined host from a joined host.
by Thomas Letherby 20 Oct '20

20 Oct '20

Hello all, I'm trying to issue some certificates via certmonger and I'm missing a permission somewhere. The situation is thus: I have a small docker swarm of containers which access storage volumes on a IPA-joined storage server (xstorage1 - Ubuntu 18.04) via NFS, stored on a ZFS array. Some of these containers, in this case a WiFi controller can ingest certificates dropped into their volumes. I want to use the storage server to request and drop the certificate files for the controller (in this case called omada) directly into the docker volume for the container, so the storage server will manage renewals and the container just sees the cert files as normal. On xstorage1 I used the following process to create the host, service and request the certificate: kinit admin ipa host-add omada.i.xrs444.net ipa service-add HTTP://omada.i.xrs444.net ipa service-add-host --hosts xstorage1.i.xrs444.net HTTP://omada.i.xrs444.net ipa-getcert request -f /nasstore/containers/omada-data/cert.crt -k /nasstore/containers/omada-data/tls.key -r -K HTTP/ omada.i.xrs444.net(a)I.XRS444.NET -N 'CN=omada.i.xrs444.net,O=I.XRS444.NET' -D omada.i.xrs444.net -C "/usr/local/bin/catcerts.sh /nasstore/containers/omada-data/cert.crt /etc/ipa/ca.crt //nasstore/containers/omada-data/tls.crt" (The -C is calling a script to concatenate the cert change into one file) This appears to process without error, but when I run ipa-getcert list I see the following error: Request ID '20201019194610': status: CA_REJECTED ca-error: Server at https://xipa1.i.xrs444.net/ipa/xml denied our request, giving up: 2100 (RPC failed at server. Insufficient access: Insufficient 'add' privilege to add the entry 'krbprincipalname=HTTP/ omada.i.xrs444.net(a)I.XRS444.NET ,cn=services,cn=accounts,dc=i,dc=xrs444,dc=net'.). In the GUI of xipa1 (IPA Server) I can see the host and service, with xstorage1 listed in the 'managed by' tab for both. I tried from another host with the same results. What have I missed? I'm sure I've done this before a while back, but I can't recall how I did it. Looking through guides online I can't see a step I've skipped. Thomas

2 2

Is it possible to alter the default two-year expiration of derived certificates
by Bo Lind 20 Oct '20

20 Oct '20

I'm generating certificates for a bunch of not-enrolled, not-certmonger-feasible services (our printer, for example) and I'd like a little longer life cycle than the standard two years. I can't for the life of me figure out where I can set that. Thanks in advance.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users October 2020