February 2020 - FreeIPA-users - Fedora Mailing-Lists

Re: Python-ing into FreeIPA - hit a glitch

by White, Daniel E. (GSFC-770.0)[NICS]

Should have been: What is even stranger, If I exit the console and try : ipa service-show api-requester/some-host.example.com(a)EXAMPLE.COM ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: "White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users" <freeipa-users(a)lists.fedorahosted.org> Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Date: Thursday, February 13, 2020 at 14:06 To: Alexander Bokovoy <abokovoy(a)redhat.com> Cc: Rob Crittenden <rcritten(a)redhat.com>, FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>, Daniel White <daniel.e.white(a)nasa.gov> Subject: [Freeipa-users] Python-ing into FreeIPA - hit a glitch Alexander, I followed your instructions and ran into a problem. These commands went as described: $ ipa service-add api-requester/`hostname` $ ipa service-allow-retrieve-keytab api-requester/`hostname` --users=me $ ipa service-allow-create-keytab api-requester/`hostname` --users=me $ ipa-getkeytab -Y GSSAPI -k api-requester.keytab -p api-requester/`me` $ KRB5_CLIENT_KTNAME=./api-requester.keytab KRB5CCNAME=./api.ccache ipa console (Custom IPA interactive Python console) api: IPA API object pp: pretty printer api.Command.whoami() {'object': 'service', 'command': 'service_show/1', 'arguments': ('api-requester/some-host.example.com(a)EXAMPLE.COM',)} HOWEVER, when I tried this: api.Command.service_show('api-requester/some-host.example.com(a)EXAMPLE.COM') I got this error: Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 471, in __do_call params = self.convert(**params) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in convert (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in <genexpr> (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 852, in convert return convert(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 839, in convert return self._convert_scalar(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 2152, in _convert_scalar return super(Principal, self)._convert_scalar(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 862, in _convert_scalar raise ConversionError(name=self.name, error=ugettext(self.type_error)) ConversionError: invalid 'krbcanonicalname': must be Kerberos principal The argument I used in the "service_show" is identical to the argument returned from the "whoami" command. What is even stranger, If I exit the console and try : api.Command.ipa service-show api-requester/some-host.example.com(a)EXAMPLE.COM I get the expected response. I ran this on a CentOS 7 IPA client v4.6.5-11.el7.centos.3.x86_64 The server is RHEL 7, IPA/RH-IdM server v4.6.5-11.el7_7.3.x86_64 Any ideas ?

4 years, 2 months

1
0
0 / 0

Re: FreeIPA and FreeRadius (or any RADIUS)

by White, Daniel E. (GSFC-770.0)[NICS]

Thank you I will add this to my list of configurations to try. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Ernedin Zajko <ezajko(a)root.ba> Date: Wednesday, February 12, 2020 at 15:29 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Alex Scheel <ascheel(a)redhat.com>, Daniel White <daniel.e.white(a)nasa.gov> Subject: Re: [Freeipa-users] Re: [EXTERNAL] Re: FreeIPA and FreeRadius (or any RADIUS) Daniel, There is nice how-to here https://firstyear.id.au/blog/html/2016/01/13/FreeRADIUS:_Using_mschapv2_w...<https://urldefense.proofpoint.com/v2/url?u=https-3A__firstyear.id.au_blog...> --eZ On Wed, Feb 12, 2020, 20:03 White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> wrote: My use case is RADIUS for network device auth, with IPA doing the underlying authentication. The group information is all the LDAP groups a user belongs to. This is for access control. Our current setup uses an ancient version of RADIUS that runs on an old Solaris 9 Sparc server. It uses the users and groups on that server to control access. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290

4 years, 2 months

1
0
0 / 0

Certificate showing invalid (possibly revoked) but is valid

by Christopher Young

I have a weird issue where I have my RHV (RedHat Virtualization) environment system that has an IPA-issued certificate in place. This has been working very well for some time. In any case, I'm suddenly finding that browsers are telling me the certificate is invalid, yet when I check things (I issue certs with properly SANs just to clarify that point), everything seems to be ok and in place. I tried stop-tracking and reissuing a new cert thinking that something was wrong as I had recently removed/rebuilt my secondary IPA server due to what I believed were replication issues. This has looked very good since then (at least a month). When I try and go to the URL in Chrome, I'm getting: NET::ERR_CERT_REVOKED Safari (as a test) denies the cert as well. When I look at things on the system via ipa-getcert: ----- [root@orldc-prod-vengine ~]# ipa-getcert list Number of certificates and requests being tracked: 1. Request ID '20200211221958': status: MONITORING stuck: no key pair storage: type=FILE,location='/etc/pki/ovirt-engine/keys/apache.key.nopass' certificate: type=FILE,location='/etc/pki/ovirt-engine/certs/apache.cer' CA: IPA issuer: CN=Certificate Authority,O=PASSUR.LOCAL subject: CN=orldc-prod-vengine.passur.local,O=PASSUR.LOCAL expires: 2024-02-11 22:20:00 UTC dns: orldc-prod-vengine.passur.local principal name: HTTP/orldc-prod-vengine.passur.local(a)PASSUR.LOCAL key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth pre-save command: post-save command: track: yes auto-renew: yes ----- If I search for the cert via the IPA webUI, I see the certificate there and it shows as valid (with the correct Serial number). I've also at least verified that OCSP and CRL URLs at least function (I get a response and I download a CRL). I'm just not sure how to parse things and verify. I'm trying to get steps on how best to troubleshoot this as this is currently preventing me from managing my RHV environment (which is a serious problem). Please let me know if you have any guidance. I need some help! -- Chris

4 years, 2 months

2
5
0 / 0

Revocation process for FreeIPA Sub CA issued by ms-ca

by Christopher Lord

Hi All, We are doing a PoC of FreeIPA using a Sub CA issued by ms-ca as the CA for FreeIPA. One of the test cases laid out by our security team is that we need to be able to issue Sub CA certs for each FreeIPA replica so that we are able to revoke one of the Sub CAs and still have a functioning FreeIPA stack. However I haven't been able to find a way to have an issued Sub CA cert per replica server, or how to have a FreeIPA replica register that its Sub CA cert has been revoked. Is it possible to do these? If so, could I please be pointed to the appropriate doco? Cheers, Chris Christopher Lord Systems Engineer [cid:image356452.PNG@9ba4e46c.4b878abf]<http://> T +61 2 9994 8587 E christopher.lord(a)mnfgroup.limited mnfgroup.limited<https://mnfgroup.limited> [cid:imagecc7394.JPG@0d852b9a.4ca00984]<http://> This communication is intended only for the person to whom it is addressed and may contain confidential material. If you received this communication in error, please inform the sender immediately and delete all copies. Please think of the environment before printing this email.

4 years, 2 months

3
4
0 / 0

Re: [EXTERNAL] Re: FreeIPA and FreeRadius (or any RADIUS)

by White, Daniel E. (GSFC-770.0)[NICS]

My use case is RADIUS for network device auth, with IPA doing the underlying authentication. The group information is all the LDAP groups a user belongs to. This is for access control. Our current setup uses an ancient version of RADIUS that runs on an old Solaris 9 Sparc server. It uses the users and groups on that server to control access. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Alex Scheel <ascheel(a)redhat.com> Date: Wednesday, February 12, 2020 at 13:38 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Daniel White <daniel.e.white(a)nasa.gov> Subject: [EXTERNAL] Re: [Freeipa-users] FreeIPA and FreeRadius (or any RADIUS) Hi Daniel, I'm afraid I don't understand what you're trying to accomplish. There's two primary use cases for RADIUS: - RADIUS for wireless auth, with IPA doing the underlying authentication - RADIUS as a backend for OTP, with IPA passing OTP queries to RADIUS to validate I'm going to guess by your request that you want the former, not the latter. What you're looking for is probably most easily accomplished via an LDAP interface for FreeRADIUS. I think the following might help you: - https://wiki.freeradius.org/modules/Rlm_ldap - http://lists.freeradius.org/pipermail/freeradius-users/2018-April/091159.... I'm not sure what group information you'd need in this scenario, though. If you're trying to use RADIUS to do authenticate on systems, we don't support pam_radius (and the authenticating system doesn't get group information in that setup). Would sssd be a better fit in this case? Thanks, - Alex ----- Original Message ----- From: "Daniel E. White (GSFC-770.0)[NICS] via FreeIPA-users" <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> To: "FreeIPA users list" <freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>> Cc: "Daniel E. White (GSFC-770.0)[NICS]" <daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov>> Sent: Wednesday, February 12, 2020 8:54:31 AM Subject: [Freeipa-users] FreeIPA and FreeRadius (or any RADIUS) Reference: https://urldefense.proofpoint.com/v2/url?u=https-3A__www.freeipa.org_page... What about setting it up so that RADIUS gets credentials and groups from FreeIPA without the OTP ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov><mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org<mailto:freeipa-users-leave@lists.fedorahosted.org> Fedora Code of Conduct: https://urldefense.proofpoint.com/v2/url?u=https-3A__docs.fedoraproject.o... List Guidelines: https://urldefense.proofpoint.com/v2/url?u=https-3A__fedoraproject.org_wi... List Archives: https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.fedorahosted.o...

4 years, 2 months

3
3
0 / 0

FreeIPA and FreeRadius (or any RADIUS)

by White, Daniel E. (GSFC-770.0)[NICS]

Reference: https://www.freeipa.org/page/Using_FreeIPA_and_FreeRadius_as_a_RADIUS_bas... What about setting it up so that RADIUS gets credentials and groups from FreeIPA without the OTP ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290

4 years, 2 months

2
1
0 / 0

Enrollment Administrator role

by Jeff Goddard

Hello again, We're using salt for automation and have created a salt service account for the express permissions of joining machines to our domain. This user has been assigned the "Enrollment Administrator" roll but when attempting to join clients the log output is as follows: Client hostname: ubuntu.domain.com Realm: DOMAIN.COM DNS Domain: domain.com IPA Server: server1.domain.com BaseDN: dc=domain,dc=com Continue to configure the system with these values? [no]: yes Synchronizing time Configuration of chrony was changed by installer. Attempting to sync time with chronyc. Time synchronization was successful. User authorized to enroll computers: test-join Password for test(a)DOMAIN.COM: Successfully retrieved CA cert Subject: CN=Certificate Authority,O=DOMAIN.COMIPA environment is 4.4 Issuer: CN=Certificate Authority,O=DOMAIN.COM Valid From: 2017-01-26 18:47:36 Valid Until: 2037-01-26 18:47:36 Joining realm failed: No permission to join this host to the IPA domain. The FreeIPA version is 4.6.5 and its running on Centos 7.7. Can someone assist me in troubleshooting? Is there another pre-defined role or permission that I need to assign? Thanks, Jeff

4 years, 2 months

2
2
0 / 0

Re: Is there any documentation for the ipapython library ?

by White, Daniel E. (GSFC-770.0)[NICS]

Fantastic ! Many thanks. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Alexander Bokovoy <abokovoy(a)redhat.com> Date: Wednesday, February 12, 2020 at 11:00 To: Daniel White <daniel.e.white(a)nasa.gov> Cc: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>, Rob Crittenden <rcritten(a)redhat.com> Subject: [EXTERNAL] Re: [Freeipa-users] Re: Is there any documentation for the ipapython library ? On ke, 12 helmi 2020, White, Daniel E. (GSFC-770.0)[NICS] wrote: Many thanks for the ansible pointer, Alexander. As far as API automation, I see two immediate use-cases (and I will file an issue) 1. Some bundled commands for use by IdM admins for user management: Add a user along with all the necessary additional permissions. These would use the admin-user's current keytab. 2. Information gathering scripts. Is it possible to set up a read-only service keytab for this ? I want to use Python to be able to capture and process the responses without all the extra console output of the command line. Both these requests are already possible with existing Python API.

4 years, 2 months

1
0
0 / 0

Re: Is there any documentation for the ipapython library ?

by White, Daniel E. (GSFC-770.0)[NICS]

Many thanks for the ansible pointer, Alexander. As far as API automation, I see two immediate use-cases (and I will file an issue) 1. Some bundled commands for use by IdM admins for user management: Add a user along with all the necessary additional permissions. These would use the admin-user's current keytab. 2. Information gathering scripts. Is it possible to set up a read-only service keytab for this ? I want to use Python to be able to capture and process the responses without all the extra console output of the command line. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Alexander Bokovoy <abokovoy(a)redhat.com> Date: Wednesday, February 12, 2020 at 01:42 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Daniel White <daniel.e.white(a)nasa.gov>, Rob Crittenden <rcritten(a)redhat.com> Subject: [EXTERNAL] Re: [Freeipa-users] Re: Is there any documentation for the ipapython library ? On ti, 11 helmi 2020, Rob Crittenden via FreeIPA-users wrote: White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote: I would like to create some python automation scripts using it. Only the limited docs within the file(s) themselves + usage found elsewhere within IPA. We are trying to keep the API more stable than the past by deprecating things we move but there is no guarantee (I've been bitten myself by this in the past). So use with care. Please also file tickets at pagure.io/freeipa/issues describing your intended use of API. We are planning to create a simpler API on top of existing one to make sure it is not preventing us to refactor internals where possible. Knowing use cases would help a lot. Also, ansible-freeipa project should provide you a healthy base for automation. It does have wrappers for many objects already, beyond just installing the servers and clients. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

4 years, 2 months

2
1
0 / 0

Re: Is there any documentation for the ipapython library ?

by White, Daniel E. (GSFC-770.0)[NICS]

Thanks for the warning, Rob. I shall proceed with caution. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Rob Crittenden <rcritten(a)redhat.com> Date: Tuesday, February 11, 2020 at 18:57 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Daniel White <daniel.e.white(a)nasa.gov> Subject: [EXTERNAL] Re: [Freeipa-users] Is there any documentation for the ipapython library ? White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote: I would like to create some python automation scripts using it. Only the limited docs within the file(s) themselves + usage found elsewhere within IPA. We are trying to keep the API more stable than the past by deprecating things we move but there is no guarantee (I've been bitten myself by this in the past). So use with care. rob

4 years, 2 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2020