FreeIPA-users July 2023

freeipa-users@lists.fedorahosted.org

31 participants
61 discussions

Using IPA's 389-ds for other directory information trees?
by Mathieu Baudier 27 Jul '23

27 Jul '23

Hello, we are using IPA as the backbone of a middle-sized infrastructure whose purpose is to host multi-tenants (Java) applications. These applications use 389-ds instances to manage the authentication and authorisation. The 389-ds instances are deployed on hosts which are IPA clients but are not IPA servers. Since we monitor closely the IPA servers and their 389-ds instances, I was wondering whether it could be efficient to also host the applicative 389-ds LDAP trees on the same hosts as the IPA servers. These instances are small (hundreds of applicative users maximum) and use only the standard LDAP schemas, consistently with IPA (which was taken as the reference when developing the user-management model of these applications). I can see three approaches: 1) Separate 389-ds instances on distinct ports. In that case, only the software is shared. 2) Separate 389-ds backends in the IPA instances, with their own replication agreements. 3) Separate LDAP subtrees within the IPA backends. In that case, IPA replication agreements are leveraged. Intuitively, I would favour 2), then 1), then 3). Did I miss something in this analysis? Is it reasonable/advisable to reuse the IPA servers for such purposes? Does anyone have experience with such a setup? Thanks in advance for any comment! Mathieu

2 1

Re: Exporting certificates with keys associated in FreeIPA
by Jernej Jakob 27 Jul '23

27 Jul '23

On Wed, 26 Jul 2023 11:10:23 +0000 Carlos Lopez via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org> wrote: > Hi all, > > Sorry to disturb but I can not find which is the correct procedure to accomplish this. I have created a certificate in WebUI and I can export certificate in pem format, which it is what I need. But I need the private key also. This certificate is for a host outside of Kerberos and LDAP's FreeIPA domain. > > How can I export pem cert and key file? > > Regards, > C. L. Martinez > While I don't know the answer to your question, I can say that the private key should not leave the server (machine, service, user,...) which uses it. The standard procedure for PKI is to generate a private key on the machine, generate a CSR, send the CSR to the CA to get signed (which issues the certificate), then install the certificate back on the machine. If the machine is enrolled into FreeIPA you can do this with certmonger. If not, you can probably still get FreeIPA to sign your CSR.

4 3

TXT - SPF & DKIM
by lejeczek 26 Jul '23

26 Jul '23

Hi guys. Would you know a correct or best-practice way to add such records. When I look at how those resolve for some(a few a tried) well-know domains - in order to get the same/similar with IPA it seems, that I have to escape some chars, name white-spaces. Is that normal/expected - it did not feel as such to me. many thanks, L.

3 7

cert management - ? - pkcs format
by lejeczek 26 Jul '23

26 Jul '23

Hi guys. Is it possible IPA output format (when rendered into files) is _pkcs_, for both keys & certs? Being not a security/cryptography expert thus unable to put it into better words - format/container which works with/in Java? Like when: -> $ openssl pkcs8 ... -topk8 -nocrypt -v1 PBE-SHA1-3DES .. many thanks, L.

2 3

Exporting certificates with keys associated in FreeIPA
by Carlos Lopez 26 Jul '23

26 Jul '23

Hi all, Sorry to disturb but I can not find which is the correct procedure to accomplish this. I have created a certificate in WebUI and I can export certificate in pem format, which it is what I need. But I need the private key also. This certificate is for a host outside of Kerberos and LDAP's FreeIPA domain. How can I export pem cert and key file? Regards, C. L. Martinez

1 0

Krb5kdc and kadmin services not getting started
by Polavarapu Manideep Sai 25 Jul '23

25 Jul '23

Hi Team, Krb5kdc and kadmin services not getting started PFB error logs As you can see we are getting "Kerberos User Principal not found. Do you have a valid Credential Cache?" upon getting new keytab [root@dir ~]# tail -f /var/log/krb5kdc.log krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM krb5kdc: Server error - while fetching master key K/M for realm IPA.DOMAIN.COM ------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# tail -f /var/log/kadmind.log Jul 24 19:49:57 dir.IPA.DOMAIN.COM kadmind[211105](Error): Server error while initializing, aborting Jul 24 19:56:29 dir.IPA.DOMAIN.COM kadmind[2807](Error): Server error while initializing, aborting Jul 24 20:50:50 dir.IPA.DOMAIN.COM kadmind[5803](Error): Server error while initializing, aborting Jul 24 20:55:02 dir.IPA.DOMAIN.COM kadmind[6560](Error): Server error while initializing, aborting Jul 24 21:39:45 dir.IPA.DOMAIN.COM kadmind[9520](Error): Server error while initializing, aborting ---------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# klist -kt Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 05/14/2019 13:23:12 host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM 1 05/14/2019 13:23:12 host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM ---------------------------------------------------------------------------------------------------------- [root@dir ~]# [root@dir ~]# [root@dir ~]# mv /etc/krb5.keytab /etc/krb5.keytab-bak [root@dir ~]# ------------------------------------------------------------------------------------------------------------ [root@dir ~]# ipa-getkeytab -s central01.ipa.domain.com -p host/dir.IPA.DOMAIN.COM(a)IPA.DOMAIN.COM -k /etc/krb5.keytab Kerberos User Principal not found. Do you have a valid Credential Cache? [root@dir ~]# [root@dir ~]# Regards Sai ________________________________ DISCLAIMER: The information in this message is confidential and may be legally privileged. It is intended solely for the addressee. Access to this message by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of the message, or any action or omission taken by you in reliance on it, is prohibited and may be unlawful. Please immediately contact the sender if you have received this message in error. Further, this e-mail may contain viruses and all reasonable precaution to minimize the risk arising there from is taken by OnMobile. OnMobile is not liable for any damage sustained by you as a result of any virus in this e-mail. All applicable virus checks should be carried out by you before opening this e-mail or any attachment thereto. Thank you - OnMobile Global Limited.

2 1

Cannot get rid of a replica/agreement
by lejeczek 21 Jul '23

21 Jul '23

Hi guys. Two masters from which third got disconnected in a "dirty" manner. -> $ ipa-replica-manage del midway.ccn.priv.dom Server removal aborted: Replication topology in suffix 'domain' is disconnected: Topology does not allow server love.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom Topology does not allow server midway.ccn.priv.dom to replicate with servers: love.ccn.priv.dom punch.ccn.priv.dom Topology does not allow server punch.ccn.priv.dom to replicate with servers: midway.ccn.priv.dom. -> $ ipa topologysegment-find domain ----------------- 1 segment matched ----------------- Segment name: punch.ccn.priv.dom-to-love.ccn.priv.dom Left node: punch.ccn.priv.dom Right node: love.ccn.priv.dom Connectivity: both ---------------------------- Number of entries returned 1 -> $ ipa-replica-manage del midway.ccn.priv.dom --force ipa: WARNING: /usr/lib/python3.6/site-packages/ipaserver/plugins/dogtag.py:1973: The subsystem in PKIConnection.__init__() has been deprecated (https://www.dogtagpki.org/wiki/PKI_10.8_Python_Changes) Updating DNS system records Not allowed on non-leaf entry I've tried to 'reinitialize' but without success. Anybody care to share suggestions & thoughts? many thanks, L.

4 6

Do you want to search for missing reverse zones?
by Ian Pilcher 21 Jul '23

21 Jul '23

I am attempting to automate a FreeIPA installation (for troubleshooting purposes), and I cannot figure out how to get rid of this question. I have tried adding '--no-reverse' to the ipa-server-install command, but I am still getting the prompt. What option do I need to use? Thanks! -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

2 2

ipa-ca-install fails on a install
by Rudi Gabler 19 Jul '23

19 Jul '23

Hi, I've a bunch of 5 servers for my domain. One has CA on it and on any other the attempt to bring it up as secondary,.. CA replica fails with: ipa-ca-install ... caSigningCert cert-pki-ca CTu,Cu,Cu ocspSigningCert cert-pki-ca u,u,u subsystemCert cert-pki-ca u,u,u Installation failed: <html><head><title>Apache Tomcat/7.0.76 - Error report</title><style></style> </head><body><h1>HTTP Status 500 - javax.ws.rs.ProcessingException: Unable to invoke request</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>javax.ws.rs.ProcessingException: Unable to invoke request</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>org.jboss.resteasy. spi.UnhandledException: javax.ws.rs.ProcessingException: Unable to invoke request org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149) org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372) org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) javax.servlet.http.HttpServlet.service(HttpServlet.java:731) sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) together with a (journalctl) Jul 17 10:24:14 kre.example.com server[21753]: CMS Warning: FAILURE: authz instance DirAclAuthz initialization failed and skipped, error=Property internaldb.ldapconn.port missing value| Jul 17 10:24:14 kre.example.com server[21753]: CA is started. Jul 17 10:24:17 server[21753]: getSystemCertProfileID tag: subsystem defaultName: caInternalAuthSubsystemCert keyType: null Jul 17 10:24:17 kre.example.com server[21753]: FATAL: SSL alert received: HANDSHAKE_FAILURE The pki-tomcat is the last thing started, but throws an exeption I can provide the ipareplication-install.log. For all servers the failure is exactly the same (without the running master of course). Software: centos 7 with pa-common-4.6.8-5.el7.centos.14.noarch ipa-server-trust-ad-4.6.8-5.el7.centos.14.x86_64 ipa-client-common-4.6.8-5.el7.centos.14.noarch ipa-client-4.6.8-5.el7.centos.14.x86_64 ipa-server-dns-4.6.8-5.el7.centos.14.noarch ipa-server-common-4.6.8-5.el7.centos.14.noarch ipa-server-4.6.8-5.el7.centos.14.x86_64 Maybe someone has a tip for me? Regards, Rudi G.

2 4

Clarification on automember rules
by dweller dweller 18 Jul '23

18 Jul '23

In our environment, we have deployed Dex as an Identity Provider (IdP) for authentication in various Kubernetes (k8s) clusters. However, we encountered an issue with configuring Dex to account for nested groups. As a workaround, we implemented a solution that assigns groups with automembership. Allow me to explain: Each k8s cluster has Role-Based Access Control (RBAC) configured, which is associated with four groups retrieved from LDAP via Dex. Consequently, we have the following naming convention: k8s-cluster-01-l0 k8s-cluster-01-l1 k8s-cluster-01-l2 k8s-cluster-01-l3 Additionally, we have user groups such as: team-l0 team-l1 team-l2 team-l3 We add users to the appropriate team group based on their entitlements, and subsequently, we associate the team-l* groups with their respective k8s-cluster-01-l* group. This arrangement grants the members of the team-* group specific access rights to the corresponding k8s cluster. However, initially, Dex was only able to recognize the groups that a user was directly a member of. To address this limitation, we implemented automember rules. For example, we created four rules as follows: k8s-cluster-01-l0 if memberof team-l0 k8s-cluster-01-l1 if memberof team-l1 k8s-cluster-01-l2 if memberof team-l2 k8s-cluster-01-l3 if memberof team-l3 As the number of clusters increased, we ended up with around 52 automember rules following the same pattern for k8s. Now, whenever I need to add a user or modify automember rules and trigger an automember rebuild, even for a small set of users (5-10), FreeIPA experiences a prolonged hang. Eventually, it times out the automember rebuild task, and this lagging behavior extends to all replicas. In light of this situation, I would like to clarify the following: Is my understanding correct that for each user in this setup, I create 52 automember rebuild tasks? Is it expected for the system to function this way, or am I using the automember plugin incorrectly? Could it be that the plugin is not intended for such high membership usage? I would appreciate any insights you can provide to help resolve these concerns. P.S.: I found a way to make a Dex to see nested groups membership, but for now I'm stuck with this workaround, cause it much harder to conform changes now.

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2023