January 2024 - FreeIPA-users - Fedora Mailing-Lists

by Ronald Wimmer

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/... >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. > So. Am I right that our options are to use LDAP with a cleartext passwort or use the IPA API?

3 months, 2 weeks

2
1
0 / 0

web login failed after upgrade

by 彭勇

when we upgrade ipa-server-4.9.12-9 to ipa-server-4.9.12-11 on RHEL 8, we can't login to web. the web give me message: “Your session has expired. Please log in again.” we check the error_log [Thu Jan 18 21:56:42.535394 2024] [auth_gssapi:error] [pid 11025:tid 139639453087488] [client 118.184.176.67:30891] Failed to unseal session data!, referer: https://id1.netegn.com/ipa/xml [Thu Jan 18 21:56:43.113937 2024] [wsgi:error] [pid 11021:tid 139639621613312] [remote 118.184.176.67:30891] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) [Thu Jan 18 21:56:43.611962 2024] [wsgi:error] [pid 11023:tid 139639621613312] [remote 118.184.176.67:30893] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credential cache is empty) all three ipa server failed. we can't resolve the problem, we restore the snapshot and it recovery. we install RHEL 9.3 with ipa-server-4.10.2-5，set it as replicator of master ipa server, it has same problem. -- Peng Yong

3 months, 2 weeks

2
1
0 / 0

Freeipa Ansible Galaxy collection - missing idoverride module from community.general collection.

by slek kus

Hi, I have tested below playbook on a testmachine, where I downloaded the ansible roles and modules, which worked. Now trying to do repeat this on Ansible automation platform but cannot find the module there? Anyone any idea or clue? https://github.com/freeipa/ansible-freeipa/blob/master/playbooks/idoverri... Or is this simply missing, if so, and are there ways to have idoverride functionality in Ansible AP? https://docs.ansible.com/ansible/latest/collections/community/general/ind... I am new to Ansible. Cheers, slekkus

3 months, 2 weeks

2
4
0 / 0

Freeipa sudo

by Dmitry Krasov

Hello. The FreeIpa user has sudo rights on a Ubuntu 2204 desktop machine that is in the FreeIpa Linux domain. It can do sudo su, sudo apt install… But when starting some services and basic installation of applications from the market (in general, when it comes to gui admin rights), it asks the local administrator password. How can I fix this so the user’s password was requested from FreeIpa or not at all?

3 months, 3 weeks

2
9
0 / 0

Is there any way to disable TOTP watermark support?

by Heo Paul

I use the core server (fedora 39, ipa-version : 4.11.0) I know that freeipa server adds TOTP watermark support since 4.1 version. But for some reason, I need to reuse otp-code from generated with TOPT for short time to login but it fails with otp watermark. Are there any ways to disable the feature from server side? Thanks in advance.

3 months, 3 weeks

2
1
0 / 0

Redundancy and failover practices

by Justin Sanderson

I have built a 4 node environment in which all 4 servers have CA and domain replication via a tight-cell topology. I have some questions about redundancy and failover. 1. How are user logins affected if my master dies? 2. I understand that sssd has some built-in failover capabilities but is there anything that I need to do on the DNS SRV records for ldap and kerberos? 3. Is failover even a thing for krb5/ldap services since they're replicating? Overall, I would like some detail about what to do and how, when my master goes down? I see a decent amount of information about how to set it all up but how do I actually make use of it in the event of server failure? Any in-depth docs/info on this topic would be appreciated. Thanks in advance.

3 months, 3 weeks

1
0
0 / 0

Bind9/named 4.10.2 segfaults under dnssec load, ISC points to lib version mismatches.

by Harry G Coin

Under opendnssec processing load, bind9 segfaults under v 4.10.2. The only mitigation was to add systemd restart override. Details here: https://gitlab.isc.org/isc-projects/bind9/-/issues/4533 Coredumps available. The ISC devs closed the issue with this comment: "Yeah, SoftHSM2 is pretty much broken with OpenSSL 3. If you want this to work, you need to compile both BIND 9 and SoftHSM2 to be compiled with OpenSSL 1.1. (The worst you can do is to compile one with OpenSSL 3 and second with OpenSSL 1.1, SoftHSM2 leaks symbols into the address space.) There’s also a libnss file provider that can be used as alternative. But combining old and new will not work here. SoftHSM2 is basically in maintained as of not. There’s nothing we can do here on BIND 9 side. There will be support for OpenSSL 3 providers in future, but not in the version near EOL." Looks like the freeipa team has some choices to make re: named-bind/opendnssec/softhsm2/pcks11/openssl ! Thanks Harry

3 months, 3 weeks

1
0
0 / 0

Re: Greenfield FreeIPA deployment - is it OK to put FreeIPA at the domain apex, or a "best practice" to put it in a subdomain?

by Thomas Letherby

I say always use a subdomain. You don't lose much (apart from a slightly longer domain to type in) but you get a whole lot more flexibility. If you need to stand up Active Directory, or another FreeIPA forest separate from the first, you can keep it in the same namespace and not worry about conflicts. You can use CNAMEs in the root for user accessed things to keep URLs short, and you don't have the issue of people not being able to use the company website without www.... Thomas On Thu, Jan 11, 2024 at 8:06 AM Paul Wilcox via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote: > Older thread, curious which direction you went with. > > I am kind of deciding the same as you. Build it with root domain and > then have resource domains or do a subdomain to start. Have not really > found a best practice guide. > > Wonder how redhat does there domain setup. > > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue >

3 months, 3 weeks

1
0
0 / 0

Old Home Folders and Free ipa users

by Alper AYKUT

Hello I have 5 servers. The users of all servers are created locally. All users have Home. Now I will connect the Servers to the Free ipa server to enable them to log in with the Users I have created in Free IPA. However, how will the users' home folders that were created in the past match the User created in Free ipa? Or will the users need to delete their home folders to be created again. If I need to delete the Home folders of the users, I will need to back up the data of all users. This is a huge workload. Thankyou for support.

3 months, 3 weeks

4
5
0 / 0

[SSSD] Announcing SSSD 2.9.4

by Pavel Březina

# SSSD 2.9.4 The SSSD team is announcing the release of version 2.9.4 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.4 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.4.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.4 Release Notes ## Highlights ### Important fixes * Fixes a crash when PAM passkey processing incorrectly handles non-passkey data. * A workaround was implemented to handle gracefully misbehaving applications that destroy internal state of SSSD client librarires. A particular example of such application is described in https://github.com/TigerVNC/tigervnc/issues/1709. * An error when rotating KCM's logs was fixed. When KCM's logs were rotated by logrotate, KCM would still use the old file (renamed sssd_kcm.log.1). Only after KCM was restarted (either manually or automatically) the new log file would be used. This problem is now solved and KCM uses the new file immediately. * Fixed group membership handling when members are coming from different forest domains and using ldap token groups is prohibited. * Files provider was erroneously taking into consideration `local_auth_policy` config option, thus breaking smartcard authentication of local user in setups that didn't explicitly specify this option. This is now fixed.

3 months, 3 weeks

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2024