November 2024 - FreeIPA-users - Fedora mailing-lists

Two-way trusts and AD Linux client.
by Aleksandr Sabirov 29 Nov '24

29 Nov '24

Hello, Suppose we have: Machine - with the full name ws16.ad16.loc - MS AD. Windows Server 2016 Machine - with the full name ipasrv-1.ipadomain.loc - IdM AD version 4.8.10. Linux Debian Machine - with the full name adclient-1.ad16.loc - AD Client. Linux Debian Bidirectional trust relationships between IPA and AD are configured. The third machine is joined to the AD domain using sssd 2.4.0. Can I somehow authenticate on the AD client (third machine) using IdM users via the bidirectional trust relationships? That is, I don't mean the case where we make the AD client partially integrated into IdM by adding settings in sssd.conf for the second domain ([domain/ipadomain.loc]) and updating krb5.keytab. I mean, how can I make it so that the request goes specifically through AD (i.e., via the trust relationships) and not directly to IdM? And is this possible? Thanks.

2 6

Two-way trusts and AD Linux client.
by James Hancock 28 Nov '24

28 Nov '24

Hello, Suppose we have: Machine - with the full name ws16.ad16.loc - MS AD. Windows Server 2016 Machine - with the full name ipasrv-1.ipadomain.loc - IdM AD version 4.8.10. Linux Debian Machine - with the full name adclient-1.ad16.loc - AD Client. Linux Debian Bidirectional trust relationships between IPA and AD are configured. The third machine is joined to the AD domain using sssd 2.4.0. Can I somehow authenticate on the AD client (third machine) using IdM users via the bidirectional trust relationships? That is, I don't mean the case where we make the AD client partially integrated into IdM by adding settings in sssd.conf for the second domain ([domain/ipadomain.loc]) and updating krb5.keytab. I mean, how can I make it so that the request goes specifically through AD (i.e., via the trust relationships) and not directly to IdM? And is this possible? Thanks.

1 0

Nextcloud/SSO with FreeIPA
by Daniel Pätzold 27 Nov '24

27 Nov '24

Hello, i have setup Freeipa (on Docker) and was able to logon via pam / SSSD on some host. Klist shows a valid Ticket and in Firefox i am able to log into FreeIPAs WebUI using SSO/Kerberos as the User i am logged in. I would like to have Nextcloud (also on Docker) use SSO Kerberos. There are many Apps in Nextcloud and i don't know howto start: SSO/SAML, Social Logon, Backend LDAP, OpenID, OAuth... I only found one Documentation an SSO in Nextcloud but its behind a paywall (and our Company is too small to get a subscription). Does anybody got this working? Which Nextcloud Apps should be used and how would they be configured? -- -- Mit freundlichen Grüßen Daniel Pätzold

4 3

Re: Create IPA user via LDAP
by Ronald Wimmer 25 Nov '24

25 Nov '24

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 32

Problem updating IPA
by Sava Savchev 22 Nov '24

22 Nov '24

I am running two IPA servers in replication on Oraclelinux8 with version ipa-server-4.9.13-10.0.1 and 389-ds version 1.4.3.39-8 When I try to update IPA to ipa-server-4.9.13-12.0.2 it fails on ipa-server-upgrade due to dirsrv not starting: ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: saving configuration [2/9]: disabling listeners [3/9]: enabling DS global lock [4/9]: disabling Schema Compat [5/9]: starting directory server [error] CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n') [cleanup]: stopping directory server [cleanup]: restoring configuration IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n') The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information In dirsrv logs there is: ERR - NSMMReplicationPlugin - changelog program - changelog5_init: failed to start changelog at /var/lib/dirsrv/slapd/cldb When I revert back to the original version, everything is back to normal. I have another cluster with the same configuration and I successfully updated. The only difference is that on the failing one I have enabled changelog encryption. I don't know if this is the correct list to report this problem, but since it is emerging when I update IPA, I guess this is the right one :)

2 2

Free User Certificates - EC certificstes
by Winfried de Heiden 21 Nov '24

21 Nov '24

Hi all, Previously, in another post, I mentioned slowness using Aventra MyEID PKI cards for login, sudo etc. I tried another solution, using EC (Elastic Curve) keys. Speed should benefit, since EC keys are much smaller, keeping the same degree of security. Shoter key = loading faster. Hoever, I seems FreeIPA will not accept and EC key, omly RSA when trying to sing an EC CSR? Would it be possible though to use Elastic Curve certificates? Thanks! Winfried

3 3

Re: Smart Card authentication - only works running sssd in foreground
by Sumit Bose 18 Nov '24

18 Nov '24

Am Mon, Nov 18, 2024 at 02:50:09PM +0100 schrieb Winfried de Heiden: > Hi all, > > The tuning options as provided on https://github.com/OpenSC/OpenSC/wiki/Aventra-MyEID-PKI-card#smart-card-rea…. > > He looks however it is related to file caching. In "man 5 opensc.conf": > > If caching is done by a system process, the cached files may be > placed inaccessible from a user account. Use a globally readable > and writable location if you wish to share the cached > information. > Note that the cached files may contain personal data such as name > and mail address. > > email handtekening privé It seems caching is done by GDM (user: gdm) and > sssd (user: root) and I added to ensure a caching directory is created (and > removed when rebooted, nice and handy during testing) > > /etc/tmpfiles.d/opensc.conf > d /dev/shm/.cache/opensc 2700 gdm root - > > I also added "file_cache_dir" to /etc/opensc.conf: > > app default { > # debug = 3; > # debug_file = opensc-debug.txt; > framework pkcs15 { > use_file_caching = public; > file_cache_dir = /dev/shm/.cache/opensc; > } > reader_driver pcsc { > # The pinpad is disabled by default, > # because of many broken readers out there > enable_pinpad = false; > } > } > # the pkcs15-init is used for card initialization when the file caching > # brings more trouble than use so disable that: > app pkcs15-init { > framework pkcs15 { > use_file_caching = no; > } > } > > It's still not bleeding fast () but it'sa shure more acceptable and > workable. After a reboot: > > time sudo -l; sudo -k; time sudo -l > PIN for MyEID-222 (MyEID-222 Basic PIN): > > User winfried may run the following commands on minicard: > (ALL : ALL) ALL > > real 0m8.016s > user 0m0.019s > sys 0m0.022s > > PIN for MyEID-222 (MyEID-222 Basic PIN): > User winfried may run the following commands on minicard: > (ALL : ALL) ALL > > real 0m5.428s > user 0m0.019s > sys 0m0.012s > > > When I remove the line "file_cache_dir", sudo -l takes ages (...) but > strangely there are no traces of any cache anywhere on the filesystem; no > wonder it is slow... > According to the man pages: > > Where to cache the card's files. The default values are: > • $XDG_CACHE_HOME/opensc/ (If $XDG_CACHE_HOME is defined) > • $HOME/.cache/opensc/ (Unix) > • $USERPROFILE\.eid-cache\ (Windows) > > But nothing is there!? Anyone got an idea whatś happening here? Hi, have you check if the `$XDG_CACHE_HOME` or `$HOME/.cache` directories exists for the root user? bye, Sumit > > Thanks! > > Winfried >

2 3

SRV and URI records are not cleaned after ipa server-del
by Kees Bakker 18 Nov '24

18 Nov '24

Hi, After I did a "ipa server-del" I was expecting that the SRV and URI records were cleaned up as well. But they weren't. I'm talking about DNS records like _kerberos.example.com _kerberos_tcp.example.com _ldap_tcp.example.com etc Is this a known issue? Am I expected to cleanup these entries myself? after a ipa server-del -- Kees

2 4

Disabling "kinit admin" on all machines
by Dominik Vogt 18 Nov '24

18 Nov '24

What is the correct way to disable "kinit admin" on all ipa clients? In our setup, becoming admin should only possible on the ipa server. (Everything is done by scripts runn through ssh; nobody ever logs in to the server directly.) Ciao Dominik ^_^ ^_^ -- Dominik Vogt

3 12

radius-proxy / Blast-Radius
by Angus Clarke 15 Nov '24

15 Nov '24

Hello Our RSA infra was upgraded to address Blast-Radius vulnerability https://www.blastradius.fail/ Since then, radius-proxy enabled users can no longer authenticate against those providers. I understand the RSA radius servers now require Message-Authenticator attributes to be set which I suppose is the missing piece when freeipa attempts to authenticate. Anybody have a view on this? Thanks Angus From the RSA instructions (lol): RSA recommends asking your vendors for a fix for the BlastRADIUS vulnerability and applying the client-side fixes immediately. This must be done before applying the RSA patches and enabling the Message-Authenticator configuration.

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2024