November 2024 - FreeIPA-users - Fedora mailing-lists

Errors in dirsrv log
by Ranbir 14 Mar '25

14 Mar '25

I'm seeing errors like the ones below on my ipa servers (excuse the wrapping): [11/Aug/2023:22:07:37.684144411 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d558000400130000 [11/Aug/2023:22:07:37.686865097 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5d8d00004003e0000 [11/Aug/2023:22:07:37.689902756 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5dc51000700190000 [11/Aug/2023:22:07:37.693576614 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d5ff800005002d0000 [11/Aug/2023:22:07:37.696088129 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d60301000400380000 [11/Aug/2023:22:07:37.698351038 -0700] - ERR - get_value_from_string - type does not match: dsEntryDN != dsEntryDN;vucsn-64d606800007000d0000 I can't find anything about what they mean. What do these errors mean? How do I resolve the problem? -- Ranbir

3 5

Cannot create users on platform migration: sambaSID failure
by Melissa Ferreira da Silva Boiko 07 Mar '25

07 Mar '25

Hi, I'm trying to upgrade an ancient master replica (the CA master) running FreeIPA 4.5 on CentOS 7.4. Upgrading the freeipa packages in-place (in a cloned VM) caused numerous problems so I'm trying to create a new master replica on a fresh Fedora 39, using the "Migrating to different platform or OS" procedure described on https://www.freeipa.org/page/Howto/Migration At first sight the new replica appears to work, but user creation fails, both on the web and command-line, with: ipa user-add --first=Testy --last=McTestface teste123 ipa: ERROR: missing attribute "sambaSID" required by object class "sambaSamAccount" Web searches seem to suggest this is due to a missing DNA plugin that should autogenerate the sambaSIDs, but I failed to find a guide on how to enable that plugin with current IPA (4.11). Should it be enabled automatically? Unless it's used for something internal to IPA I don't think we actually are even using AD integration or SMB shares, so removing Samba support altogether would also be an option, but I don't know what's the safe way of doing that to the schema either. Thanks for your help!

3 8

Re: Create IPA user via LDAP
by Ronald Wimmer 21 Jan '25

21 Jan '25

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 47

2FA not working with OpenVPN Free IPA Integration
by Tinku Goyal 20 Jan '25

20 Jan '25

My setup includes a set of FreeIPA servers running on 4.9.2 version and a OpenVPN configured for the users to connect to VPN. Previously I was using IPA version 4.6.8 on CentOS7 and now installed IPA replica on 4.9.2 on OL8 and decommissioned the old one. I am using openvpn-plugin-auth-pam.so with login pam file to authenticate the IPA users logging in to OpenVPN. when I am resetting the password of users now, then users are not able to login to OpenVPN with 2FA (password+otp) whereas, with otp disabled it is working for old users for whom password is not resetted recently after change in IPA cluster, their authentication is working through OpenVPN with/without OTP both. All users(old + users whose password is resetted recently) are able to login to linux servers using password and OTP both combination, its just not authenticating in OpenVPN. I have tried multiple things but still couldn't able to get it work. Hoping if someone can help with this!!

3 7

Two-way trusts and AD Linux client.
by Aleksandr Sabirov 31 Dec '24

31 Dec '24

Hello, Suppose we have: Machine - with the full name ws16.ad16.loc - MS AD. Windows Server 2016 Machine - with the full name ipasrv-1.ipadomain.loc - IdM AD version 4.8.10. Linux Debian Machine - with the full name adclient-1.ad16.loc - AD Client. Linux Debian Bidirectional trust relationships between IPA and AD are configured. The third machine is joined to the AD domain using sssd 2.4.0. Can I somehow authenticate on the AD client (third machine) using IdM users via the bidirectional trust relationships? That is, I don't mean the case where we make the AD client partially integrated into IdM by adding settings in sssd.conf for the second domain ([domain/ipadomain.loc]) and updating krb5.keytab. I mean, how can I make it so that the request goes specifically through AD (i.e., via the trust relationships) and not directly to IdM? And is this possible? Thanks.

4 16

Nextcloud/SSO with FreeIPA
by Daniel Pätzold 06 Dec '24

06 Dec '24

Hello, i have setup Freeipa (on Docker) and was able to logon via pam / SSSD on some host. Klist shows a valid Ticket and in Firefox i am able to log into FreeIPAs WebUI using SSO/Kerberos as the User i am logged in. I would like to have Nextcloud (also on Docker) use SSO Kerberos. There are many Apps in Nextcloud and i don't know howto start: SSO/SAML, Social Logon, Backend LDAP, OpenID, OAuth... I only found one Documentation an SSO in Nextcloud but its behind a paywall (and our Company is too small to get a subscription). Does anybody got this working? Which Nextcloud Apps should be used and how would they be configured? -- -- Mit freundlichen Grüßen Daniel Pätzold

5 7

Crashes in bind9 name.c:667: REQUIRE((name1->attributes & 0x00000001) == (name2->attributes & 0x00000001))
by Kees Bakker 02 Dec '24

02 Dec '24

Hi, After a scheduled power down on and power up on one of our IPA servers named crashed. I remember I saw this before and that it was "solved" by restarting named. This time however it took about 12 retries before named finally continued. This is the error it produces ../../../lib/dns/name.c:667: REQUIRE((name1->attributes & 0x00000001) == (name2->attributes & 0x00000001)) failed, back trace bind9 is quite drastic when it hits a failing REQUIRE. It immediately stops with a coredump. But it doesn't tell which names are failing the comparison. Of course I can (or should) report this to the bind developers. However, I'm sure they are going to say that this is an old version and that I should ask CentOS/RH devs. If anybody here on the list has an idea, then please let me know. Some more details Version info: * os: CentOS 9-Stream * ipa packages 4.12.0-4.el9 * bind9 packages 32:9.16.23-15.el9 * bind-libdyndb-ldap 11.9.8-el9 Stack trace: Stack trace of thread 6432: #0 0x00007fb5a348b94c __pthread_kill_implementation (libc.so.6 + 0x8b94c) #1 0x00007fb5a343e646 raise (libc.so.6 + 0x3e646) #2 0x00007fb5a34287f3 abort (libc.so.6 + 0x287f3) #3 0x00005570cbbea5b5 assertion_failed.cold (named + 0x1c5b5) #4 0x00007fb5a433d420 isc_assertion_failed (libisc-9.16.23-RH.so + 0x1c420) #5 0x00007fb5a409f9ca dns_name_equal (libdns-9.16.23-RH.so + 0x9f9ca) #6 0x00007fb5a40b48ec dns_order_find (libdns-9.16.23-RH.so + 0xb48ec) #7 0x00007fb5a4429de8 query_addrrset.lto_priv.0 (libns-9.16.23-RH.so + 0x1dde8) #8 0x00007fb5a442eece query_gotanswer (libns-9.16.23-RH.so + 0x22ece) #9 0x00007fb5a4432b8b fetch_callback (libns-9.16.23-RH.so + 0x26b8b) #10 0x00007fb5a43781bd isc_task_run (libisc-9.16.23-RH.so + 0x571bd) #11 0x00007fb5a43632a9 process_netievent (libisc-9.16.23-RH.so + 0x422a9) #12 0x00007fb5a4363425 process_queue (libisc-9.16.23-RH.so + 0x42425) #13 0x00007fb5a4363c17 async_cb (libisc-9.16.23-RH.so + 0x42c17) #14 0x00007fb5a4285afd uv__async_io.part.0 (libuv.so.1 + 0xaafd) #15 0x00007fb5a42a185e uv__io_poll.part.0 (libuv.so.1 + 0x2685e) #16 0x00007fb5a428b568 uv_run (libuv.so.1 + 0x10568) #17 0x00007fb5a43634db nm_thread (libisc-9.16.23-RH.so + 0x424db) #18 0x00007fb5a4375f9a isc__trampoline_run (libisc-9.16.23-RH.so + 0x54f9a) #19 0x00007fb5a3489c02 start_thread (libc.so.6 + 0x89c02) #20 0x00007fb5a350ec40 __clone3 (libc.so.6 + 0x10ec40) -- Kees

3 5

Two-way trusts and AD Linux client.
by James Hancock 29 Nov '24

29 Nov '24

Hello, Suppose we have: Machine - with the full name ws16.ad16.loc - MS AD. Windows Server 2016 Machine - with the full name ipasrv-1.ipadomain.loc - IdM AD version 4.8.10. Linux Debian Machine - with the full name adclient-1.ad16.loc - AD Client. Linux Debian Bidirectional trust relationships between IPA and AD are configured. The third machine is joined to the AD domain using sssd 2.4.0. Can I somehow authenticate on the AD client (third machine) using IdM users via the bidirectional trust relationships? That is, I don't mean the case where we make the AD client partially integrated into IdM by adding settings in sssd.conf for the second domain ([domain/ipadomain.loc]) and updating krb5.keytab. I mean, how can I make it so that the request goes specifically through AD (i.e., via the trust relationships) and not directly to IdM? And is this possible? Thanks.

1 0

Problem updating IPA
by Sava Savchev 22 Nov '24

22 Nov '24

I am running two IPA servers in replication on Oraclelinux8 with version ipa-server-4.9.13-10.0.1 and 389-ds version 1.4.3.39-8 When I try to update IPA to ipa-server-4.9.13-12.0.2 it fails on ipa-server-upgrade due to dirsrv not starting: ipa-server-upgrade Upgrading IPA:. Estimated time: 1 minute 30 seconds [1/9]: saving configuration [2/9]: disabling listeners [3/9]: enabling DS global lock [4/9]: disabling Schema Compat [5/9]: starting directory server [error] CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n') [cleanup]: stopping directory server [cleanup]: restoring configuration IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. Unexpected error - see /var/log/ipaupgrade.log for details: CalledProcessError: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv@.service'] returned non-zero exit status 1: 'Job for dirsrv@.service failed because the control process exited with error code.\nSee "systemctl status dirsrv@.service" and "journalctl -xe" for details.\n') The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information In dirsrv logs there is: ERR - NSMMReplicationPlugin - changelog program - changelog5_init: failed to start changelog at /var/lib/dirsrv/slapd/cldb When I revert back to the original version, everything is back to normal. I have another cluster with the same configuration and I successfully updated. The only difference is that on the failing one I have enabled changelog encryption. I don't know if this is the correct list to report this problem, but since it is emerging when I update IPA, I guess this is the right one :)

2 2

Free User Certificates - EC certificstes
by Winfried de Heiden 21 Nov '24

21 Nov '24

Hi all, Previously, in another post, I mentioned slowness using Aventra MyEID PKI cards for login, sudo etc. I tried another solution, using EC (Elastic Curve) keys. Speed should benefit, since EC keys are much smaller, keeping the same degree of security. Shoter key = loading faster. Hoever, I seems FreeIPA will not accept and EC key, omly RSA when trying to sing an EC CSR? Would it be possible though to use Elastic Curve certificates? Thanks! Winfried

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2024