June 2024 - FreeIPA-users - Fedora mailing-lists

Override Sudo Rule for one host
by Russ Long 24 Jun '24

24 Jun '24

I'm setting up a new FreeIPA cluster/environment, and have one host that I do not want included in my sudo rule that normally allows sudo to all hosts. Basically this machine is holding highly sensitive data, and will be used by multiple people who normally have sudo to all hosts, but I do not want them to have sudo on this host. I do not see a way to exclude a host, is the only option to add every other host manually to a rule or is there a way to "blacklist" a certain host in a sudo rule. --Russ

2 2

SMB share with IPA ID Views user and group mapping
by Yossi Hayat 24 Jun '24

24 Jun '24

Hi, To centrally manage all credentials from Active Directory, we configured FreeIPA integration with Active Directory to authenticate users to IPA-joined Linux machines via SSSD using AD credentials. The Linux machines have NFS shares mounted on their local filesystems which we use to work in a sharable way. We have configured FreeIPA "ID Views" for each user to override the AD-originating generic UID and GID with shorter UID and GID values. This is to preserve IPA-authenticated users' NFS permissions that were inherited from the previous Linux directory management system (NIS) we used and for simplicity. When working locally or remotely (SSH/VNC) on the Linux machines, everything is working as expected with no issues. Our problem is with SMB - We need to share the NFS shares over SMB for direct File Explorer access for Windows users. For this purpose, we have an Ubuntu machine we use as an SMB server. The server is joined to IPA as a client and has all NFS shares mounted locally on its filesystem. The ideal way is to somehow configure SMB to forward authentication to IPA (as it was a local/SSH authentication to the server) and map the ID views user and group IDs to preserve permissions. We searched all over the internet and didn't find a working solution for this use case. Is this supported? If yes, how can this be implemented?

2 2

Prevent domain-local groups from being mapped at all
by Ronald Wimmer 24 Jun '24

24 Jun '24

Is there a way for preventing AD domain-local groups from being mapped into IPA? From time to time colleagues try to use AD groups with scope 'domain local'. Personally, I do not see a use case for these groups mapped into IPA... Cheers, Ronald

2 1

Ranger FreeIPA Integration
by Mike Patterson 20 Jun '24

20 Jun '24

Anyone have success with integrating FreeIPA with Ranger? I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users. I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both. Any suggestions are greatly appreciated. Mike

2 3

Ranger FreeIPA Integration
by Mike Patterson 19 Jun '24

19 Jun '24

Anyone have success with integrating FreeIPA with Ranger? I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users. I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both. Any suggestions are greatly appreciated. Mike

1 0

Ranger FreeIPA Integration
by Mike Patterson 19 Jun '24

19 Jun '24

Anyone have success with integrating FreeIPA with Ranger? I have them sync-ed and it generally works, but I'm confused by the lack of attributes being shared by FreeIPA concerning Users. I'm unclear if FreeIPA isnt sharing attributes (beyond the most basic) via the LDAP protocol or if Ranger is not setup to read/display/use them or both. Any suggestions are greatly appreciated. Mike

1 0

FreeIPA on CentOS 7 fails with latest bind packages
by Jeremy Utley 19 Jun '24

19 Jun '24

Hello Everyone! We have a pair of IPA servers running under CentOS 7 (I know, EOL is approaching, and we are working on migrating!). When we applied the latest patches this morning, the new bind packages were causing named-pkcs11 to core dump during ipa-server-upgrade. The new package versions were: bind-9.11.4-26.P2.el7_9.16.x86_64 bind-dyndb-ldap-11.1-7.el7_9.1.x86_64.rpm The error we saw is almost identical to what is documented at: https://access.redhat.com/solutions/7065748 for RHEL8/9, but the recommended fixes did not help. We rolled our installation back to the previous bind packages and everything works again. I don't think there's anyplace remaining to submit CentOS 7 bug reports, and I'm also not sure if this same issue would impact the remaining RHEL 7 installs, since we have no RHEL licensing. So I thought I would put it out on here, so at least others are aware of the issue!

2 1

I am unable to install freeIPA server by dnf in Redhat Linux 8.1
by veck zuo 19 Jun '24

19 Jun '24

=> I am trying to deploy a freeIPA server in VM. Following the steps from https://www.freeipa.org/page/Quick_Start_Guide . I am unable to install the package by dnf . VM: [root@freeipa ~]# cat /etc/redhat-release Red Hat Enterprise Linux release 8.10 (Ootpa) [root@freeipa ~]# uname -r 4.18.0-372.9.1.el8.x86_64 [root@freeipa ~]# [root@freeipa ~]# dnf search freeipa-server Updating Subscription Management repositories. Last metadata expiration check: 0:13:36 ago on Sun 16 Jun 2024 12:57:13 AM CST. No matches found. [root@freeipa ~]#

2 1

How to grant sysaccount rights to change attributes of user (ldap bind)
by Se Fer 18 Jun '24

18 Jun '24

Hey there I provisioned a FreeIPA instance (IPA, version: 4.10.2, dockerized) to switch from atlassian crowd. For the ldap bind in i.e. Jira I created a sysaccount and already added it to "cn=System: Change User password,cn=permissions,cn=pbac,$SUFFIX". This way users can change their password in Jira itself. Now I want my users to be able to change their Display Name or Mail Address. Therefore I tried adding the sysaccount to "cn=System: Modify Users,cn=permissions,cn=pbac,$SUFFIX" but the changes do not get through to FreeIPA. There is no error displayed in Jira and I cannot find any hint within FreeIPA logs so far. Do you have any advice on how to proceed from here? Best regards Sefer

1 1

Re: `ipactl restart` fails with `Unknown error when retrieving list of services from LDAP: not enough values to unpack (expected 2, got 1)`
by Schwerdlin, Jason T RTX 17 Jun '24

17 Jun '24

Did you get a resolution to this? Were seeing the same thing when installing on Rocky9. Initial bring up is OK but after restart it fails. In our case it is because the ldap_uri line is missing from /etc/ipa/default.conf (the topic of the Redhat article) Once we manually insert that, we hit an error with krb5kdc and kadmin failing to start and we more or les follow the steps documented here to get them to start up: https://stackoverflow.com/questions/60273441/kerberos-service-started-with-…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2024