January 2025 - FreeIPA-users - Fedora mailing-lists

Upgrade from 4.12.2-1.el9 to 4.12.2-7.el9 on centos stream 9 failed
by Russ Long 24 Jan '25

24 Jan '25

I just upgraded, using dnf, from 4.12.2-1.el9 to 4.12.2-7.el9 on a Centos Stream 9 IPA server. During the DNF upgrade, I received the following error: Job for ipa.service failed because the control process exited with error code. See "systemctl status ipa.service" and "journalctl -xeu ipa.service" for details. After the upgrade I attempted a manual ipa-server-upgrade which was met with many errors. I attempted a reboot of the host as it needed it for a kernel update anyways. Post reboot, none of the IPA Services will start, so ipa-server-upgrade fails nearly instantly. ipactl start fails as it attempts to run the server-upgrade. ipactl start --skip-version-check fails with an error about dirsrv: [root@ipa-primary sysrestore]# ipactl start --skip-version-check Skipping version check Starting Directory Service Failed to start Directory Service: CalledProcessError(Command ['/bin/systemctl', 'start', 'dirsrv(a)REDACTED.service'] returned non-zero exit status 1) That service shows multiple errors: Jan 24 10:08:01 REDACTED ns-slapd[4763]: [24/Jan/2025:10:08:01.238214824 -0500] - ERR - plugin_setup - Required attribute nsslapd-pluginInitFunc is missing from entry "cn=Case Exact String Syntax,cn=plugins,cn=config" Jan 24 10:08:01 REDACTED ns-slapd[4763]: [24/Jan/2025:10:08:01.240364122 -0500] - ERR - slapd_bootstrap_config - The plugin entry [cn=Case Exact String Syntax,cn=plugins,cn=config]in the configfile /etc/dirsrv/slapd-REDACTED/dse.ldif was invalid. Required attribute nsslapd-pluginInitFunc is missing from entry. Jan 24 10:08:01 REDACTED ns-slapd[4763]: [24/Jan/2025:10:08:01.241806986 -0500] - EMERG - main - The configuration files in directory /etc/dirsrv/slapd-REDACTED could not be read or were not found. Please refer to the error log or output for more information. Jan 24 10:08:01 REDACTED systemd[1]: dirsrv(a)REDACTED.service: Main process exited, code=exited, status=1/FAILURE Jan 24 10:08:01 REDACTED systemd[1]: dirsrv(a)REDACTED.service: Failed with result 'exit-code'. Jan 24 10:08:01 REDACTED systemd[1]: Failed to start 389 Directory Server REDACTED.. Is there any way to save this?

1 4

can't enroll ubuntu 24
by Dmitry Krasov 24 Jan '25

24 Jan '25

Hello. Trying to enroll Ubuntu 24.04 to domain, but it says "certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa2.dom.loc'. (_ssl.c :1000)" But when I trying ipa web adress via browser it's seems fine. It's selfsigned like always, but date and name are fine. And just recently I have successfully added another one host How can I fix it? Maybe I can disable certificate checking somehow, just for start? sudo ipa-client-install --hostname dit-ntb-spc39-1797875.dom.loc --server=ipa2.dom.loc --enable-dns-updates --domain dom.loc --mkhomedir -p admin -w Password --force-join This program will set up IPA client. Version 4.11.1 WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd Using existing certificate '/etc/ipa/ca.crt'. Autodiscovery of servers for failover cannot work with this configuration. If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure. Proceed with fixed values and no DNS discovery? [no]: y Do you want to configure chrony with NTP server or pool address? [no]: Client hostname: dit-ntb-spc39-1797875.dom.loc Realm: dom.loc DNS Domain: dom.loc IPA Server: ipa2.dom.loc BaseDN: dc=l3874,dc=ru Continue to configure the system with these values? [no]: y Removed old keys for realm dom.loc from /etc/krb5.keytab Synchronizing time Configuration of chrony was changed by installer. Attempting to sync time with chronyc. Time synchronization was successful. Enrolled in IPA realm dom.loc Created /etc/ipa/default.conf Domain dom.loc is already configured in existing SSSD config, creating a new one. The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. Configured /etc/sssd/sssd.conf Connection to https://ipa2.dom.loc/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa2.dom.loc'. (_ssl.c :1000) Connection to https://ipa.dom.loc/ipa/json failed with [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'ipa.dom.loc'. (_ssl.c:1000) cannot connect to 'любой из настроенных серверов': https://ipa2.dom.loc/ipa/json, https://ipa.dom.loc/ipa/json The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

3 29

Fedora 41 - ssl/tls alert handshake failure on CA subsystem
by Hannes Eberhardt 24 Jan '25

24 Jan '25

Hi, I recently upgraded my FreeIPA host system from Fedorda 40 to 41. Since the upgrade I am unable to access the details of the CA subsystem. While I get a list/overview of all certificates that are available in the directory, FreeIPA throws an error if I try to access a specific certificate or CA. The error is: IPA Error 907: Network Error cannot connect to 'https://my-idm-server.idm.my.domain:443/ca/rest/certs/216402019788816070027…' : [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:2638) I am also getting this error while running the ipa-healthcheck. { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConnectivityCheck", "result": "ERROR", "uuid": "84949312-c4a1-4924-95e5-338894d2ee27", "when": "20250122094218Z", "duration": "0.022545", "kw": { "key": "cert_show_ra", "error": "cannot connect to 'https://my-idm-server.idm.my.domain:443/ca/rest/certs/198421384424903357883…' : [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:2638)", "serial": "198421384424903357883919048254057663382", "msg": "Request for certificate failed: {error}" } }, [...] I am able to get a working TLS Handshake and a sensible reply with curl on the same machine. At first I guessd it might be an incompatiblity with TLSv1.3, so I tried to configure only TLSv1.2 in the httpd ssl.conf, but this did not resolve the issue. I also tried to use the legacy system crypto-policy instead of the default one. So I don't really think that this is a cipher missmatch/compatiblity issue. Could this be a verification issue on the certificate chain somewhere? Does someone maybe have a hint where to start looking next and get this fixed? FreeIPA Version 4.12.2 OS: Fedora 41 Server, no upgrades pending, default repos. Thank you for your help! Cheers, Hannes

3 5

ipa: ERROR: No valid Negotiate header in server response
by Frederic Ayrault 22 Jan '25

22 Jan '25

Bonjour, When I try the command 'ipa ping', I get on the console the error with --debug (I am also unable to login in the gui) > ipa: DEBUG: failed to find session_cookie in persistent storage for > principal 'admin(a)LIX.POLYTECHNIQUE.FR' > ipa: INFO: trying https://ipa4.lix.polytechnique.fr/ipa/json > ipa: DEBUG: Created connection context.rpcclient_140138341763920 > ipa: INFO: [try 1]: Forwarding 'schema' to json server > 'https://ipa4.lix.polytechnique.fr/ipa/json' > ipa: DEBUG: New HTTP connection (ipa4.lix.polytechnique.fr) > ipa: DEBUG: HTTP connection destroyed (ipa4.lix.polytechnique.fr) > Traceback (most recent call last): > File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 726, in > single_request > if not self._auth_complete(response): > File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 679, in > _auth_complete > message=u"No valid Negotiate header in server response") > KerberosError: No valid Negotiate header in server response > ipa: DEBUG: Destroyed connection context.rpcclient_140138341763920 > ipa: ERROR: No valid Negotiate header in server response and in the logs > ==> /var/log/krb5kdc.log <== > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1848](info): AS_REQ > (8 etypes {18 17 16 23 20 19 25 26}) 193.55.176.152: NEEDED_PREAUTH: > HTTP/ipa4.lix.polytechnique.fr(a)LIX.POLYTECHNIQUE.FR for > krbtgt/LIX.POLYTECHNIQUE.FR(a)LIX.POLYTECHNIQUE.FR, Additional > pre-authentication required > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1848](info): closing > down fd 11 > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1851](info): preauth > (encrypted_timestamp) verify failure: Preauthentication failed > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1851](info): AS_REQ > (8 etypes {18 17 16 23 20 19 25 26}) 193.55.176.152: PREAUTH_FAILED: > HTTP/ipa4.lix.polytechnique.fr(a)LIX.POLYTECHNIQUE.FR for > krbtgt/LIX.POLYTECHNIQUE.FR(a)LIX.POLYTECHNIQUE.FR, Preauthentication failed > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1851](info): closing > down fd 11 > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1847](info): AS_REQ > (8 etypes {18 17 16 23 20 19 25 26}) 193.55.176.152: NEEDED_PREAUTH: > HTTP/ipa4.lix.polytechnique.fr(a)LIX.POLYTECHNIQUE.FR for > krbtgt/LIX.POLYTECHNIQUE.FR(a)LIX.POLYTECHNIQUE.FR, Additional > pre-authentication required > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1847](info): closing > down fd 11 > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1851](info): preauth > (encrypted_timestamp) verify failure: Preauthentication failed > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1851](info): AS_REQ > (8 etypes {18 17 16 23 20 19 25 26}) 193.55.176.152: PREAUTH_FAILED: > HTTP/ipa4.lix.polytechnique.fr(a)LIX.POLYTECHNIQUE.FR for > krbtgt/LIX.POLYTECHNIQUE.FR(a)LIX.POLYTECHNIQUE.FR, Preauthentication failed > Jan 20 15:20:08 ipa4.lix.polytechnique.fr krb5kdc[1851](info): closing > down fd 11 > > ==> /var/log/httpd/error_log <== > [Mon Jan 20 15:20:08.754030 2025] [auth_gssapi:error] [pid 6735] > [client 193.55.176.152:51668] GSS ERROR gss_acquire_cred[_from]() > failed to get server creds: [Unspecified GSS failure. Minor code may > provide more information ( SPNEGO cannot find mechanisms to > negotiate)], referer: https://ipa4.lix.polytechnique.fr/ipa/xml I am running 4.6.8-5 on CentOS in a CA less. I tried 'getcert resubmit -i' according to what I found here https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… , Unfortunately without success Thank you for your help Regards, Frédéric AYRAULT Administrateur Systèmes et Réseaux Laboratoire d'Informatique de l'Ecole polytechnique <http://www.lix.polytechnique.fr> fred(a)lix.polytechnique.fr

2 2

FreeIPA and automatically renewed user certs for VPN connections
by Ronald Wimmer 21 Jan '25

21 Jan '25

Some time ago I read an excellent blog post about this topic. But unfortunately I cannot find it anymore... Anyone knows what I am talking about? Any input on that matter is highly appreciated! Cheers, Ronald

2 2

Can't renew certificates after upgrading tomcat version
by Tran Ngoc Duc 21 Jan '25

21 Jan '25

Hi, I want to upgrade tomcat version from 9.0.62 to 9.0.98 in FreeIPA 4.11.0 - CentOS 9 [root@aaa~]# yum list installed tomcat* Installed Packages tomcat.noarch 1:9.0.62-39.el9 @appstream tomcat-el-3.0-api.noarch 1:9.0.62-39.el9 @appstream tomcat-jsp-2.3-api.noarch 1:9.0.62-39.el9 @appstream tomcat-lib.noarch 1:9.0.62-39.el9 @appstream tomcat-servlet-4.0-api.noarch 1:9.0.62-39.el9 @appstream [root@aaa ~]# yum list available tomcat* Available Packages tomcat.noarch 1:9.0.87-2.el9 appstream tomcat-admin-webapps.noarch 1:9.0.87-2.el9 appstream tomcat-docs-webapp.noarch 1:9.0.87-2.el9 appstream tomcat-el-3.0-api.noarch 1:9.0.87-2.el9 appstream tomcat-jsp-2.3-api.noarch 1:9.0.87-2.el9 appstream tomcat-lib.noarch 1:9.0.87-2.el9 appstream tomcat-servlet-4.0-api.noarch 1:9.0.87-2.el9 appstream tomcat-webapps.noarch 1:9.0.87-2.el9 appstream tomcatjss.noarch 8.2.0-0.2.beta1.el9 appstream It can't not update with yum. So I download tomcat:9.0.98 with command: "wget https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.98/bin/apache-tomcat-9.0.98.t…" I changed time system to force certificates renewal. Some certificates renew successfully, but some are failed: Request ID '20240627032922': status: CA_UNREACHABLE ca-error: Error 7 connecting to http://aaa.bbb.com:8080/ca/ee/ca/profileSubmit: Couldn't connect to server. stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='Server-Cert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=BBB.COM subject: CN=aaa.bbb.com,O=BBB.COM issued: 2024-06-27 03:28:19 UTC expires: 2026-06-17 03:28:19 UTC dns: aaa.bbb..com key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-kp-clientAuth profile: caServerCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "Server-Cert cert-pki-ca" track: yes auto-renew: yes Can someone help me ? Thanks a lot.

2 3

Re: Create IPA user via LDAP
by Ronald Wimmer 21 Jan '25

21 Jan '25

On 08.01.24 17:58, Alexander Bokovoy wrote: > On Пан, 08 сту 2024, Ronald Wimmer wrote: >> On 02.01.24 17:57, Ronald Wimmer via FreeIPA-users wrote: >>> On 02.01.24 16:27, Rob Crittenden wrote: >>>> Ronald Wimmer via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 14.12.23 14:42, Alexander Bokovoy wrote: >>>>>> On Чцв, 14 сне 2023, Ronald Wimmer via FreeIPA-users wrote: >>>>>>> In our company we do have an IAM tool for user management. We >>>>>>> need to >>>>>>> create IPA users via this particular tool. I am aware of all IPA >>>>>>> commands or API calls to create/modify or delete a user. >>>>>>> >>>>>>> As the tool does not support FreeIPA yet they asked if there is a >>>>>>> way >>>>>>> to manage users by using LDAP only. Could that work? What about >>>>>>> attributes like ipaNTSecurityIdentifier, ipaUniqueID or uidNumber? >>>>>> >>>>>> Learn about lifecycle management. This is your way of integrating >>>>>> with >>>>>> such tools bvy creating staged users: >>>>>> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/ht… >>>>>> >>>>> >>>>> I followed the instructions from the documentation. >>>>> >>>>> How could I possibly overcome >>>>> >>>>> Dec 19 09:18:39 tipa01.ipatest.mydomain.at ipa-activate-all[836863]: >>>>> ipa: ERROR: Constraint violation: pre-hashed passwords are not valid >>>>> >>>>> I need to set passwords from the external system. >>>> >>>> You need to enable migration mode (ipa config-mod --enable-migration >>>> true). >>>> >>>> By default a pre-hashed password can only be set once: during the user >>>> add operation. >>> >>> Ok. So this would not work for a password change. So if we need to >>> set an initial password and change that particular password in some >>> point in time the only feasible way is the IPA API, right? >>> >>> Can the immediate password expiration be overridden? >> >> As we have an upcoming please allow me to ask if I got the point here. >> >> I appreciate your support in this matter! >> > > I was looking over the code. The only way to accept pre-hashed passwords > is when they also have Kerberos keys set. This means you cannot use > external LDAP modify/add for that as you cannot create the Kerberos key > without knowing a Kerberos master key. > > So the only other option is to submit a clear-text password: > > userPassword: {CLEAR}text-password > > That will be accepted and if bind DN that performed this change is > either a cn=Directory Manager or a one from the passsync managers, it > would also not be marked for expiration immediately. If I try to set the userPassword attribute to some value with an LDAP browser and chose "plaintext" the value gets hashed immediately. I do see {PBKDF2_SHA256}. As a consequence the user cannot be activated. What am I doing wrong? I tried to enable migration mode and wanted to try it again but now I cannot connect to IPA's LDAP directory at all anymore... [root@tipa01 ~]# ipa config-mod --enable-migration=true Maximum username length: 32 Maximum hostname length: 64 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: ipatest.mydomain.at Search time limit: 2 Search size limit: 100 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: True Certificate Subject base: O=IPATEST.MYDOMAIN.AT Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA master capable of PKINIT: tipa01.ipatest.mydomain.at, tipa02.ipatest.mydomain.at IPA CA servers: tipa01.ipatest.mydomain.at IPA CA renewal master: tipa01.ipatest.mydomain.at Domain resolution order: org.mydomain.at:ipatest.mydomain.at [root@tipa01 ~]# ipa config-mod --enable-migration=false ipa: ERROR: Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638972): KDC returned error string: PROCESS_TGS

4 47

Prevent user from changing its password
by Ronald Wimmer 21 Jan '25

21 Jan '25

What would be the best way to do this? Cheers, Ronald

1 1

2FA not working with OpenVPN Free IPA Integration
by Tinku Goyal 20 Jan '25

20 Jan '25

My setup includes a set of FreeIPA servers running on 4.9.2 version and a OpenVPN configured for the users to connect to VPN. Previously I was using IPA version 4.6.8 on CentOS7 and now installed IPA replica on 4.9.2 on OL8 and decommissioned the old one. I am using openvpn-plugin-auth-pam.so with login pam file to authenticate the IPA users logging in to OpenVPN. when I am resetting the password of users now, then users are not able to login to OpenVPN with 2FA (password+otp) whereas, with otp disabled it is working for old users for whom password is not resetted recently after change in IPA cluster, their authentication is working through OpenVPN with/without OTP both. All users(old + users whose password is resetted recently) are able to login to linux servers using password and OTP both combination, its just not authenticating in OpenVPN. I have tried multiple things but still couldn't able to get it work. Hoping if someone can help with this!!

3 7

Multi-Arch support of freeipa-container images
by Ronald Wimmer 18 Jan '25

18 Jan '25

I've read https://github.com/freeipa/freeipa-container/issues/596#issuecomment-198865… for example. I am wondering if there is any progress here? We are experimenting with K3s clusters on Raspberry Pis (5). It would be great if FreeIPA could run inside a pod on that hardware...

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2025