April 2025 - FreeIPA-users - Fedora mailing-lists

ipa-replica-install -- cannot get past [26/41]: creating DS keytab
by Jonathon Jenkins 10 Jun '25

10 Jun '25

Greetings, I cannot get the ipa-replica-install to proceed past step 26/41 - creating DS keytab. I see the command that is to be run, and I can run that just fine before and after the ipa-replica-install command, and it creates the keytab. I am not sure how to proceed from here - the bug reports I see all pertain to earlier versions, and my files reflect those changes. I have also tried running this with all manner of password flags, which are correct, but still getting insufficient access rights. particulars: centos 7 3.10.0-957.1.3.el7.x86_64 ipa-server-4.6.4-10.el7.centos.x86_64 ipa-common-4.6.4-10.el7.centos.noarch ipa-server-common-4.6.4-10.el7.centos.noarch ipa-client-4.6.4-10.el7.centos.x86_64 ipa-server-dns-4.6.4-10.el7.centos.noarch ipa-client-common-4.6.4-10.el7.centos.noarch * Note: anonymized output below ipapython.ipautil: DEBUG stderr= ipalib.backend: DEBUG Created connection context.ldap2_139891568509776 ipaserver.install.service: DEBUG duration: 7 seconds ipaserver.install.service: DEBUG [26/41]: creating DS keytab [26/41]: creating DS keytab ipalib.frontend: DEBUG raw: service_add(u'ldap/<ipa-replica-host>@<domain>.NET', force=True, version=u'2.229') ipalib.frontend: DEBUG service_add(ipapython.kerberos.Principal('ldap/<ipa-replica-host>@<domain>.NET'), force=True, all=False, raw=False, version=u'2.229', no_members=False) ipalib.frontend: DEBUG raw: host_show(u'<ipa-replica-host>', version=u'2.229') ipalib.frontend: DEBUG host_show(u'<ipa-replica-host>', rights=False, all=False, raw=False, version=u'2.229', no_members=False) ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/dirsrv/ds.keytab' ipalib.install.sysrestore: DEBUG -> Not backing up - '/etc/dirsrv/ds.keytab' doesn't exist ipapython.ipautil: DEBUG Starting external process ipapython.ipautil: DEBUG args=/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master> ipapython.ipautil: DEBUG Process finished, return code=9 ipapython.ipautil: DEBUG stdout= ipapython.ipautil: DEBUG stderr=Failed to parse result: Insufficient access rights Retrying with pre-4.0 keytab retrieval method... Failed to parse result: Insufficient access rights Failed to get keytab! Failed to get keytab ipaserver.install.service: DEBUG Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipaserver.install.service: DEBUG [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 [error] CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipalib.backend: DEBUG Destroyed connection context.ldap2_139891548583120 ipalib.install.sysrestore: DEBUG Backing up system configuration file '/etc/ipa/default.conf' ipalib.install.sysrestore: DEBUG Saving Index File to '/var/lib/ipa/sysrestore/sysrestore.index' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 364, in run return self.execute() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 389, in execute for rval in self._executor(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 658, in _configure next(executor) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 463, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 622, in main replica_install(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 406, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1431, in install fstore=fstore) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 113, in install_replica_ds setup_pkinit=not options.no_pkinit, File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 419, in create_replica self.start_creation(runtime=30) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 570, in start_creation run_step(full_msg, method) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 560, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1308, in request_service_keytab super(DsInstance, self).request_service_keytab() File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 742, in request_service_keytab self.run_getkeytab(self.api.env.ldap_uri, self.keytab, self.principal) File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 732, in run_getkeytab ipautil.run(args, nolog=nolog) File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 562, in run raise CalledProcessError(p.returncode, arg_string, str(output)) ipapython.admintool: DEBUG The ipa-replica-install command failed, exception: CalledProcessError: Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR Command '/usr/sbin/ipa-getkeytab -k /etc/dirsrv/ds.keytab -p ldap/<ipa-replica-host>@<domain>.NET -H ldaps://<ipa-replica-master>' returned non-zero exit status 9 ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

3 4

Re: freeIPA fails update 4.12.2-5.el9 t 4.12.2-9.el9
by Vicente Quintans 03 Jun '25

03 Jun '25

We found this issue today, upgrading from Fedora 40 to Fedora 41. In dogtagpki the /ca/rest/account/login endpoint (actually all /ca/rest endpoints) was moved to /ca/v1 in this commit: https://github.com/dogtagpki/pki/commit/850e6b9e5128264a471e57b70ab8d970cf9… We were able to complete the upgrade succesfully modifying the file /usr/lib/python3.13/site-packages/ipaserver/plugins/dogtag.py changing al "/rest" to "/v1". With this modification ipa-server-upgrade completed successfully. It seems there is some kind of version mismatch. Greetings, Vicente Quintáns.

10 35

FreeIPA failed after upgrading to fedora 42
by Ian Kumlien 09 May '25

09 May '25

Hi, I have two freeipa servers that failed after the upgrade. On one, i managed to fix it with ipa-cert-fix since they had expired again, but i'm now left with: ipa-backup Preparing backup on freeipa1.... Error: Local roles CA, DNS, DNSKeySync do not match globally used roles CA, DNS, DNSKeySync, KRA. A backup done on this host would not be complete enough to restore a fully functional, identical cluster. The ipa-backup command failed. See /var/log/ipabackup.log for more information And on the other pki-tomcat doesn't start without ca_signing.csr which it never had according to backups... Any clues?

3 10

Using OIDC device code auth for SSH access
by Anders Wittendorff 30 Apr '25

30 Apr '25

I'm currently stuck in an implementation of device code auth for SSH access using External Identity on FreeIPA 4.12. My issue is that when connecting with SSH I get the correct message: Authenticate at https://... with code and press Enter. But after authentication at external IDP and pressing Enter the login just loops, and when looking at logs on the FreeIPA server I can see the Access-Challenge but seems to shutdown the process: Apr 23 13:31:27 ipa-test.int.domain.net ipa-otpd[147396]: username(a)INT.DOMAIN.NET: response sent: Access-Challenge Apr 23 13:31:27 ipa-test.int.domain.net ipa-otpd[147396]: oauth2.c:089: Child finished with status [0]. Apr 23 13:31:27 ipa-test.int.domain.net ipa-otpd[147396]: Socket closed, shutting down... Any inputs?

2 9

CA-less conversion
by tipex tipex 28 Apr '25

28 Apr '25

I've recently had a lot of trouble with CA on my FreeIPA 2 node cluster. Some amazing people on this forum have helped me fix the issues but its got me thinking that I dont use CA as I have external certificates (LetsEncrypt) so could I get rid of it. Less stuff = less failures. I'm wondering if I could create two new machines (C and D) without CA installed and add them to the cluster. Then remove the two existing machines (A and B) which have CA installed. This way I remove CA but keep all my users and settings that are currently in FreeIPA. Does this sound feasible or am I asking for problems? Thanks

2 2

Fedora 41 to F42 system-upgrade errors out on tomcat CA login attempt
by Eric Ashley 24 Apr '25

24 Apr '25

Hello, I'm running the following new versions: |Installed packages freeipa-client.x86_64 4.12.2-13.fc42 updates freeipa-client-common.noarch 4.12.2-13.fc42 updates freeipa-common.noarch 4.12.2-13.fc42 updates freeipa-healthcheck.noarch 0.17-6.fc42 fedora freeipa-healthcheck-core.noarch 0.17-6.fc42 fedora freeipa-selinux.noarch 4.12.2-13.fc42 updates freeipa-server.x86_64 4.12.2-13.fc42 updates freeipa-server-common.noarch 4.12.2-13.fc42 updates freeipa-server-dns.noarch 4.12.2-13.fc42 updates libcamera-ipa.x86_64 0.4.0-4.fc42 fedora libipa_hbac.x86_64 2.10.2-3.fc42 fedora python3-ipaclient.noarch 4.12.2-13.fc42 updates|| ||python3-ipalib.noarch 4.12.2-13.fc42 updates| |ipactl status |reports the following: Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED pki-tomcatd Service: RUNNING ipa-otpd Service: STOPPED ipa-ods-exporter Service: STOPPED ods-enforcerd Service: STOPPED ipa-dnskeysyncd Service: RUNNING 5 service(s) are not running On initial boot, the system started the FreeIPA upgrade, which got through all the certificate checks with no issues, then reports the following errors (with retry): |2025-04-17T18:43:18Z INFO [Ensuring presence of included profiles] 2025-04-17T18:43:18Z DEBUG Discovery: available servers for service 'CA' are phobos.ipa.ab-data.us 2025-04-17T18:43:18Z DEBUG Discovery: using phobos.ipa.ab-data.us for 'CA' service 2025-04-17T18:43:18Z DEBUG request GET https://phobos.ipa.ab-data.us:443/ca/rest/account/login 2025-04-17T18:43:18Z DEBUG request body '' 2025-04-17T18:43:18Z DEBUG response status 404 2025-04-17T18:43:18Z DEBUG response headers Date: Thu, 17 Apr 2025 18:43:18 GMT Server: Apache/2.4.63 (Fedora Linux) OpenSSL/3.2.4 mod_wsgi/5.0.2 Python/3.13 mod_auth_gssapi/1.6.5 Content-Type: text/html;charset=utf-8 Content-Language: en Transfer-Encoding: chunked 2025-04-17T18:43:18Z DEBUG response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/ca/rest/account/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.98</h3></body></html>' 2025-04-17T18:43:18Z DEBUG Overriding CA port: Failed to authenticate to CA REST API 2025-04-17T18:43:18Z DEBUG Profile 'KDCs_PKINIT_Certs' is already in LDAP; skipping 2025-04-17T18:43:18Z DEBUG Profile 'caIPAserviceCert' is already in LDAP; skipping 2025-04-17T18:43:18Z DEBUG Profile 'acmeIPAServerCert' is already in LDAP; skipping 2025-04-17T18:43:18Z DEBUG Profile 'IECUserRoles' is already in LDAP; skipping 2025-04-17T18:43:18Z INFO [Add default CA ACL] 2025-04-17T18:43:18Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2025-04-17T18:43:18Z INFO Default CA ACL already added 2025-04-17T18:43:18Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2025-04-17T18:43:18Z DEBUG Discovery: available servers for service 'CA' are phobos.ipa.ab-data.us 2025-04-17T18:43:18Z DEBUG Discovery: using phobos.ipa.ab-data.us for 'CA' service 2025-04-17T18:43:18Z DEBUG request GET https://phobos.ipa.ab-data.us:8443/ca/rest/account/login 2025-04-17T18:43:18Z DEBUG request body '' 2025-04-17T18:43:18Z DEBUG response status 404 2025-04-17T18:43:18Z DEBUG response headers Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 784 Date: Thu, 17 Apr 2025 18:43:18 GMT 2025-04-17T18:43:18Z DEBUG response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/ca/rest/account/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.98</h3></body></html>' 2025-04-17T18:43:18Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2025-04-17T18:43:18Z DEBUG File "/usr/lib/python3.13/site-packages/ipapython/admintool.py", line 219, in execute return_value = self.run() File "/usr/lib/python3.13/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() ~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/server/upgrade.py", line 2097, in upgrade upgrade_configuration() ~~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/server/upgrade.py", line 1958, in upgrade_configuration cainstance.repair_profile_caIPAserviceCert() ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/cainstance.py", line 2166, in repair_profile_caIPAserviceCert with api.Backend.ra_certprofile as profile_api: ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/ipaserver/plugins/dogtag.py", line 610, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2025-04-17T18:43:18Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2025-04-17T18:43:18Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API 2025-04-17T18:43:18Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information| Tomcat is active, all the certificates are current and in LDAP. I was unable to find anything similar in the archive. How to I go about getting this update to finish? Best regards, Eric

4 7

Integration AD and IPA for single auth point
by Fiodor Cibulin 24 Apr '25

24 Apr '25

Hi Everybody I need help with recommendation on integration of AD and IPA . Our target is to create an environment with single authentication credentials, while allow preserving user access configuration (sudo / HBAC ) and data permissions via groups independently. We have some Samba setups that need to get information from both systems so we added UID and GID information to AD objects . In our environment we have hundreds of lab desktops and portable devices running Ubuntu and RHEL based OS . While most of user personal devices are Windows based we have some users using Linux as well. I found following ways: Password sync service. My college used it previously and recommended it as solution, but it looks that this way is not under development recently and not recommended for new setups. AD - IPA domains trust. I tested trust between AD and IPA and stuck with issue that we were required to multiply user groups as were unable to get access/sudo without creating POSIX IPA groups . We are using NFS3 with 16 groups limit that significantly limiting us in how many POSIX groups user can be member of . IPA - AD via Radius with LDAP backend. I tested such setup and it was working correctly for online systems, but offline users were unable to login. Offline login is must for our setup as we have user laptops. All my attempts to find solution on this behaviour were not successful and even with Ubuntu 24 that includes SSSD 2.9 that intended to support FAST channel for getting Kerberos ticket offline login failed. Maybe I missed something and there is some better way as I am sure that my setup is similar to many other companies. Looking for any tips or recommendation on the integration of AD and IPA . Thanks.

1 0

Enable random certificate serial numbers on existing installation
by Kroon PC, Peter 23 Apr '25

23 Apr '25

Hello world, I recently set up the certificate ACME service on my IPA installation, and am looking into pruning old and expired certificates. However, when I try `ipa-acme-manage pruning --config-show` it tells me `Certificate pruning requires random serial numbers`. Is there any way to turn this on? I'm currently running ipa-server 4.12.2-1.el9_5.4. All I can find so far is that there is (currently?) no way to switch to the random serial numbers. Many thanks, Peter

2 2

Demo freeipa server authentication failure
by Joe Rafaniello 23 Apr '25

23 Apr '25

I'm getting "Login failed due to an unknown reason" using the credentials from the wiki: https://www.freeipa.org/page/Demo I'm trying to access: https://ipa.demo1.freeipa.org/ipa/ui/ It was working as of April 11th. Thanks!

3 2

ACI to allow a listing of cn=sysaccounts,cn=etc
by Rael S-R 23 Apr '25

23 Apr '25

# Context: ## Goal I eventually want to have a sysaccount with readonly access to a number of attributes in our FreeIPA deployment, which will be used by verification scripts in a scheduled pipeline that will prove certain accounts exist or do no exist. One of those checks is making sure that all the "sysaccounts" are expected (no extras), so I'll want a sysaccount that can list the other sysaccounts. ## Related posts and resources I've already seen some related posts, but I am still experiencing issues that I do not understand at this time: - "Allow sysaccount to view its own entry" : https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… - Probably the closest to my eventual goal, but I want a sysaccount that can get a list of other sysaccounts - FreeIPA Docs > LDAP > System Accounts : https://www.freeipa.org/page/HowTo/LDAP#system-accounts - I have created a number of accounts using the method listed here. These accounts are already in use and enable some of our internally deployed services to authenticate users via LDAP. - "Grant extra permissions to System Accounts" : https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… - mainly relevant because my underlying goal is to have a sysaccount that can read the attributes and sysaccount memberships cannot be managed through the web interface. - Documentation on ACIs: https://docs.redhat.com/en/documentation/red_hat_directory_server/12/html/m… - I only recently found out about ACIs and was previously only aware of the "Permissions/Privileges/Roles" aspect seen in the FreeIPA web UI. From testing, my understanding is that permissions are 1-to-1 with ACIs, though they get two entries: an LDAP entry under "cn=permissions,cn=pbac,..." and then a corresponding ACI attribute on the referenced LDAP entry. ## Technical - IPA version 4.12.2 - viewing of underlying LDAP is being done through a locally run instance of "phpLDAPadmin" - https://github.com/osixia/docker-phpLDAPadmin ## Personal I'm not an LDAP expert and have been trying to understand the various search and filter patterns from examples online, but it's quite likely I am messing up something in the syntax, or not correctly understanding the LDAP structure. Where possible I've tried to model my attempts on existing records or documentation (such as trying to match the created permission looks similar in LDAP to the `System: Read User Kerberos Login Attributes` permission) # Specific confusion I have been unable to get an ACI that allows a non-admin the ability to see the children of the "cn=sysaccounts,cn=etc,..." sub tree. My current test setup is: - My own admin user account (rael) - I am using this to read LDAP attributes and verify the data present, as well as edit permissions/privileges/roles in the web interface - A simple user account (rael_test) - Is a posix account - is a member of a fresh "FreeIPA State Verifier" role - "FreeIPA State Verifier" role has the privilege "testPriv", which has the permission "testPermission" (names adjusted to remove internal ticket information) - "testPermission" is configured to grant "read", "search" and "compare" rights - target subtree: `cn=sysaccounts,cn=etc,...` - extra target filter: `(objectclass=simplesecurityobject)` - I have also tried this with more permissive options, like `(objectclass=account)` or `(objectclass=*)` - effective attributes: `description`, `uid`, `dn` With this setup, the `rael_test` account is still unable to see any of the system accounts that have been created under "cn=sysaccounts,cn=etc,...". What is the reason for this? Why can't the `rael_test` account list the existing accounts that exist under the "cn=sysaccounts,cn=etc,..." tree? ## Details The relevant ACI on `cn=sysaccounts,cn=etc,dc=ghs,dc=nl`: ```ini aci: (targetattr = "description || dn || uid") (targetfilter = "(objectClass=simplesecurityobject)") (version 3.0;acl "permission:testPerm";allow (compare,read,search) groupdn = "ldap:///cn=testPerm,cn=permissions,cn=pbac,dc=ghs,dc=nl";) ``` Permission LDIFF: ```ini version: 1 # Entry 1: cn=testPerm,cn=permissions,cn=pbac,dc=ghs,d... dn: cn=testPerm,cn=permissions,cn=pbac,dc=ghs,dc=nl cn: testPerm ipapermbindruletype: permission ipapermincludedattr: uid ipapermincludedattr: description ipapermincludedattr: dn ipapermissiontype: SYSTEM ipapermissiontype: V2 ipapermlocation: cn=sysaccounts,cn=etc,dc=ghs,dc=nl ipapermright: read ipapermright: search ipapermright: compare ipapermtargetfilter: (objectclass=simplesecurityobject) member: cn=testPriv,cn=privileges,cn=pbac,dc=ghs,dc=nl objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2 ``` `rael_test` account permissions: ```ini version: 1 # Entry 1: uid=rael_test,cn=users,cn=accounts,dc=ghs,dc=nl dn: uid=rael_test,cn=users,cn=accounts,dc=ghs,dc=nl cn: rael user_level displayname: rael user_level gecos: rael user_level gidnumber: 62018 givenname: rael homedirectory: /home/rael_test loginshell: /bin/bash mail: rael_test(a)ghs.nl memberof: cn=ipausers,cn=groups,cn=accounts,dc=ghs,dc=nl memberof: cn=emea_users,cn=groups,cn=accounts,dc=ghs,dc=nl memberof: ipaUniqueID=da7a1b20-e360-11e8-8530-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=ddb2cb20-e360-11e8-9400-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=de9d0a8c-e360-11e8-9d46-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=e03af1b0-e360-11e8-b7e1-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=a1ac6390-ffb4-11e9-9e0a-1866da6daa3e,cn=hbac,... memberof: cn=workstation_users,cn=groups,cn=accounts,dc=ghs,dc=nl memberof: cn=FreeIPA State Verifier,cn=roles,cn=accounts,dc=ghs,dc=nl memberof: cn=testPriv,cn=privileges,cn=pbac,dc=ghs,dc=nl memberof: cn=testPerm,cn=permissions,cn=pbac,dc=ghs,dc=nl memberof: ipaUniqueID=a09b5cf0-b9db-11ee-8c88-509a4c9d3b10,cn=sudorules,cn=sudo,dc=ghs,dc=nl mepmanagedentry: cn=rael_test,cn=groups,cn=accounts,dc=ghs,dc=nl objectclass: top objectclass: person objectclass: organizationalperson objectclass: inetorgperson objectclass: inetuser objectclass: posixaccount objectclass: krbprincipalaux objectclass: krbticketpolicyaux objectclass: ipaobject objectclass: ipasshuser objectclass: ipaSshGroupOfPubKeys objectclass: mepOriginEntry objectclass: ipantuserattrs sn: user_level uid: rael_test uidnumber: 62018 ``` Please let me know if more information is needed.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2025