FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a ...

learn more… | top users | synonyms

0
votes
0answers
14 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
1
vote
0answers
13 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
0
votes
1answer
15 views

How does ipa-client know when IPA Fail Over occurs during Multi Master setup?

I have setup a multi-master IPA and it seems to be working fine. So it seems like for this kind of a setup, we don't need to mention the --server option and only the --domain option should work fine. ...
-1
votes
2answers
77 views

How to install freeipa server with apache ssl/tls virtualhosts already present

Is it possible to run an FreeIPA server next to a full configured apache server with ssl/tls configured virtual hosts and if yes what do I have to do to not get a conflicting 443 port error during ...
1
vote
2answers
26 views

How to confirm that IPA+SSSD is using only encrypted channels?

Simply put: I want to ensure that my authentication path is encrypted along the entire path. (e.g. encrypted from laptop->SSH host; from SSH host->authentication server; and from SSH host->other ...
3
votes
1answer
27 views

Restrict LDAP attribute read to self in FreeIPA/RedHat IdM

In our environment, employeeNumber is a sensitive field and we don't want it to be readable by all users. By default, IdM/IPA has a default permission System: Read User Addressbook Attributes which ...
0
votes
1answer
54 views

BIND DNS (with IPA) unable to Forward DNS Requests

I have been trying to install IPA on my CentOS system for several days, but I keep experiencing a problem with DNS forwarding, in that I am unable to get it working. I have tried this with two DNS ...
0
votes
0answers
24 views

FreeIPA: User not prompted to set new password upon password reset by admin

I have installed freeIPA in Centos 7. I login to t he web UI as admin, and create a new user as well as set a password. Documentation for freeIPA states that the user should then be prompted to ...
1
vote
2answers
63 views

Support users in openldap catalog with samba specific attributes

2016 is coming. We still use openldap. I have openldap server from ubuntu 12.04 with existing users. It provides the authentication layer in addition to containing the user, group, and machine ...
0
votes
1answer
30 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
0
votes
0answers
57 views

FreeIPA one domain starts showing “Internal Server Error”

When i want to check list of domains in one zone im getting "Internal Server Error". This is what i have in my http error log file: [Tue Nov 17 15:19:48.429112 2015] [:error] [pid 3930] (70007)The ...
0
votes
1answer
86 views

Joining realm failed: HTTP response code is 401, not 200

I am using an ipa-server for centralised user login in my enviornment. i have about 20 to 25 client machines to connect to this server. i was able to connect most of the client to the server using ...
0
votes
1answer
40 views

FreeIPA show all dns records

Just as the title says. I'm stuck at ipa dnsrecord-show mydomain.com I get prompted for a hostname Usage: ipa [global-options] dnsrecord-show DNSZONE NAME [options] I've tried wildcards but it is ...
0
votes
1answer
174 views

freeipa admin password reset

I'm trying to figure out how to reset my freeipa3 admin password. I'm able to see the user when I search the domain: [root@ipaserver ipa]# LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -h localhost -ZZ ...
-2
votes
1answer
77 views

How can I join a Windows Server 2008R2 server to a FreeIPA domain (LDAP/Kerberos)

In an infrastructure which consists of over 100 linux machines and only a single Windows Server (which will be replaced in two years with a linux server), it makes no sense to configure cross-forest ...
0
votes
1answer
24 views

FreeIPA - remove user password

I have created a user in FreeIPA. He has been assigned a password and SSH key. I want him to leave only SSH key. Is there a way, how to remove password??
2
votes
2answers
78 views

FreeIPA without web UI or change of ports

Can I install FreeIPA server without httpd (without web UI)?? Or at least can I change the ports?? (80->8880 and 443->8443)
0
votes
1answer
170 views

Install FreeIPA 4.1.0 on CentOS 6

I have installed FreeIPA master server in version 4.1.0 on the server with CentOS 7.1 and I need install replication server on the machine with Centos 6. Is there a way, how to install ipa-server ...
1
vote
0answers
37 views

MAC OSX and FreeIPA integration?

There seem to be just one Documentation in FreeIPA and that also says to use weak crypto ciphers and does not seem to support the --mkhomedir option since there is no IPA-Client for MAC OSX 10 Anyone ...
1
vote
2answers
432 views

Configure Gitlab to use FreeIPA as LDAP server

I'm running in ran into a bit of a trouble and I don't seem to be able to fix it. Please follow the scenario bellow: I have two servers: ONE (10.0.3.10): Ubuntu based, having Gitlab (as deb ...
0
votes
1answer
112 views

FreeIPA ssh auth not working remotle with .k5login file

I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem: root@gwhost:~# ssh user@freeipa01 user@freeipa01's ...
0
votes
0answers
92 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
0
votes
1answer
67 views

FreeIPA (LDAP): Refuse auth for users with expired password

I have a FreeIPA used mostly as an LDAP in many local web services. Unfortunatly LDAP authorizes users to login to 3-rd party applications even when user's password is expired (including first random ...
1
vote
1answer
125 views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
2
votes
0answers
43 views

Cannot create a user in IPA server for remote login

I had created a new IPA IdM server in Centos 7 using script install-ipa-server. The installation was successful. After installation, I was not able to create a user using IPA user-add user, it asks ...
0
votes
1answer
370 views

LDAP + KERBEROS + NFS. Why do I need idmapd?

What I am trying to do I have a freeIPA domain, with a few clients and a Synology NAS (also enrolled in freeIPA). I created a shared folder on the NAS, with NFSv4 + krb5 support. From the client, I ...
0
votes
0answers
25 views

FreeIPA multi domain single master

I have 3 separate environments that I am using FreeIPA for authenticaiton in. Originally we were going connect each environment up to our Active Directory domain for centralized authentication but ...
2
votes
2answers
288 views

How to automate directory creation on NFS-Server?

I created and configured a test-environment of 3 virtual machines: A FreeIPA server which provides krb5-authentication A NFS-Server using server 1 to secure itself A client that automounts home ...
1
vote
1answer
85 views

Setup freeIPA to handle Oracle Database name resolution

I am trying to setup freeIPA to handle Oracle Database name resolution. I have followed this tutorial for OpenLDAP http://www.idevelopment.info/data/Oracle/DBA_tips/LDAP/LDAP_8.shtml The schema ...
0
votes
1answer
36 views

ProcessMaker import groups from FreeIPA

I just connected ProcessMaker to FreeIPA using advanced LDAP authentication using this tutorial and I was able to import users list and login using FreeIPA accounts. My problem is that I can't ...
0
votes
1answer
134 views

RHEL 7/CENT0S 7 IPA/IDM transitive trusts

I have a situation I am having a hard time getting a clean answer on. I have a IDM/IPA domain setup and I have a trust setup with my Windows domain. That part is working perfectly. I have a one ...
1
vote
0answers
27 views

FreeIPA remove read and search permission

I want to disable the read and search permission that is granted to all user accounts by default. I don't want users to be able to display other users informations. is this possible? and is there ...
0
votes
0answers
57 views

assigning permissions to nested groups in FreeIPA

I have several user groups in FreeIPA (group1, group2, ..., group6) which are members of each other. (group1 is the master group) group1 -> group2 -> group3 -> group4 -> group5 -> ...
3
votes
0answers
62 views

Multiple passwordStorageScheme values on same user on 389ds / FreeIPA

I have deployed a FreeIPA identity solution which is backed inside by a 389 directory server. Due to the need of periodically syncing user passwords to another platform (Google Apps for Work), I need ...
2
votes
1answer
19 views

FreeIPA re-arrange custom attributes

I created several custom attributes and added them to LDAP and FreeIPA, but their order in the user page is very messy. I want to re-arrange them and put the related attributes together (such as ...
0
votes
0answers
50 views

Assigning attributes to groups, roles, and permissions in LDAP

I noticed that I can add object-classes to groups, roles and permissions then I can set a value to there attributes. in the example below I added an object-class 'customName' and it has an attribute ...
0
votes
1answer
31 views

LDAP share attribute's value between a group members

I want to add members to a group, then I want them to share a single attribute value that need to be changed once for it to be changed for all other members. I found a page about effective attributes. ...
0
votes
1answer
183 views

FreeIPA users can't see new custom attributes

I have added some new custom attributes to my FreeIPA and so far I was using the admin account to check them in the WebUI. But today I accessed the WebUI using a regular user account and I was ...
0
votes
2answers
49 views

Create a relationship between two attributes in LDAP

I created two attributes in LDAP (multivalued strings) and I want to (somehow) create a relationship between their values so that each value in one of then is linked to a value in the second: for ...
2
votes
1answer
135 views

Extending LDAP and FreeIPA

I'm working with FreeIPA and I've extended its attributes successfully, but noticed that the verification function in the Python plugin, added to FreeIPA, only works for the values entered through the ...
1
vote
1answer
100 views

How does a FreeIPA failed authentication session display browserconfig.html?

In FreeIPA, when browsing to the web UI, a failed authentication session should redirect to http://<servername>/browserconfig.html. Mine does not. Maybe I'm over complicating things, but the ...
1
vote
1answer
335 views

how to disable forwarder in freeipa servers named.conf

My IPA server's named.conf has this in it since I chose to enter a forwarder address during the ipa-server-install. forward first; forwarders { 132.206.44.21; ...
0
votes
0answers
310 views

FreeIPA Install on CentOS 7 - “Cannot contact any KDC”

I am trying to install a new stand alone instance of FreeIPA on CentOS 7. I am doing this in an Amazon AWS EC2 environment. The install completes flawlessly every time, however, when I attempt to ...
0
votes
1answer
76 views

Deployed IPA-server, created replica, then fed production data only to replica. How to fix?

At some point, I deployed ipa-server on a CentOS 6 machine. Being asked to better move it into a VM, I used ipa-replica-prepare / ipa-replica-install . This resulted as wanted, and I got a working ...
0
votes
2answers
397 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
0
votes
1answer
3k views

[root@pcm-ipa-01 tmp]# klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)freeipa kadmin admin principal not found

I have installed freeipa on centos and after restarting the service seems to have lost authentication for "kadmin" [root@pcm-ipa-01 ~]# kadmin init Authenticating as principal root/admin@MY.DOMAIN T ...
1
vote
2answers
334 views

Replica between FreeIPA 3.3 to FreeIPA 4

I am trying to move our data from FreeIPA 3.3 CentOS 6.5 to FreeIPA 4 on Fedora 21 I tried to create a replica on IPA 4.1.2 with IPA 3.3 but it didn't work Got this error Configuring certificate ...
3
votes
1answer
1k views

Integrating FreeIPA or RH IdM in an existing MS AD environment

I want to deploy FreeIPA or Red Hat IdM in my existing environment Currently my domain is managed by MS AD which is controlled by a separate group. Assume that changing anything in MS AD is going to ...
0
votes
2answers
387 views

FreeIPA 4.1.1 Fedora 21is not working

I am trying to install FreeIPA 4.1.1 on Fedora 21 yum install freeipa-* ipa-server-install Error during the installation: [10/27]: importing CA chain to RA certificate database [error] ...
6
votes
1answer
573 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...