FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a ...

learn more… | top users | synonyms

0
votes
1answer
38 views

FreeIPA in LXD/LXC containers - cannot switch user

The Setup consists of one FreeIPA-Server and one Client, which both reside in unprivileged LXD-Containers on the same Host. Both containers and the host machine run Ubuntu 16.04. All Settings are ...
1
vote
0answers
11 views

How to Configure freeIPA to host external DNS Zone

Is it possible to use freeIPA DNS servers to host an external DNS zone that will resolve records for external clients without exposing the internal zones and records? I need to host SPF and DKIM ...
1
vote
0answers
53 views

Is it possible to use Active directory without a trust relationship for FreeIPA passwords?

I am looking to integrate FreeIPA with an Active Directory environment that I do not have full control over and most likely will not be able to get a trust relationship setup with my FreeIPA install. ...
0
votes
2answers
58 views

Build a production IPA server without integrate DNS and NTP with client

We are going to deploy a centralized authentication Linux server (RHEL6) for our RedHat/CentOS servers in Data Center environment. I made some search I believe Free IPA is the best choice since it's ...
1
vote
2answers
47 views

Centos package naming for FreeIPA?

Where can I find information about CentOS package management? I installed Spacewalk recently and noticed that FreeIPA was listed as ready for an update. The versions are differently named, and the ...
0
votes
0answers
20 views

How to integrate Freeipa authentication with Cacti?

I have been trying to integrate FreeIPA authentication with Cacti but unable to till now. Can someone please help me out in configuring one?? I followed this guide @ ...
0
votes
0answers
25 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
1
vote
0answers
35 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
0
votes
1answer
38 views

How does ipa-client know when IPA Fail Over occurs during Multi Master setup?

I have setup a multi-master IPA and it seems to be working fine. So it seems like for this kind of a setup, we don't need to mention the --server option and only the --domain option should work fine. ...
-1
votes
2answers
258 views

How to install freeipa server with apache ssl/tls virtualhosts already present

Is it possible to run an FreeIPA server next to a full configured apache server with ssl/tls configured virtual hosts and if yes what do I have to do to not get a conflicting 443 port error during ...
1
vote
2answers
34 views

How to confirm that IPA+SSSD is using only encrypted channels?

Simply put: I want to ensure that my authentication path is encrypted along the entire path. (e.g. encrypted from laptop->SSH host; from SSH host->authentication server; and from SSH host->other ...
3
votes
1answer
42 views

Restrict LDAP attribute read to self in FreeIPA/RedHat IdM

In our environment, employeeNumber is a sensitive field and we don't want it to be readable by all users. By default, IdM/IPA has a default permission System: Read User Addressbook Attributes which ...
0
votes
1answer
139 views

BIND DNS (with IPA) unable to Forward DNS Requests

I have been trying to install IPA on my CentOS system for several days, but I keep experiencing a problem with DNS forwarding, in that I am unable to get it working. I have tried this with two DNS ...
0
votes
0answers
33 views

FreeIPA: User not prompted to set new password upon password reset by admin

I have installed freeIPA in Centos 7. I login to t he web UI as admin, and create a new user as well as set a password. Documentation for freeIPA states that the user should then be prompted to ...
1
vote
2answers
95 views

Support users in openldap catalog with samba specific attributes

2016 is coming. We still use openldap. I have openldap server from ubuntu 12.04 with existing users. It provides the authentication layer in addition to containing the user, group, and machine ...
0
votes
1answer
40 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
0
votes
0answers
64 views

FreeIPA one domain starts showing “Internal Server Error”

When i want to check list of domains in one zone im getting "Internal Server Error". This is what i have in my http error log file: [Tue Nov 17 15:19:48.429112 2015] [:error] [pid 3930] (70007)The ...
0
votes
2answers
171 views

Joining realm failed: HTTP response code is 401, not 200

I am using an ipa-server for centralised user login in my enviornment. i have about 20 to 25 client machines to connect to this server. i was able to connect most of the client to the server using ...
0
votes
1answer
101 views

FreeIPA show all dns records

Just as the title says. I'm stuck at ipa dnsrecord-show mydomain.com I get prompted for a hostname Usage: ipa [global-options] dnsrecord-show DNSZONE NAME [options] I've tried wildcards but it is ...
0
votes
1answer
425 views

freeipa admin password reset

I'm trying to figure out how to reset my freeipa3 admin password. I'm able to see the user when I search the domain: [root@ipaserver ipa]# LDAPTLS_CACERT=/etc/ipa/ca.crt ldapsearch -h localhost -ZZ ...
-2
votes
1answer
123 views

How can I join a Windows Server 2008R2 server to a FreeIPA domain (LDAP/Kerberos)

In an infrastructure which consists of over 100 linux machines and only a single Windows Server (which will be replaced in two years with a linux server), it makes no sense to configure cross-forest ...
0
votes
1answer
43 views

FreeIPA - remove user password

I have created a user in FreeIPA. He has been assigned a password and SSH key. I want him to leave only SSH key. Is there a way, how to remove password??
2
votes
2answers
125 views

FreeIPA without web UI or change of ports

Can I install FreeIPA server without httpd (without web UI)?? Or at least can I change the ports?? (80->8880 and 443->8443)
0
votes
1answer
268 views

Install FreeIPA 4.1.0 on CentOS 6

I have installed FreeIPA master server in version 4.1.0 on the server with CentOS 7.1 and I need install replication server on the machine with Centos 6. Is there a way, how to install ipa-server ...
1
vote
0answers
46 views

MAC OSX and FreeIPA integration?

There seem to be just one Documentation in FreeIPA and that also says to use weak crypto ciphers and does not seem to support the --mkhomedir option since there is no IPA-Client for MAC OSX 10 Anyone ...
1
vote
2answers
824 views

Configure Gitlab to use FreeIPA as LDAP server

I'm running in ran into a bit of a trouble and I don't seem to be able to fix it. Please follow the scenario bellow: I have two servers: ONE (10.0.3.10): Ubuntu based, having Gitlab (as deb ...
0
votes
1answer
166 views

FreeIPA ssh auth not working remotle with .k5login file

I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem: root@gwhost:~# ssh user@freeipa01 user@freeipa01's ...
0
votes
0answers
149 views

IPA Server installation: Error with port number

When I am trying to install IPA server, I am getting the following error : IPA requires port 8443 for PKI but it is currently in use. Aborting installation I checked with netstat -tuplen | grep ...
0
votes
1answer
105 views

FreeIPA (LDAP): Refuse auth for users with expired password

I have a FreeIPA used mostly as an LDAP in many local web services. Unfortunatly LDAP authorizes users to login to 3-rd party applications even when user's password is expired (including first random ...
1
vote
1answer
370 views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
2
votes
0answers
51 views

Cannot create a user in IPA server for remote login

I had created a new IPA IdM server in Centos 7 using script install-ipa-server. The installation was successful. After installation, I was not able to create a user using IPA user-add user, it asks ...
0
votes
1answer
629 views

LDAP + KERBEROS + NFS. Why do I need idmapd?

What I am trying to do I have a freeIPA domain, with a few clients and a Synology NAS (also enrolled in freeIPA). I created a shared folder on the NAS, with NFSv4 + krb5 support. From the client, I ...
0
votes
0answers
33 views

FreeIPA multi domain single master

I have 3 separate environments that I am using FreeIPA for authenticaiton in. Originally we were going connect each environment up to our Active Directory domain for centralized authentication but ...
2
votes
2answers
419 views

How to automate directory creation on NFS-Server?

I created and configured a test-environment of 3 virtual machines: A FreeIPA server which provides krb5-authentication A NFS-Server using server 1 to secure itself A client that automounts home ...
1
vote
1answer
94 views

Setup freeIPA to handle Oracle Database name resolution

I am trying to setup freeIPA to handle Oracle Database name resolution. I have followed this tutorial for OpenLDAP http://www.idevelopment.info/data/Oracle/DBA_tips/LDAP/LDAP_8.shtml The schema ...
0
votes
1answer
44 views

ProcessMaker import groups from FreeIPA

I just connected ProcessMaker to FreeIPA using advanced LDAP authentication using this tutorial and I was able to import users list and login using FreeIPA accounts. My problem is that I can't ...
0
votes
1answer
177 views

RHEL 7/CENT0S 7 IPA/IDM transitive trusts

I have a situation I am having a hard time getting a clean answer on. I have a IDM/IPA domain setup and I have a trust setup with my Windows domain. That part is working perfectly. I have a one ...
1
vote
0answers
28 views

FreeIPA remove read and search permission

I want to disable the read and search permission that is granted to all user accounts by default. I don't want users to be able to display other users informations. is this possible? and is there ...
0
votes
0answers
75 views

assigning permissions to nested groups in FreeIPA

I have several user groups in FreeIPA (group1, group2, ..., group6) which are members of each other. (group1 is the master group) group1 -> group2 -> group3 -> group4 -> group5 -> ...
3
votes
0answers
78 views

Multiple passwordStorageScheme values on same user on 389ds / FreeIPA

I have deployed a FreeIPA identity solution which is backed inside by a 389 directory server. Due to the need of periodically syncing user passwords to another platform (Google Apps for Work), I need ...
2
votes
1answer
19 views

FreeIPA re-arrange custom attributes

I created several custom attributes and added them to LDAP and FreeIPA, but their order in the user page is very messy. I want to re-arrange them and put the related attributes together (such as ...
0
votes
0answers
57 views

Assigning attributes to groups, roles, and permissions in LDAP

I noticed that I can add object-classes to groups, roles and permissions then I can set a value to there attributes. in the example below I added an object-class 'customName' and it has an attribute ...
0
votes
1answer
34 views

LDAP share attribute's value between a group members

I want to add members to a group, then I want them to share a single attribute value that need to be changed once for it to be changed for all other members. I found a page about effective attributes. ...
0
votes
1answer
244 views

FreeIPA users can't see new custom attributes

I have added some new custom attributes to my FreeIPA and so far I was using the admin account to check them in the WebUI. But today I accessed the WebUI using a regular user account and I was ...
0
votes
2answers
57 views

Create a relationship between two attributes in LDAP

I created two attributes in LDAP (multivalued strings) and I want to (somehow) create a relationship between their values so that each value in one of then is linked to a value in the second: for ...
2
votes
1answer
154 views

Extending LDAP and FreeIPA

I'm working with FreeIPA and I've extended its attributes successfully, but noticed that the verification function in the Python plugin, added to FreeIPA, only works for the values entered through the ...
1
vote
1answer
135 views

How does a FreeIPA failed authentication session display browserconfig.html?

In FreeIPA, when browsing to the web UI, a failed authentication session should redirect to http://<servername>/browserconfig.html. Mine does not. Maybe I'm over complicating things, but the ...
1
vote
1answer
468 views

how to disable forwarder in freeipa servers named.conf

My IPA server's named.conf has this in it since I chose to enter a forwarder address during the ipa-server-install. forward first; forwarders { 132.206.44.21; ...
0
votes
1answer
88 views

Deployed IPA-server, created replica, then fed production data only to replica. How to fix?

At some point, I deployed ipa-server on a CentOS 6 machine. Being asked to better move it into a VM, I used ipa-replica-prepare / ipa-replica-install . This resulted as wanted, and I got a working ...
0
votes
2answers
537 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...