FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a ...

learn more… | top users | synonyms

2
votes
2answers
61 views

How to automate directory creation on NFS-Server?

I created and configured a test-environment of 3 virtual machines: A FreeIPA server which provides krb5-authentication A NFS-Server using server 1 to secure itself A client that automounts home ...
0
votes
0answers
13 views

FreeIPA multi domain single master

I have 3 separate environments that I am using FreeIPA for authenticaiton in. Originally we were going connect each environment up to our Active Directory domain for centralized authentication but ...
1
vote
1answer
46 views

Setup freeIPA to handle Oracle Database name resolution

I am trying to setup freeIPA to handle Oracle Database name resolution. I have followed this tutorial for OpenLDAP http://www.idevelopment.info/data/Oracle/DBA_tips/LDAP/LDAP_8.shtml The schema ...
0
votes
1answer
17 views

ProcessMaker import groups from FreeIPA

I just connected ProcessMaker to FreeIPA using advanced LDAP authentication using this tutorial and I was able to import users list and login using FreeIPA accounts. My problem is that I can't ...
0
votes
1answer
37 views

RHEL 7/CENT0S 7 IPA/IDM transitive trusts

I have a situation I am having a hard time getting a clean answer on. I have a IDM/IPA domain setup and I have a trust setup with my Windows domain. That part is working perfectly. I have a one ...
10
votes
1answer
3k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
5
votes
3answers
957 views

backup and restoration of a freeipa infrastructure

I'm finding the documentation on ipa server backup and restoration sadly lacking, and being so centrally critical it's not something i'm really happy about shooting in the dark with - could some kind ...
2
votes
1answer
56 views

Extending LDAP and FreeIPA

I'm working with FreeIPA and I've extended its attributes successfully, but noticed that the verification function in the Python plugin, added to FreeIPA, only works for the values entered through the ...
1
vote
0answers
14 views

FreeIPA remove read and search permission

I want to disable the read and search permission that is granted to all user accounts by default. I don't want users to be able to display other users informations. is this possible? and is there ...
0
votes
2answers
175 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
0
votes
0answers
14 views

assigning permissions to nested groups in FreeIPA

I have several user groups in FreeIPA (group1, group2, ..., group6) which are members of each other. (group1 is the master group) group1 -> group2 -> group3 -> group4 -> group5 -> ...
2
votes
0answers
38 views

Multiple passwordStorageScheme values on same user on 389ds / FreeIPA

I have deployed a FreeIPA identity solution which is backed inside by a 389 directory server. Due to the need of periodically syncing user passwords to another platform (Google Apps for Work), I need ...
2
votes
1answer
13 views

FreeIPA re-arrange custom attributes

I created several custom attributes and added them to LDAP and FreeIPA, but their order in the user page is very messy. I want to re-arrange them and put the related attributes together (such as ...
0
votes
0answers
18 views

Assigning attributes to groups, roles, and permissions in LDAP

I noticed that I can add object-classes to groups, roles and permissions then I can set a value to there attributes. in the example below I added an object-class 'customName' and it has an attribute ...
0
votes
1answer
23 views

LDAP share attribute's value between a group members

I want to add members to a group, then I want them to share a single attribute value that need to be changed once for it to be changed for all other members. I found a page about effective attributes. ...
0
votes
2answers
29 views

Create a relationship between two attributes in LDAP

I created two attributes in LDAP (multivalued strings) and I want to (somehow) create a relationship between their values so that each value in one of then is linked to a value in the second: for ...
0
votes
1answer
53 views

FreeIPA users can't see new custom attributes

I have added some new custom attributes to my FreeIPA and so far I was using the admin account to check them in the WebUI. But today I accessed the WebUI using a regular user account and I was ...
1
vote
1answer
49 views

How does a FreeIPA failed authentication session display browserconfig.html?

In FreeIPA, when browsing to the web UI, a failed authentication session should redirect to http:///browserconfig.html. Mine does not. Maybe I'm overcomplicating things, but the default FreeIPA ...
1
vote
1answer
107 views

how to disable forwarder in freeipa servers named.conf

My IPA server's named.conf has this in it since I chose to enter a forwarder address during the ipa-server-install. forward first; forwarders { 132.206.44.21; ...
0
votes
1answer
1k views

[root@pcm-ipa-01 tmp]# klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)freeipa kadmin admin principal not found

I have installed freeipa on centos and after restarting the service seems to have lost authentication for "kadmin" [root@pcm-ipa-01 ~]# kadmin init Authenticating as principal root/admin@MY.DOMAIN T ...
5
votes
4answers
539 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source based on this question: Managing access to multiple linux system One problem I ran into is that if a ...
2
votes
2answers
2k views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
0
votes
1answer
123 views

FreeIPA krb5.conf has example.com entries

I have installed and reinstalled FreeIPA ipa-server-3.0.0-37.el6.x86_64 on a fully updated OEL 6.5 server a couple (3) times now and even if I destroy the existing /etc/krb5.conf file and reinstall ...
0
votes
0answers
200 views

FreeIPA Install on CentOS 7 - “Cannot contact any KDC”

I am trying to install a new stand alone instance of FreeIPA on CentOS 7. I am doing this in an Amazon AWS EC2 environment. The install completes flawlessly every time, however, when I attempt to ...
0
votes
1answer
48 views

Deployed IPA-server, created replica, then fed production data only to replica. How to fix?

At some point, I deployed ipa-server on a CentOS 6 machine. Being asked to better move it into a VM, I used ipa-replica-prepare / ipa-replica-install . This resulted as wanted, and I got a working ...
6
votes
1answer
390 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
0
votes
2answers
187 views

Replica between FreeIPA 3.3 to FreeIPA 4

I am trying to move our data from FreeIPA 3.3 on centos 6.5 to FreeIPA 4 on Fedora 21 1) I tried to create a replica on IPA 4.1.2 with IPA 3.3 but it didn't work Got this error Configuring ...
3
votes
1answer
589 views

Integrating FreeIPA or RH IdM in an existing MS AD environment

I want to deploy FreeIPA or Red Hat IdM in my existing environment Currently my domain is managed by MS AD which is controlled by a separate group. Assume that changing anything in MS AD is going to ...
3
votes
2answers
2k views

Google authenticator with Openldap or Fedora 389 Server or FreeIPA

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
0
votes
2answers
305 views

FreeIPA 4.1.1 Fedora 21is not working

I am trying to install FreeIPA 4.1.1 on Fedora 21 yum install freeipa-* ipa-server-install Error during the installation: [10/27]: importing CA chain to RA certificate database [error] ...
0
votes
1answer
739 views

MacOS X 10.9 Mavericks Kerberos login w/ FreeIPA

Has anyone successfully set up authentication and authorization between MacOS X and FreeIPA? An old revision of the FreeIPA documentation explains how to get it working in 10.4 and nothing in their ...
0
votes
0answers
64 views

freeipa 4.1.0 on fedora20 not working

Has anyone successfully setup freeipa 4.0.3 on Fedora20 as a server and another fedora20 with freeipa 4.1.0 for the client side? because I can't figure out why im always having the error " user does ...
0
votes
2answers
488 views

How to disable Null and Weak Ciphers on 389-Directory-Server

I am running 389-DS on CentOS. Version - '389-ds-base.i686 1.2.11.15-34.el6_5'. Security scans revealed that NullCiphers were found on Port 389 and 636. I tried to disable them by shutting down DS, ...
-1
votes
2answers
186 views

Windows domain + Linux Domain on One Network

Currently our network is all tied to Active Directory with both Windows and Linux workstations/servers. We would like to implement a Free IPA server that synchronizes authentication between a Linux ...
0
votes
1answer
293 views

FreeIPA/389 DS userPassword

I am connecting to FreeIPA LDAP (386 Directory Server) as admin. I can find a user, and add the userPassword attribute like #!RESULT OK #!CONNECTION ldap://freeipa1.localdomain:389 #!DATE ...
-2
votes
3answers
296 views

has no MX record

I have two servers running CentOS release 6.5 (Final). In one of them is installed FreeIPA: Name: freeipa.fi.example.com IP: 192.168.99.50 And the other Zimbra as mail server: Name: ...
0
votes
1answer
317 views

Configuring Redhat / CentOS 5 SSH to authenticate to IPA server with public keys

I'm trying to configure some Red Hat/CentOS servers to use an ipa-server on CentOS 6 for SSH authentication with public keys. I'm storing the public keys on the IPA server, which works great on ...
1
vote
2answers
617 views

Managing Linux user accounts + Samba + more

I have a network of about 3-6 CentOS servers, with about 5-10 users (currently, and near future). I'm looking for a solution for centralized managements of users. My requirements from it are: Linux ...
2
votes
1answer
1k views

Can't change password of FreeIPA admin - “Current password's minimum life has not expired”

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com ...
3
votes
2answers
364 views

VCenter 5.5 Appliance and FreeIPA 3 authentication

I have a vcenter appliance and freeipa running in my environment. There are no windows machines at all, nor will there be. I have setup vca to authenticate via LDAP to IPA and this works PER USER. the ...
8
votes
2answers
905 views

VMWare vCenter/ESXi with FreeIPA instead of Active Directory?

Can vCenter authenticate against FreeIPA instead of Active Directory? If so, how would you set it up? We have a pure Linux environment (CentOS) and need to have vCenter and our VM's have the same ...
2
votes
1answer
224 views

How can I force a mac mobile account user to be logged out or locked out when their LDAP account is disabled?

I have a FREEIPA LDAP server and a Mavericks Client. I have bound my Mac to my ldap and created a mobile account. What I want is when someone is disabled it logs out the user or locks the screen.
1
vote
1answer
387 views

FreeIPA client's sssd not using LDAPS

No matter what I try I am unable to get sssd to connect to my ldap/FreeIPA server via LDAPS/636. Checking debug shows that sssd is showing that it should be using 636... however packet captures and ...
1
vote
1answer
3k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
2
votes
0answers
1k views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
0
votes
2answers
394 views

Accidentally disabled the administrator account on IPA server

I'm running ipa-server on Centos 6. I was going through the users disabling accounts and accidentally disabled the "administrator" account. Now I have no access to do anything. Is there any way to ...
0
votes
1answer
417 views

ipa root certificate signing

I am trying to get my ipa certificate signed by openca and its getting rejected due to hostname. The following hostnames were rejected because the system couldn't link them to your account, if they ...
5
votes
1answer
5k views

Using FreeIPA for centralized sudo - using SSSD for sudoers

I have setup FreeIPA for centralized sudo and all is working well with the exception of being able to use SSSD for sudoers. If I have in my client /etc/nsswitch.conf the following: sudoers: files ...
5
votes
1answer
1k views

Using FreeIPA for centralized sudo - how to specify ALL commands?

I'm having a hard time wrapping my head around FreeIPA's model. The FreeIPA manual states: FreeIPA adds an extra control measure with sudo command groups, which allow a group of commands to be ...
0
votes
0answers
59 views

FreeIPA issue: after ipa1 server kernel panic, not switching to ipa2 failover server

Our setup is as follows. All machines are running under Centos 5.8. We have a gateway machine with a firewall, gw.example.com, through which all external traffic is funneled. Behind it we have 2 ...