Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

FreeIPA and Kerberos [Cannot contact any KDC for realm while getting initial credentials]

I hope this is the correct forum to ask. We run a cluster (Centos 7) using FreeIPA for account management. On Sunday the IPA server suddenly restarted and since then, users are no longer able to login ...
user avatar
0 votes
0 answers
26 views

pam-auth-update update of /etc/pam.d/common-auth doesn't work

I'm trying to match a FreeIPA user to a local group via FreeIPA group membership. When testing the manual edit of common-auth it works. But I'm trying to generate the file with pam-auth-update so that ...
user avatar
1 vote
1 answer
34 views

FreeIPA migrate the current NFSv4 storing home directories to another server

I have a FreeIPA set-up that uses NFSv4 to store users' home directories. NFS is running on the same physical server as the FreeIPA. CentOS btw. I'd like to move the NFS server on a new machine and ...
user avatar
  • 11
1 vote
1 answer
78 views

Cross realm constrained delegation

I have Red Hat IdM on RHEL8 with a two-way trust to AD on Windows 2019. What currently works: Constrained delegation for NFS clients. NFS clients can impersonate users from the IdM realm (gssproxy). ...
user avatar
0 votes
1 answer
38 views

Setting cgroup limits to all users in network

I have a FreeIPA user authentication set up. There are many users in the system already, along with many host systems (configured IPA clients). I want to set up cgroup restrictions on the tasks these ...
user avatar
0 votes
0 answers
168 views

Could not find imported module support code for freeipa.ansible_freeipa.ipaclient_test

My ansible controller is running on a Rocky 8.5 machine with the ansible-freeipa version 0.3.8-1.el8 rpm package installed. ansible 2.9.27 config file = /etc/ansible/ansible.cfg configured module ...
user avatar
0 votes
0 answers
53 views

FreeIPA user_add fails to add user "user already exists" when it doesn't

I am getting an error when trying to create users in FreeIPA. Can someone help me figure out the problem? ipa: ERROR: user with name "ttest" already exists ipa user_show ttest ipa: ERROR: ...
user avatar
0 votes
1 answer
310 views

Freeipa web interface behind HAProxy

I am trying to configure the FreeIPA web interface to work behind my HAProxy instance. I found an old GitHub Gist for the configuration (https://gist.github.com/m4ce/d081ab39654c3e13bbe8b150986526a3) ...
user avatar
0 votes
1 answer
161 views

Kerberos credentials not renewed on ipa ubuntu client

When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the ...
user avatar
  • 153
3 votes
0 answers
190 views

Extremely slow NFS openat performance

I've installed an NFS server on Ubuntu 20.04 and a FreeIPA Ubuntu 20.04 client with the users home directories served by the NFS server. Performance is extremely slow when accessing files. When I ...
user avatar
  • 153
0 votes
1 answer
50 views

How to get Gravitee to do recursive group lookups

I have set up Gravitee APIM 3x (gateway, rest-api, console and portal). This work fine. When trying to replace the memory authentication with LDAP (FreeIPA) authentication, I am able to get the ...
user avatar
  • 101
0 votes
2 answers
36 views

Putting .k5login credentials in ldap with freeipa

On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data. By using a .k5login file in home directories, it is ...
user avatar
  • 140
0 votes
0 answers
109 views

How to issue SSL certificate with Nginx docker container using FreeIPA?

Instead of using a self-signed SSL certificate (untrusted) I want to issue certificate from a trusted source in this case from a FreeIPA instance (I'm new to FreeIPA). How can this be done? Is ...
user avatar
  • 1
1 vote
0 answers
178 views

NFS stale file handle for regular user but not root

I've installed freeipa container on a Ubuntu server and an NFS server on the server itself. When I mount the NFS directory on a client machine or even the server itself, I can view the mounted ...
user avatar
  • 153
1 vote
0 answers
147 views

Indirect Group Membership with Keycloak and oauth2-proxy

I'm using oauth2-proxy/oauth2-proxy with Keycloak-oidc provider for authentication for some pods in my Kubernetes cluster. I can specify which groups are allowed to access a resource using the --...
user avatar
  • 623
0 votes
1 answer
191 views

FreeIPA not resolving itself

I plan on using FreeIPA as my authoritative DNS server for my network. All other records resolve just fine, however, FreeIPA is not resolving itself. Running dig ipa-hermes.lan.example.com yields no ...
user avatar
  • 623
0 votes
0 answers
170 views

How are external url's resolved by FreeIPA?

We are running FreeIPA version 4.6.8 on Centos 7.9.2009 and have multiple dns zones defined for local resources running inside our private network. For this to work we enter our ipa server's IP ...
user avatar
  • 75
0 votes
0 answers
181 views

Login loop for FreeIPA users

I am running into an issue with one of my newly configured freeipa clients where all of the ipa users that try to log into the computer go through a login loop. New users, and users with their ...
user avatar
  • 1
0 votes
1 answer
336 views

FreeIPA: External DNS requests (google etc.) fail for clients on new subnet

I'm trying to rebuild my home network to make use of FreeIPA to manage some Linux clients. This has all gone well on my main network (192.168.222.0/24) with all clients being able to resolve both ...
user avatar
1 vote
0 answers
80 views

Temporarily disable minimum password time in FreeIPA after password reset by support

We use FreeIPA 4.6.8 and we have users that of course forget their passwords. However, password policy has a minimum password time of 1 hour. When support resets their password for them and provides ...
user avatar
  • 123
0 votes
0 answers
314 views

VMware Vcenter with FreeIPA - permissions for group

I have a problem with permissions for groups in vmware. My configuration in Vmware: Identity source type: OpenLDAP Name: FreeIpa Base distinguished name for users: cn=users,cn=accounts,dc=freeipa,dc=...
user avatar
  • 19
1 vote
0 answers
85 views

freeipa Cannot obtain CA certificate error via ansible

I am trying to install my freeipa replica server via ansible role and I have this error: File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 1858, in get_ca_certs ...
user avatar
0 votes
1 answer
24 views

Deleted Group in FreeIPA Still Comes Up

I'm having an issue deleting a group in FreeIPA. A group was previously created called "developer" for which I want to delete. I go into "User Groups" in FreeIPA GUI and delete the ...
user avatar
  • 125
1 vote
0 answers
302 views

How should we automount home directories stored at different NFS paths at /home/$USER?

We're currently transitioning to storing all of our organization's user information in Red Hat IDM (FreeIPA). We have several thousand users, and mount user home directories over NFS from a NetApp ...
user avatar
1 vote
0 answers
520 views

Linking authentication FreeIPA and SSO

Long story short, my goal is to have all user permissions managed in one place and then deployed everywhere. My thoughts are that Active Directory/FreeIPA is perfect for this sort of thing. It also ...
user avatar
0 votes
1 answer
149 views

FreeIPA - ssh as root prompted for password

I know the access via root won't work (client sshd_config and restricted account in FreeIPA). But is there a way to blacklist root either on the host or on FreeIPA so it's denied immediately rather ...
user avatar
0 votes
1 answer
144 views

is it possible to set default home-directory based on the users gidnumber?

I'm aware that I can change the general settings by running: ipa config-mod --homedirectory=/some/path what I would like to achieve is for IPA to change it to a different path based on the GID/...
user avatar
1 vote
0 answers
182 views

FreeRADIUS cannot bind to FreeIPA

I have installed FreeRADIUS and FreeIPA on the same machine running Fedora 33. IPA is working as expected and can have clients join and authenticate. LDAP command line tools (ldapsearch, ldapmodify) ...
user avatar
  • 11
3 votes
0 answers
309 views

How do I add an entryUUID field to the FreeIPA compat schema?

I am trying to add an entryUUID field to groups in the FreeIPA compat schema, but I am struggling to create the required attributeType. My LDIF for creating it is: dn: cn=schema changetype: modify add:...
user avatar
0 votes
1 answer
354 views

Implementing LDAP with Public IP

I'd like to implement an LDAP using FreeIPA for centralized authentication and for security sake (Kerberos). The problem is my servers (Ubuntu) running as public cloud with no private interface ...
user avatar
  • 1
0 votes
1 answer
182 views

Restrict web access on apache web server to FreeIPA users

We have an apache web server installed on a Centos 8 machine which is been used to easily expose user and group folders both internally and to other collaborators. Most of the data exposed is plain ...
user avatar
  • 23
1 vote
0 answers
338 views

Unable to add users from Keycloack on FreeIPA via LDAP although Keycloack host has permissions set in FreeIPA

I have the following setup: FreeIPA 4.8.7 via docker (freeipa/freeipa-server:centos-8) Keycloack 12.0.1 The FreeIPA users are in cn=users,cn=accounts,dc=freeipa,dc=example,dc=com Keycloack DN: ...
user avatar
0 votes
1 answer
1k views

ubuntu ignores default_ccache_name

I'm having trouble with Kerberos and Ubuntu 20.04. Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue. The big goal is to have a SSO System, for ...
user avatar
  • 103
2 votes
0 answers
693 views

FreeIPA - Login failed due to an unknown reason - SSL certificate: unable to get local issuer certificate

I believe my FreeIPA instance has a certificate issue, which manifests in the "Login failed due to an unknown reason" error on the web ui. This seems to be really close to the issue ...
user avatar
  • 21
0 votes
1 answer
1k views

ipa-server installation failed

facing a problem when install ipa-server . the problem is : Configured /etc/sssd/sssd.conf trying https://ipa.cse.local/ipa/json [try 1]: Forwarding 'schema' to json server 'https://ipa.cse.local/ipa/...
user avatar
3 votes
1 answer
667 views

NFS/krb5 authentication server lookup fails due to wrong principal name

When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server. LOOKING_UP_SERVER: ... host/nfsclient.internal.domain.tld@IPA.DOMAIN.TLD ...
user avatar
  • 31
1 vote
0 answers
346 views

FreeIPA unable to create a replica

I'm trying to create a replica of my single FreeIPA server to aid in migration and move to a clustered environment. I spun up a CentOS host, enrolled it as a client to the ipa server, and added it to ...
user avatar
  • 623
0 votes
1 answer
601 views

How to find IPA user creation date?

Command ipa user-show $user -all doesn't show what I have described in title. Do you have any ideas?
user avatar
  • 1
0 votes
0 answers
166 views

Signing CSR from user by sub CA using FreeIPA

There is a CSR from user with O=test_org, CN=test. It is necessary to sign it with CA test in FreeIPA. I do it by following command: ipa cert-request test-client.csr --ca=ca-name --certificate-out=...
user avatar
0 votes
0 answers
35 views

Centos OS7 not receiving user context from FreeIPA

Hopefully there is something simple I am missing here. I have FreeIPA 4.6.6 (can not update at this time), Centos 7 and Centos 6 systems. SELinux is in permissive mode. Logins on the Centos 6 system ...
user avatar
0 votes
1 answer
1k views

Unable to log in to FreeIPA web ui - “Login failed due to an unknown reason.”

I have few months old freeipa installation. However, lately when I came back to continue my administration with IPA server I cannot login to it. DNS is working in my private network without problem ...
user avatar
1 vote
0 answers
894 views

FreeIPA Server Install with external CA

I am tasked with building a FreeIPA server to help us manage TLS certificates to support Nginx, Postgres and RabbitMQ. I have never worked with certs from an admin perspective so I may be making some ...
user avatar
  • 111
0 votes
1 answer
113 views

How do I add dot-slash (./) as a sudo command rule in FreeIPA?

I can't run scripts using dot-slash, because I don't know how to add it as a sudo command rule in FreeIPA. Users are not allowed to it. ./myscript.sh How can add ./ as rule in FreeIPA like any other ...
user avatar
  • 115
0 votes
1 answer
970 views

FreeIPA Forward Zones not working

I have a few replica of FreeIPA 4.6.4 running. I'm trying to forward request for another DNS domain to their DNS server. dig/nslookup to the forwarder works, but queries to FreeIPA returns NXDOMAIN ...
user avatar
  • 99
0 votes
1 answer
277 views

FreeIpa. How to setup specific shell only on 1 host for group of users

I'd like to set specific shell for group of users only in 1 host. In my environment already installed FreeIpa. In FreeIpa I can change shell for all my hosts, it is not my requirement.
user avatar
3 votes
0 answers
981 views

DNSSEC for private internal sub zones of an external domain

Consider the following scenario: example.com is hosted on CloudFlare and it's signed by CloudFlare DNSSEC. Everything works as expected for example.com. Inside the company we have some internal ...
user avatar
0 votes
1 answer
150 views

FreeIPA host with dynamic IP

I'm trying to logon to Windows with FreeIPA User. Everything went fine when i created IPA host with specific ---ip-address but what if my host(windows machine) do not have static IP? i know after ...
user avatar
  • 49
0 votes
1 answer
446 views

What are the drawbacks/issues when having REALM and DOMAIN with different names in FreeIPA?

I have been trying to configure a FreeIPA server for learning purposes and to have centralised access to all my self-hosted services for me and my family/friends. I started with this tutorial where ...
user avatar
0 votes
2 answers
2k views

FreeIPA Intermediate CA Certificate Expired

We have 2 FreeIPA servers running in our network, today we found this: https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 One of the intermediate ...
user avatar
0 votes
1 answer
159 views

FreeIPA on RPi3 Kerberos5 timeout

I pulled a magic trick from a hat. I put Kerberos 5 using FreeIPA on a Raspberry Pi 3 B. It's an inexpensive box that does one thing only, issuing tickets. I modified the 60 second timeout to 2000 ...
user avatar

1
2 3 4 5