Ronald Wimmer via FreeIPA-users wrote: > On 13.02.24 21:04, Ronald Wimmer via FreeIPA-users wrote: >> On 13.02.24 18:54, Christian Heimes via FreeIPA-users wrote: >>> On 13/02/2024 18.03, Ronald Wimmer via FreeIPA-users wrote: >>>> On 13.02.24 17:47, Rob Crittenden wrote: >>>>> >>>>> I don't think it's possible to speculate without knowing your process. >>>>> >>>>> This requires the cleartext password so assuming you create the staged >>>>> user then immediately active them, that would be the time to do the >>>>> bind. Otherwise you have to store cleartext passwords and that is a >>>>> recipe for disaster. >>>> >>>> User is created by an external tool. User activation in IPA is done >>>> by a script on one of the IPA servers periodically. Sadly, the >>>> external tool cannot do an initial LDAP bind in order to create a >>>> users's krb LDAP attributes. I am looking for a simple way these >>>> properties are created. >>>> >>>> Sure I could say a user has to SSH somewhere but why can't that >>>> happen if a user tries to login to IPA's WebGUI and the krb >>>> properties are missing? Or is there another option for users to >>>> accomplish this? >>> >>> Because the IPA WebUI uses the Kerberos extension S4U2Proxy under the >>> hood. It allows the WebUI to talk to the LDAP server on behalf of the >>> user. This feature require a proper Kerberos credentials. See >>> https://www.freeipa.org/page/V4/Service_Constraint_Delegation >>> >>> I already mentioned the recommended option to archive this a while >>> ago. You may have missed the piece of information in this very long >>> thread. IPA servers have a special /ipa/migration route (e.g. >>> https://ipa.demo1.freeipa.org/ipa/migration/) for password migration. >>> Under the hood the endpoint just does an LDAP bind with username and >>> password. You can ask your users to either log into a machine with >>> ssh or go to the migration page. >> >> I did indeed miss that vital information. It is more than sufficient >> for our needs. >> >> Thanks a lot guys. All scenarios that need to be working in our >> environment do actually work now. > > Did something change on the IPA side? Newly created users cannot login > to the WebGUI anymore. They get a "Your session has expired" error. > Might have to do with this thread: > https://lists.fedorahosted.org/archives/list/[email protected]/thread/YFPMHCWA7R47ZSI75EZKCMSWLH5QYH4P/?sort=date
You don't provide enough information to tell. Did you upgrade versions? Per the link, do your users have SIDs? rob -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
