Hi Chris, This sounds great!
What are you using now, both CentOS ? So Samba and FreeIPA ? Maybe it's good to explain which way you used now in steps too, so we can combine or create multiple howto's ? At least we are going somewhere! Thanks, Matt 2015-08-09 14:54 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>: > Hi Matt > > My test integration of FreeIPA 4.x and Samba 4.x with the "good old Samba > Schema extensions) is up and working, almost flawlessly. > > I can add users and groups via the FreeIPA CLI, and they get the correct > ObjectClasses / attributes required for Samba. > > So far I have not yet bothered to try the extensions to the WebUI, because > it is currently giving me the classic "Your session has expired. Please > re-login." error which renders the WebUI useless. > > The only problem I have so far encountered managing Samba / FreeIPA users > via FreeIPA CLI commands is with the handling of the attribute > sambaPwdLastSet. This is the subject of an existing thread, also updated > today. > > There is also an existing alternative to hacking group.py, using "Class of > Service" (Cos) documented in this thread from February 2015 > https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html. > I have not yet tried it, but it sounds reasonable. > > Chris > > > > > > From: "Matt ." <yamakasi....@gmail.com> > To: Christopher Lamb/Switzerland/IBM@IBMCH > Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com>, Youenn > PIOLET <piole...@gmail.com> > Date: 06.08.2015 16:19 > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA > > > > Hi Chris, > > OK, than we might create two different versions of the wiki, I think > this is nice. > > I'm still figuring out why I get that: > > IPA Error 4205: ObjectclassViolation > > missing attribute "sambaGroupType" required by object class > "sambaGroupMapping" > > Matt > > 2015-08-06 16:09 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>: >> Hi Matt >> >> As far as I can make out, there are at least 2 viable Samba / FreeIPA >> integration paths. >> >> The route I took is suited where there is no Active Directory involved: > In >> my case all the Windows, OSX and Linux clients are islands that sit on > the >> same network. >> >> The route that Youenn has taken (unless I have got completely the wrong > end >> of the stick) requires Active Directory in the architecture. >> >> Chris >> >> >> >> From: "Matt ." <yamakasi....@gmail.com> >> To: Youenn PIOLET <piole...@gmail.com> >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> Date: 06.08.2015 14:42 >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA >> >> >> >> Hi, >> >> OK, this sounds already quite logical, but I'm still refering to the >> old howto we found earlier, does that one still apply somewhere or not >> at all ? >> >> Thanks, >> >> Matt >> >> >> >> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>> Hey guys, >>> >>> I'll try to make a tutorial soon, sorry I'm quite in a rush these > days :) >>> >>> General idea: >>> >>> On FreeIPA (4.1) >>> - `ipa-adtrust-install --add-sids` (creates ipaNTsecurityidentifier >>> attribude, also known as SID) >>> - regenerate each user password to build ipaNTHash attribute, not here > by >>> default on users >>> - use your ldap browser to check ipaNTHash values are here on user >> objects >>> - create a CIFS service for your samba server >>> - Create user roles/permissions as described here: >>> >> > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > >> >>> so that CIFS service will be able to read ipaNTsecurityidentifier and >>> ipaNTHash attributes in LDAP (ACI) >>> - SCP ipasam.so module to your cifs server (this is the magic trick) : >> scp >>> /usr/lib64/samba/pdb/ipasam.so >>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also try to >> recompile >>> it. >>> >>> On SAMBA Server side (CentOS 7...) >>> - Install server keytab file for CIFS >>> - check ipasam.so is here. >>> - check you can read password hash in LDAP with `ldapsearch -Y GSSAPI >>> uid=admin ipaNTHash` thanks to kerberos >>> - make your smb.conf following the linked thread and restart service >>> >>> I don't know if it works in Ubuntu. I know sssd has evolved quickly and >>> ipasam may use quite recent functionalities, the best is to just try. > You >>> can read in previous thread : "If you insist on Ubuntu you need to get >>> ipasam somewhere, most likely to compile it yourself". >>> >>> Make sure your user has ipaNTHash attribute :) >>> >>> You may want to debug authentication on samba server, I usually do this: >>> `tail -f /var/log/samba/log* | grep <username> >>> >>> Cheers >>> -- >>> Youenn Piolet >>> piole...@gmail.com >>> >>> >>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> >>>> Hi, >>>> >>>> This sounds great to me too, but a howto would help to make it more >>>> clear about what you have done here. The thread confuses me a little >>>> bit. >>>> >>>> Can you paste your commands so we can test out too and report back ? >>>> >>>> Thanks! >>>> >>>> Matt >>>> >>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb >> <christopher.l...@ch.ibm.com>: >>>> > Hi Youenn >>>> > >>>> > Good news that you have got an integration working >>>> > >>>> > Now you have got it going, and the solution is fresh in your mind, > how >>>> > about adding a How-to page on this solution to the FreeIPA wiki? >>>> > >>>> > Chris >>>> > >>>> > >>>> > >>>> > From: Youenn PIOLET <piole...@gmail.com> >>>> > To: "Matt ." <yamakasi....@gmail.com> >>>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> > "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>> > Date: 05.08.2015 14:51 >>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against >> IPA >>>> > >>>> > >>>> > >>>> > Hi guys, >>>> > >>>> > Thank you so much your previous answers. >>>> > I realised my SID were stored in ipaNTsecurityidentifier, thanks to >>>> > ipa-adtrust-install --add-sids >>>> > >>>> > I found an other way to configure smb here: >>>> > >>>> > >> > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > >> >>>> > It works perfectly. >>>> > >>>> > I'm using module ipasam.so I have manually scp to the samba server, >>>> > Samba is set to use kerberos + ldapsam via this ipasam module. >>>> > Following the instructions, I created a user role allowing service >>>> > principal to read ipaNTHash value from the LDAP. >>>> > ipaNTHash are generated each time a user changes his password. >>>> > Authentication works perfectly on Windows 7, 8 and 10. >>>> > >>>> > For more details, the previously linked thread is quite clear. >>>> > >>>> > Cheers >>>> > >>>> > -- >>>> > Youenn Piolet >>>> > piole...@gmail.com >>>> > >>>> > >>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> > Hi Chris. >>>> > >>>> > Yes, Apache Studio did that but I was not sure why it complained it >>>> > was "already" there. >>>> > >>>> > I'm still getting: >>>> > >>>> > IPA Error 4205: ObjectclassViolation >>>> > >>>> > missing attribute "sambaGroupType" required by object class >>>> > "sambaGroupMapping" >>>> > >>>> > When adding a user. >>>> > >>>> > I also see "class" as fielname under my "Last name", this is not OK >>>> > also. >>>> > >>>> > >>>> > >>>> > We sure need to make some howto, I think we can nail this down :) >>>> > >>>> > Thanks for the heads up! >>>> > >>>> > Matthijs >>>> > >>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>>> > <christopher.l...@ch.ibm.com>: >>>> > > Hi Matt >>>> > > >>>> > > If I use Apache Directory Studio to add an attribute >> ipaCustomFields >>>> > to >>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, as >> shown >>>> > below: >>>> > > >>>> > > #!RESULT OK >>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>>> > > #!DATE 2015-08-05T05:45:04.608 >>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>>> > > changetype: modify >>>> > > add: ipaCustomFields >>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>>> > > >>>> > > After that I then have a visible attribute ipaCustomFields as >>>> > expected. >>>> > > >>>> > > When adding the attribute, the wizard offered me > "ipaCustomFields" >>>> > as >>>> > > attribute type in a drop down list. >>>> > > >>>> > > Once we get this cracked, we really must write a how-to on the >>>> > FreeIPA >>>> > > Wiki. >>>> > > >>>> > > Chris >>>> > > >>>> > > >>>> > > >>>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>>> > > To: "Matt ." <yamakasi....@gmail.com> >>>> > > Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>> > > Date: 05.08.2015 07:31 >>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> against >>>> > IPA >>>> > > Sent by: freeipa-users-boun...@redhat.com >>>> > > >>>> > > >>>> > > >>>> > > Hi Matt >>>> > > >>>> > > I also got the same result at that step, but can see nothing in >>>> > Apache >>>> > > Directory Studio. >>>> > > >>>> > > As I am using existing Samba / FreeIPA groups migrated across, >> they >>>> > > probably were migrated with all the required attributes. >>>> > > >>>> > > Looking more closely at that LDIF: I wonder should it not be: >>>> > > >>>> > > ldapmodify -Y GSSAPI <<EOF >>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>> > > changetype: modify >>>> > > add: ipaCustomFields >>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>> > > EOF >>>> > > >>>> > > i.e. changetype: modify, instead of changetype add ? >>>> > > >>>> > > I don't want to play around with my prod directory - I will setup >> an >>>> > EL >>>> > 7.1 >>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me to >> play >>>> > around >>>> > > more destructively. >>>> > > >>>> > > Chris >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > From: "Matt ." <yamakasi....@gmail.com> >>>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> > > Cc: Youenn PIOLET <piole...@gmail.com>, " >>>> > freeipa-users@redhat.com" >>>> > > <freeipa-users@redhat.com> >>>> > > Date: 05.08.2015 01:01 >>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>> > Auth >>>> > against IPA >>>> > > >>>> > > >>>> > > >>>> > > Hi Chris, >>>> > > >>>> > > I'm at the right path, but my issue is that: >>>> > > >>>> > > ldapmodify -Y GSSAPI <<EOF >>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>> > > changetype: add >>>> > > add: ipaCustomFields >>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>> > > EOF >>>> > > >>>> > > Does say it exists, my ldap explorer doesn't show it, and when I >> add >>>> > > it manually as an attribute it still fails when I add a user on >> this >>>> > > sambagrouptype as it's needed by the other attributes >>>> > > >>>> > > So that is my issue I think so far. >>>> > > >>>> > > Any clue about that ? >>>> > > >>>> > > No problem "you don't know something or are no guru" we are all >>>> > > learning! :) >>>> > > >>>> > > Cheers, >>>> > > >>>> > > Matt >>>> > > >>>> > > >>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>>> > christopher.l...@ch.ibm.com>: >>>> > >> Hi Matt, Youeen >>>> > >> >>>> > >> Just to set the background properly, I did not invent this >> process. >>>> > I >>>> > > know >>>> > >> only a little about FreeIPA, and almost nothing about Samba, but >> I >>>> > guess >>>> > > I >>>> > >> was lucky enough to get the integration working on a Sunday >>>> > afternoon. >>>> > (I >>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as a >>>> > reference). >>>> > >> >>>> > >> It sounds like we need to step back, and look at the test user >> and >>>> > group >>>> > > in >>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes this >> much >>>> > > easier. >>>> > >> >>>> > >> My FreeIPA / Samba Users have the following Samba extensions in >>>> > FreeIPA >>>> > >> (cn=accounts, cn=users): >>>> > >> >>>> > >> * objectClass: sambasamaccount >>>> > >> >>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet >>>> > >> >>>> > >> My FreeIPA / Samba Groups have the following Samba extensions in >>>> > FreeIPA >>>> > >> (cn=accounts, cn=groups): >>>> > >> >>>> > >> * objectClass: sambaGroupMapping >>>> > >> >>>> > >> * Attributes: sambaGroupType, sambaSID >>>> > >> >>>> > >> The Users must belong to one or more of the samba groups that > you >>>> > have >>>> > >> setup. >>>> > >> >>>> > >> If you don't have something similar to the above (which sounds >> like >>>> > it >>>> > is >>>> > >> the case), then something went wrong applying the extensions. It >>>> > would >>>> > be >>>> > >> worth testing comparing a new user / group created post adding >> the >>>> > >> extensions to a previous existing user. >>>> > >> >>>> > >> i.e. >>>> > >> are the extensions missing on existing users / groups? >>>> > >> are the extensions missing on new users / groups? >>>> > >> >>>> > >> Cheers >>>> > >> >>>> > >> Chris >>>> > >> >>>> > >> >>>> > >> >>>> > >> >>>> > >> >>>> > >> From: Youenn PIOLET <piole...@gmail.com> >>>> > >> To: "Matt ." <yamakasi....@gmail.com> >>>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> > >> "freeipa-users@redhat.com" > <freeipa-users@redhat.com> >>>> > >> Date: 04.08.2015 18:56 >>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> > against >>>> > IPA >>>> > >> >>>> > >> >>>> > >> >>>> > >> Hi there, >>>> > >> >>>> > >> I have difficulties to follow you at this point :) >>>> > >> Here is what I've done and what I've understood: >>>> > >> >>>> > >> ## SMB Side >>>> > >> - Testparm OK >>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to > connect. >>>> > >> - pdbedit -Lv output is all successfull but I can see there is a >>>> > filter : >>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users don't >>>> > have >>>> > >> sambaSamAccount. >>>> > >> >>>> > >> ## LDAP / FreeIPA side >>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on my >>>> > FreeIPA >>>> > >> server to get samba LDAP extensions. >>>> > >> - I can see samba classes exist in LDAP but are not used on my >>>> > group >>>> > >> objects nor my user objects >>>> > >> - I have add sambaSamAccount in FreeIPA default user classes, >>>> > >> and sambaGroupMapping to default group classes. In that state I >>>> > can't >>>> > >> create user nor groups anymore, as new samba attributes are >> needed >>>> > for >>>> > >> instantiation. >>>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>>> > > Type,sambagrouptype,true' >>>> > >> but I don't get what it does. >>>> > >> - I tried to add the samba.js plugin. It works, and adds the >>>> > "local" >>>> > > option >>>> > >> when creating a group in FreeIPA, supposed to set sambagrouptype >> to >>>> > 4 >>>> > or >>>> > > 2 >>>> > >> (domain). It doesn't work and tells that sambagrouptype > attribute >>>> > doesn't >>>> > >> exist (but it should now I put sambaGroupType class by >> default...) >>>> > >> >>>> > >> ## Questions >>>> > >> 0) Can I ask samba not to search sambaSamAccount and use unix / >>>> > posix >>>> > >> instead? I guess no. >>>> > >> 1) How to generate the user/group SIDs ? They are requested to >> add >>>> > >> sambaSamAccount classes. >>>> > >> This article doesn't seem relevant since we don't use domain >>>> > controller >>>> > >> >>>> > > >>>> > >>>> > >> > http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>>> > >>>> > >> and netgetlocalsid returns an error. >>>> > >> 2) How to fix samba.js plugin? >>>> > >> 3) I guess an equivalent of samba.js is needed for user > creation, >>>> > where >>>> > > can >>>> > >> I find it? >>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and not > only >>>> > Windows >>>> > >> 7? >>>> > >> >>>> > >> Thanks a lot for your previous and future answers >>>> > >> >>>> > >> -- >>>> > >> Youenn Piolet >>>> > >> piole...@gmail.com >>>> > >> >>>> > >> >>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> > >> Hi, >>>> > >> >>>> > >> Yes, log is anonymised. >>>> > >> >>>> > >> It's strange, my user doesn't have a SambaPwdLastSet, also > when >> I >>>> > >> change it's password it doesn't get it in ldap. >>>> > >> >>>> > >> There must be something going wrong I guess. >>>> > >> >>>> > >> Matt >>>> > >> >>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>>> > > <christopher.l...@ch.ibm.com >>>> > >> >: >>>> > >> > Hi Matt >>>> > >> > >>>> > >> > I assume [username] is a real username, identical to that in >>>> > the >>>> > >> FreeIPA >>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the log >>>> > extract). >>>> > >> > >>>> > >> > You user should be a member of the appropriate samba groups >>>> > that >>>> > you >>>> > >> setup >>>> > >> > in FreeIPA. >>>> > >> > >>>> > >> > You should check that the user attribute SambaPwdLastSet is >> set >>>> > to >>>> > a >>>> > >> > positive value (e.g. 1). If not you get an error in the > Samba >>>> > logs >>>> > - >>>> > > I >>>> > >> > would need to play around again with a test user to find out >>>> > the >>>> > > exact >>>> > >> > error. >>>> > >> > >>>> > >> > I don't understand what you mean about syncing the users >> local, >>>> > but >>>> > > we >>>> > >> did >>>> > >> > not need to do anything like that. >>>> > >> > >>>> > >> > Chris >>>> > >> > >>>> > >> > >>>> > >> > >>>> > >> > >>>> > >> > From: "Matt ." <yamakasi....@gmail.com> >>>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> > >> > Cc: "freeipa-users@redhat.com" > <freeipa-users@redhat.com> >>>> > >> > Date: 04.08.2015 15:33 >>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> > against >>>> > >> IPA >>>> > >> > >>>> > >> > >>>> > >> > >>>> > >> > Hi Chris, >>>> > >> > >>>> > >> > A puppet run added another passdb backend, that was causing >> my >>>> > issue. >>>> > >> > >>>> > >> > What I still experience is: >>>> > >> > >>>> > >> > >>>> > >> > [2015/08/04 15:29:45.477783, 3] >>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security) >>>> > >> > check_sam_security: Couldn't find user 'username' in >> passdb. >>>> > >> > [2015/08/04 15:29:45.478026, 2] >>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password) >>>> > >> > check_ntlm_password: Authentication for user [username] > -> >>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER >>>> > >> > >>>> > >> > >>>> > >> > I also wonder if I shall still sync the users local, or is > it >>>> > > needed ? >>>> > >> > >>>> > >> > Thanks again, >>>> > >> > >>>> > >> > Matt >>>> > >> > >>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>>> > >> christopher.l...@ch.ibm.com>: >>>> > >> >> Hi Matt >>>> > >> >> >>>> > >> >> From our smb.conf file: >>>> > >> >> >>>> > >> >> [global] >>>> > >> >> security = user >>>> > >> >> passdb backend = >>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>>> > >> >> ldap admin dn = cn=Directory Manager >>>> > >> >> >>>> > >> >> So yes, we use Directory Manager, it works for us. I have >> not >>>> > tried >>>> > >> with >>>> > >> > a >>>> > >> >> less powerful user, but it is conceivable that a lesser > user >>>> > may >>>> > not >>>> > >> see >>>> > >> >> all the required attributes, resulting in "no such user" >>>> > errors. >>>> > >> >> >>>> > >> >> Chris >>>> > >> >> >>>> > >> >> >>>> > >> >> >>>> > >> >> >>>> > >> >> From: "Matt ." <yamakasi....@gmail.com> >>>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> > >> >> Cc: "freeipa-users@redhat.com" >> <freeipa-users@redhat.com> >>>> > >> >> Date: 04.08.2015 13:32 >>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server > Auth >>>> > against >>>> > >> IPA >>>> > >> >> >>>> > >> >> >>>> > >> >> >>>> > >> >> Hi Chris, >>>> > >> >> >>>> > >> >> Thanks for the heads up, indeed local is 4 I see now when I >>>> > add a >>>> > >> >> group from the GUI, great thanks! >>>> > >> >> >>>> > >> >> But do you use Directory Manager as ldap admin user or some >>>> > other >>>> > >> >> admin account ? >>>> > >> >> >>>> > >> >> I'm not sure id DM is needed and it should get that deep >> into >>>> > IPA. >>>> > >> >> Also when starting samba it cannot find "such user" as that >>>> > sounds >>>> > >> >> quite known as it has no UID. >>>> > >> >> >>>> > >> >> From your config I see you use DM, this should work ? >>>> > >> >> >>>> > >> >> Thanks! >>>> > >> >> >>>> > >> >> >>>> > >> >> Matt >>>> > >> >> >>>> > >> >> >>>> > >> > >>>> > >> > >>>> > >> > >>>> > >> > >>>> > >> >>>> > >> -- >>>> > >> Manage your subscription for the Freeipa-users mailing list: >>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users >>>> > >> Go to http://freeipa.org for more info on the project >>>> > >> >>>> > >> >>>> > >> >>>> > > >>>> > > >>>> > > >>>> > > >>>> > > -- >>>> > > Manage your subscription for the Freeipa-users mailing list: >>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>>> > > Go to http://freeipa.org for more info on the project >>>> > > >>>> > > >>>> > > >>>> > > >>>> > >>>> > -- >>>> > Manage your subscription for the Freeipa-users mailing list: >>>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>> > Go to http://freeipa.org for more info on the project >>>> > >>>> > >>>> > >>> >>> >> >> >> >> > > > > -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project