date:20160202

Re: [Freeipa-users] FreeIPA smart card how to

2016-02-02 Thread Michael Rainey (Contractor)

Okay.  I haven't been able to get around this issue. I can log using my 
username, my card is recognized by GDM and reads the card as expected, 
but I am unable to login using my smartcard.  From what I can see in the 
logs the common name on my card doesn't match the username on my test 
account.


Feb  2 13:00:05 cabildo gdm-smartcard]: pam_krb5[5152]: error resolving 
user name '' to uid/gid pair
Feb  2 13:00:05 cabildo gdm-smartcard]: pam_krb5[5152]: error getting 
information about '
Feb  2 13:00:06 cabildo gdm-smartcard]: pam_unix(gdm-smartcard:account): 
could not identify user (from getpwnam())
Feb  2 13:00:06 cabildo gdm-smartcard]: pam_sss(gdm-smartcard:account): 
Access denied for user : 10 (User not known to the 
underlying authentication module)
Feb  2 13:00:06 cabildo gdm-smartcard]: pam_krb5[5152]: error resolving 
user name '' to uid/gid pair
Feb  2 13:00:13 cabildo gdm-smartcard]: pam_pkcs11(gdm-smartcard:auth): 
pam_get_pwd() failed: Conversation error


Where do I go from here?

*Michael Rainey*
NRL 7320
Computer Support Group
Building 1009, Room C156
Stennis Space Center, MS 39529
On 02/02/2016 09:56 AM, Martin Kosek wrote:

On 02/02/2016 04:49 PM, Michael Rainey (Contractor) wrote:

Greetings FreeIPA Community,

I have been testing and working with the smart card login feature of the IPA
server, and have had some successes with this project. However, my latest
server/client setup isn't working as expected.  I can where the problem is
occurring, which is the Common Name on the Card is not being mapped to the
proper attribute on the IPA server. So here's my question: Is there a howto
which explains how an where this mapping occurs?  Is this something I can
configure myself, or is hard coded.

At the moment, the Smart Card support present in SSSD looks up the user by
searching with a blob containing the whole SC certificate. This BTW means that
the certificate needs to be present at user entry in FreeIPA to make sure it
matches, no other mapping mechanism is available yet. We have some plans though:

http://www.freeipa.org/page/V4/User_Certificates#Certificate_Identity_Mapping

If you are interested in HOWTOs, Nathan Kinder put together pretty neat blog
posts how to make Smart Card authentication working:

http://www.freeipa.org/page/V4/User_Certificates#References

HTH,
Martin


-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

[Freeipa-users] FreeIPA for securing Hadoop clusters

2016-02-02 Thread Benoy Antony

Greetings FreeIPA Community,

For the past few months, we have been working on securing our Hadoop
clusters at eBay using FreeIpa. We have been using Microsoft AD and we are
replacing it with FreeIpa.

Hadoop uses Kerberos, Ldap, certificates and secret keys for security.
FreeIPA is a good fit. We are developing automation scripts and some
services for integrating Hadoop with FreeIpa, which we plan to opensource
once it is ready.

We like to share our experience and lessons learned in the upcoming Hadoop
Summit. Please support us by voting for our topic at
https://hadoopsummit.uservoice.com/forums/344958-governance-and-security/suggestions/11664876-freeipa-for-securing-hadoop-fish

cheers,
Benoy Antony
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

[Freeipa-users] FreeIPA Consistency Checker

2016-02-02 Thread Peter Pakos


Hi,

I just wanted to share a little script that I've created to check 
consistency across FreeIPA servers.


https://github.com/peterpakos/ipa_check_consistency

I hope you will like it.

Please note, it's been tested only with FreeIPA 4.2 (Centos 7.2) so I'm 
not sure if it works with other versions.


Please feel free to try it and if you have any improvement ideas then 
log them via GitHub.


Thanks.

--
Kind regards,
 Peter Pakos

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

[Freeipa-users] "Installing the client"

2016-02-02 Thread Simpson Lachlan

In the docs, there is a section called "Installing the client".

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html-single/Linux_Domain_Identity_Authentication_and_Policy_Guide/index.html#setting-up-clients

The very first step contains language that is not explained.

"For a regular user system" has one install method, and "An administrator
machine" has another.

There is no indication what an administrator machine might be used for - is
this a replica? Is it a system that can run ipa commands on behalf of the
ipa-server?

What is the difference between a regular user system and an administrator
machine?

Cheers
L.
This email (including any attachments or links) may contain
confidential and/or legally privileged information and is
intended only to be read or used by the addressee. If you
are not the intended addressee, any use, distribution,
disclosure or copying of this email is strictly
prohibited.
Confidentiality and legal privilege attached to this email
(including any attachments) are not waived or lost by
reason of its mistaken delivery to you.
If you have received this email in error, please delete it
and notify us immediately by telephone or email. Peter
MacCallum Cancer Centre provides no guarantee that this
transmission is free of virus or that it has not been
intercepted or altered and will not be liable for any delay
in its receipt.

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

41 matches

Mail list logo