[Freeipa-users] Re: adding services to freeipa

2017-11-15 Thread Rob Crittenden via FreeIPA-users
Andrew Meyer via FreeIPA-users wrote: > When I try to add puppet i am getting the following error: > > [andrew.meyer@asm-automation01 ~]$ ipa service-add > puppetmaster/asm-automation01.mgt.asm.borg.local > ipa: ERROR: Host 'asm-automation01.mgt.asm.borg.local' does not have > corresponding DNS A/

[Freeipa-users] adding services to freeipa

2017-11-15 Thread Andrew Meyer via FreeIPA-users
When I try to add puppet i am getting the following error: [andrew.meyer@asm-automation01 ~]$ ipa service-add puppetmaster/asm-automation01.mgt.asm.borg.localipa: ERROR: Host 'asm-automation01.mgt.asm.borg.local' does not have corresponding DNS A/ record[andrew.meyer@asm-automation01 ~]$ I j

[Freeipa-users] Re: FreeIPA server: Replication issues

2017-11-15 Thread Mark Reynolds via FreeIPA-users
Hi James, On 11/15/2017 10:11 AM, James Harrison via FreeIPA-users wrote: > Hello, > I am using Centos to host our FreeIPA servers. We have a CA-less setup. > > I have upgraded to Centos 7.4 and FreeIPA version : VERSION: 4.5.0, > API_VERSION: 2.228 > > The upgrade of both went off without any see

[Freeipa-users] Re: ERROR: did not receive Kerberos credentials

2017-11-15 Thread Carl Gola via FreeIPA-users
Looks like it was finding kinit as part of java I used the full path below but my personal ipa id generates an error but the admin id works ok [root@test-nfs-prod-1 ~]# rpm --info -qf $(which kinit) file /opt/ibm/ibm-java-x86_64-8.0-1.10/jre/bin/kinit is not owned by any package [root@test-nfs-pr

[Freeipa-users] Re: upgrade to ubuntu 17.10 fails

2017-11-15 Thread David Harvey via FreeIPA-users
Thanks Rob, Simon, Rob, will check, but thought my cert system was healthy before. It's relatively new (6months or less), and no sub-ca's involved.. Any specifics on how to invoke the selftests in some manner that might provide digestible output? Or could it be my dirty hack of cloning and isolati

[Freeipa-users] Re: FreeIPA & wireless

2017-11-15 Thread Andrew Meyer via FreeIPA-users
Weird.  We are having problems with it and our Aruba wireless using FreeRADIUS. On Wednesday, November 15, 2017 10:48 AM, Michael Plemmons via FreeIPA-users wrote: I do not remember having to update any SSL certs.     I am upgraded to High Sierra and have not had any problems with cert

[Freeipa-users] Re: FreeIPA & wireless

2017-11-15 Thread Michael Plemmons via FreeIPA-users
I do not remember having to update any SSL certs. I am upgraded to High Sierra and have not had any problems with certs. *Mike Plemmons | Senior DevOps Engineer | CrossChx* 614.427.2411 mike.plemm...@crosschx.com www.crosschx.com On Tue, Nov 14, 2017 at 3:47 PM, Andrew Meyer wrote: > For

[Freeipa-users] Re: ERROR: did not receive Kerberos credentials

2017-11-15 Thread Robbie Harwood via FreeIPA-users
"Carl Gola" writes: > I'm not sure what's printing Done! either > > Here is a fresh kinit and klist afterwards > > [gola-us@test-nfs-prod-1 ~]$ kinit gola-us > Password for gola-us@test.LOCAL: > > Done! > New ticket is stored in cache file /home/rusers/gola-us/krb5cc_gola-us > [gola-us@test-nfs-p

[Freeipa-users] Re: ERROR: did not receive Kerberos credentials

2017-11-15 Thread Carl Gola via FreeIPA-users
I'm not sure what's printing Done! either Here is a fresh kinit and klist afterwards [gola-us@test-nfs-prod-1 ~]$ kinit gola-us Password for gola-us@test.LOCAL: Done! New ticket is stored in cache file /home/rusers/gola-us/krb5cc_gola-us [gola-us@test-nfs-prod-1 ~]$ klist Credentials cache: /h

[Freeipa-users] Re: ERROR: did not receive Kerberos credentials

2017-11-15 Thread Robbie Harwood via FreeIPA-users
Carl Gola via FreeIPA-users writes: > Receiving the following error when trying to run ipa commands > > [gola-us@test-nfs-prod-1 ~]$ kinit gola-us > Password for gola-us@test.LOCAL: > > Done! What's printing "Done!" here? kinit doesn't do that that I'm aware. > New ticket is stored in cache fi

[Freeipa-users] Re: Can't sync a new replica, large db file,

2017-11-15 Thread Mike Johnson via FreeIPA-users
Thank you Ludwig. I did ask on #389 on freenode. The first response I got said lkrispen (presumably you) you were the expert in this area. I have since cleaned up some nsTombstone/nsds5ReplConflict records according to the docs: https://access.redhat.com/documentation/en-us/red_hat_directory_serv

[Freeipa-users] Re: easy way to check ipa-client status

2017-11-15 Thread Rob Crittenden via FreeIPA-users
email--- via FreeIPA-users wrote: > Sorarely, a second server is built with the same fqdn, causing an > issue with the original server kerberos realm membership...thing. > > Is there an easy way to check/confirm this similar to how you'd check > the computer accounts for M$ AD? IPA should al

[Freeipa-users] Re: Can't sync a new replica, large db file,

2017-11-15 Thread Ludwig Krispenz via FreeIPA-users
On 11/15/2017 07:40 AM, Mike Johnson via FreeIPA-users wrote: I should add that I deleted/moved the large DB file as it was on the single remaining master, with no replication agreements left. yes, but that should be unrelated. Is it worth asking on the 389-users list as well? you can d othi

[Freeipa-users] FreeIPA server: Replication issues

2017-11-15 Thread James Harrison via FreeIPA-users
Hello,I am using Centos to host our FreeIPA servers. We have a CA-less setup. I have upgraded to Centos 7.4 and FreeIPA version : VERSION: 4.5.0, API_VERSION: 2.228 The upgrade of both went off without any seen errors. However, now I am getting the following messages on each server (12 in total):

[Freeipa-users] Re: upgrade to ubuntu 17.10 fails

2017-11-15 Thread Rob Crittenden via FreeIPA-users
David Harvey via FreeIPA-users wrote: > Sorry for the dump size, but not sure if the below from > /var/log/pki/pki-tomcat/localhost.date.log helps: Looks like the selftests are failing. I'd check that your CA subsystem certificates are not expired, etc. rob > > 15-Nov-2017 12:14:50.557 SEVERE [

[Freeipa-users] ERROR: did not receive Kerberos credentials

2017-11-15 Thread Carl Gola via FreeIPA-users
Receiving the following error when trying to run ipa commands [gola-us@test-nfs-prod-1 ~]$ kinit gola-us Password for gola-us@test.LOCAL: Done! New ticket is stored in cache file /home/rusers/gola-us/krb5cc_gola-us [gola-us@test-nfs-prod-1 ~]$ ipa user-find ipa: ERROR: did not receive Kerberos

[Freeipa-users] Re: upgrade to ubuntu 17.10 fails

2017-11-15 Thread Simon Williams via FreeIPA-users
There may be a million and one reasons not to do it this way, but have you considered building a new VM on 17.10 and replicating from the existing server? I have just tried to upgrade a development environment (IPA client) to 17.10 and had endless issues. I ended up creating a new machine and copyi

[Freeipa-users] Re: upgrade to ubuntu 17.10 fails

2017-11-15 Thread David Harvey via FreeIPA-users
Sorry for the dump size, but not sure if the below from /var/log/pki/pki-tomcat/localhost.date.log helps: 15-Nov-2017 12:14:50.557 SEVERE [localhost-startStop-1] org.apache.catalina.core.ApplicationContext.log StandardWrapper.Throwable java.lang.NullPointerException at com.netscape.cmscore.selfte

[Freeipa-users] upgrade to ubuntu 17.10 fails

2017-11-15 Thread David Harvey via FreeIPA-users
Hi wisdom of the list, I know I am an edge case with running on ubuntu, but hoped someone might be able to shed some light. A bit of background. I'm trying to test upgrades without potentially hosing my existing services, so I have cloned the VM, given it a new IP address, updated hosts file and

[Freeipa-users] Re: Make custom attribute fail in UI and SAVE Button

2017-11-15 Thread Alexander Bokovoy via FreeIPA-users
On ke, 15 marras 2017, barrykfl--- via FreeIPA-users wrote: anywhere can explain the following RFC of ldap ? I have confuse how come and must use this ...can I random gen some number .. 2.25.28639311321113238241701611583088740684.14.2.1 < it used custom person class so if relate to it I should u

[Freeipa-users] Re: Make custom attribute fail in UI and SAVE Button

2017-11-15 Thread barrykfl--- via FreeIPA-users
anywhere can explain the following RFC of ldap ? I have confuse how come and must use this ...can I random gen some number .. 2.25.28639311321113238241701611583088740684.14.2.1 < it used custom person class so if relate to it I should use .2 .3 .4 .5 etc ??? 2863931132111323824170161158308874

[Freeipa-users] Re: AD trust and external services

2017-11-15 Thread Alexander Bokovoy via FreeIPA-users
On ke, 15 marras 2017, Николай Савельев wrote: Can I get AD users from ipa wia ldap? Yes, you sort of can. Learn about 'legacy clients support' in Windows Integration Guide. However, it will not help you with Owncloud / Zimbra / etc. because most of those applications expect to have mail attribu

[Freeipa-users] Re: AD trust and external services

2017-11-15 Thread Николай Савельев via FreeIPA-users
Can I get AD users from ipa wia ldap? 15.11.2017, 17:13, "Alexander Bokovoy" : > On ke, 15 marras 2017, Николай Савельев via FreeIPA-users wrote: >> Hello. >> >> I install AD trust. It works normally. >> >>  I setup owcloud by this docs >> http://www.freeipa.org/page/Owncloud_Authentication_again

[Freeipa-users] Re: AD trust and external services

2017-11-15 Thread Alexander Bokovoy via FreeIPA-users
On ke, 15 marras 2017, Николай Савельев via FreeIPA-users wrote: Hello. I install AD trust. It works normally. I setup owcloud by this docs http://www.freeipa.org/page/Owncloud_Authentication_against_FreeIPA But i dont undestand how get all users from freeipa and ad for owncloud. By instruct

[Freeipa-users] Re: Make custom attribute fail in UI and SAVE Button

2017-11-15 Thread Alexander Bokovoy via FreeIPA-users
On ke, 15 marras 2017, barry...@gmail.com wrote: So I have one more question is that: If have several custom attributes should open servral new folders in different /usr/share/ipa/ui/js/plugins/ ? can it write in single file? thx It is up to you. I'd do it in a single one and would try to make

[Freeipa-users] Re: Make custom attribute fail in UI and SAVE Button

2017-11-15 Thread barrykfl--- via FreeIPA-users
So I have one more question is that: If have several custom attributes should open servral new folders in different /usr/share/ipa/ui/js/plugins/ ? can it write in single file? thx Regards 2017-11-13 18:48 GMT+08:00 Alexander Bokovoy : > On ma, 13 marras 2017, barry...@gmail.com wrote: > >> F

[Freeipa-users] AD trust and external services

2017-11-15 Thread Николай Савельев via FreeIPA-users
Hello. I install AD trust. It works normally. I setup owcloud by this docs http://www.freeipa.org/page/Owncloud_Authentication_against_FreeIPA But i dont undestand how get all users from freeipa and ad for owncloud. By instructions i getting only ipa users. I also can get only AD users. Ho