Re: [Freeipa-users] kerberos to keberos inter-realm trusts

2011-05-25 Thread Simo Sorce
On Wed, 2011-05-25 at 04:23 +, Steven Jones wrote: Can IPA do this? Technically MIT Kerberos can do that, but we do not have any infrastructure to properly handle trusts yet at the identity level. Cross-Realm trusts are the focus of version 3.0 Simo. -- Simo Sorce * Red Hat, Inc * New

Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs

2011-05-25 Thread Steven Jones
Outcome?, I couldnt see where the 401 or 500 appeared. the screen output of curl was as attached. regards From: Rob Crittenden [rcrit...@redhat.com] Sent: Thursday, 26 May 2011 1:21 a.m. To: Steven Jones Cc: freeipa-users@redhat.com Subject: Re:

Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs

2011-05-25 Thread Rob Crittenden
Steven Jones wrote: Outcome?, I couldnt see where the 401 or 500 appeared. the screen output of curl was as attached. You didn't use the FQDN of the ipa server so it didn't do the authentication. Please run this again using the FQDN. rob regards

Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs

2011-05-25 Thread Steven Jones
Strange dns things? calling host from the comamnd line works but something cant resolve the ipa server regards From: Rob Crittenden [rcrit...@redhat.com] Sent: Thursday, 26 May 2011 8:32 a.m. To: Steven Jones Cc: freeipa-users@redhat.com Subject:

Re: [Freeipa-users] Migration from FreeIPA 1.2.1 to 2

2011-05-25 Thread Steven Jones
Hi, As far as I am aware Windows clients can only authenticate against ADs. So if you need to authenticate Windows you need a password trust/sync setup with AD and yes you need an AD as well as FreeIPA. From what's been said in the last day or so the next version of FreeIPA will do

Re: [Freeipa-users] Migration from FreeIPA 1.2.1 to 2

2011-05-25 Thread Simo Sorce
On Wed, 2011-05-25 at 17:00 -0400, Dan Scott wrote: Hello, I have a FreeIPA 1.2.1 system (1 master and 1 replica server) running on Fedora 14. I'd like to migrate to FreeIPA 2, now that Fedora 15 has been released. But I have a few questions: 1. Can Fedora 15 clients authenticate against

Re: [Freeipa-users] Migration from FreeIPA 1.2.1 to 2

2011-05-25 Thread Rob Crittenden
Dan Scott wrote: Hello, I have a FreeIPA 1.2.1 system (1 master and 1 replica server) running on Fedora 14. I'd like to migrate to FreeIPA 2, now that Fedora 15 has been released. But I have a few questions: 1. Can Fedora 15 clients authenticate against my FreeIPA 1 servers? Yes but you

Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs

2011-05-25 Thread Steven Jones
any ideas pls? regards From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on behalf of Steven Jones [steven.jo...@vuw.ac.nz] Sent: Thursday, 26 May 2011 8:37 a.m. To: Rob Crittenden Cc: freeipa-users@redhat.com Subject: Re:

Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs

2011-05-25 Thread Rob Crittenden
Steven Jones wrote: Strange dns things? calling host from the comamnd line works but something cant resolve the ipa server This is not a DNS problem, you did not give the FQDN to curl. There are Apache mod_rewrite rules that attempt to redirect HTTP requests to a point where the name

Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs

2011-05-25 Thread Steven Jones
um...doh typo... From: Rob Crittenden [rcrit...@redhat.com] Sent: Thursday, 26 May 2011 12:46 p.m. To: Steven Jones Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] Server - client mismatch has no progressed to 6.1 - httpd logs Steven Jones

Re: [Freeipa-users] Migration from FreeIPA 1.2.1 to 2

2011-05-25 Thread Christian Horn
On Wed, May 25, 2011 at 01:29:41PM -0800, Erinn Looney-Triggs wrote: On 05/25/2011 01:21 PM, Steven Jones wrote: As far as I am aware Windows clients can only authenticate against ADs. So if you need to authenticate Windows you need a password trust/sync setup with AD and yes you need

Re: [Freeipa-users] Migration from FreeIPA 1.2.1 to 2

2011-05-25 Thread Steven Jones
Quickly as Im late. We are setting up cross realm from AD to a school who runs MIT Kerberos with openldap underneathA windows client in our domain can then connect to a school resource where its connected to the school's centralised setup So its possible, yes. Not with freeipa from

Re: [Freeipa-users] Migration from FreeIPA 1.2.1 to 2

2011-05-25 Thread Christian Horn
On Thu, May 26, 2011 at 05:51:59AM +, Steven Jones wrote: Quickly as Im late. We are setting up cross realm from AD to a school who runs MIT Kerberos with openldap underneathA windows client in our domain can then connect to a school resource where its connected to the school's