Re: [Freeipa-users] CA cert issues

2013-01-16 Thread Orion Poplawski
On 01/16/2013 06:50 PM, Rob Crittenden wrote: Orion Poplawski wrote: On 01/16/2013 04:28 PM, Orion Poplawski wrote: I've installed ipa 2.2 on EL6. I initially simply did an ipa-server-install. Then I changed the cert used via ipa-server-certinstall to use a wildcard SSL cert issued by Comodo

Re: [Freeipa-users] CA cert issues

2013-01-16 Thread Rob Crittenden
Orion Poplawski wrote: On 01/16/2013 04:28 PM, Orion Poplawski wrote: I've installed ipa 2.2 on EL6. I initially simply did an ipa-server-install. Then I changed the cert used via ipa-server-certinstall to use a wildcard SSL cert issued by Comodo. This has led to a lot of grief and needing t

Re: [Freeipa-users] Managing jboss through sudo

2013-01-16 Thread Dmitri Pal
On 01/16/2013 07:30 PM, William Muriithi wrote: > Hello > > I am trying to set up dev systems and want to only allow developers to > modify the jboss directory tree, shutdown and restarting jboss. This > is mainly so that they dev system don't deviate from the qa and > production machines. > > The

Re: [Freeipa-users] CA cert issues

2013-01-16 Thread Orion Poplawski
On 01/16/2013 04:28 PM, Orion Poplawski wrote: I've installed ipa 2.2 on EL6. I initially simply did an ipa-server-install. Then I changed the cert used via ipa-server-certinstall to use a wildcard SSL cert issued by Comodo. This has led to a lot of grief and needing to install the Comodo CA

[Freeipa-users] CA cert issues

2013-01-16 Thread Orion Poplawski
I've installed ipa 2.2 on EL6. I initially simply did an ipa-server-install. Then I changed the cert used via ipa-server-certinstall to use a wildcard SSL cert issued by Comodo. This has led to a lot of grief and needing to install the Comodo CA chain into lots of SSL dbs. Now I'm looking a

Re: [Freeipa-users] freeipa radius cisco

2013-01-16 Thread Dmitri Pal
On 01/16/2013 11:44 AM, Han Boetes wrote: > This might be somewhat off-topic but I'll ask anyway. > > First my questions: > > How do I get the cisco device -- a 3750 with the latest software image > -- to use EAP-TTLS and what am I missing for the rest. My memory about all this is a bit rusty. I w

Re: [Freeipa-users] freeipa radius cisco

2013-01-16 Thread John Dennis
On 01/16/2013 11:44 AM, Han Boetes wrote: This might be somewhat off-topic but I'll ask anyway. First my questions: How do I get the cisco device -- a 3750 with the latest software image -- to use EAP-TTLS and what am I missing for the rest. Sorry, I can't help you with cisco configuration, m

Re: [Freeipa-users] freeipa radius cisco

2013-01-16 Thread Simo Sorce
On Wed, 2013-01-16 at 17:44 +0100, Han Boetes wrote: > +- entering group Kerberos {...} > rlm_krb5: [hb] krb5_sname_to_principal failed: Hostname cannot be > canonicalized Something's wrong in your configuration Probably the host name is not a fqdn or similar Simo. -- Simo Sorce * Red Hat, In

Re: [Freeipa-users] freeipa radius cisco

2013-01-16 Thread Han Boetes
This might be somewhat off-topic but I'll ask anyway. First my questions: How do I get the cisco device -- a 3750 with the latest software image -- to use EAP-TTLS and what am I missing for the rest. I've set up radius to use kerberos: kerberos seems to like it when I log on with ssh on the cisc

[Freeipa-users] SSO page FreeIPAv3

2013-01-16 Thread Umarzuki Mochlis
problem: -using Zimbra Collaboration Suite 8 -3000 users -only have license for 2500 users (ZCS Network Edition, users on freeipa) -500 users on OSS Edition, openldap want to achieve: -single sign-on / login page to log in users on both NE & OSS servers e.g: user A on NE logs in via webmail.domai

Re: [Freeipa-users] error: Realm not local to KDC

2013-01-16 Thread Dmitri Pal
On 01/16/2013 08:55 AM, Simo Sorce wrote: > On Tue, 2013-01-15 at 17:57 -0500, Sylvain Angers wrote: >> Some rhel6.2 have problem with authenticating against IPA v2.2 >> while some others on same domain do not have issue but still get the >> same >> error "Failed to init credentials: Realm not loca

Re: [Freeipa-users] error: Realm not local to KDC

2013-01-16 Thread Simo Sorce
On Tue, 2013-01-15 at 17:57 -0500, Sylvain Angers wrote: > Some rhel6.2 have problem with authenticating against IPA v2.2 > while some others on same domain do not have issue but still get the > same > error "Failed to init credentials: Realm not local to KDC" > Because you are putting machines in

Re: [Freeipa-users] error: Realm not local to KDC

2013-01-16 Thread Petr Spacek
Hello, as Dmitri said, this problem is probably related to DNS. I would recommend to run tcpdump/wireshark on the client, capture all network traffic during client enrolment and check IP addresses. You will probably see IP address of AD server more often than you should ... Petr^2 Spacek On