Re: [Freeipa-users] understanding RUVs?

2015-04-21 Thread Martin Kosek
On 04/21/2015 01:26 AM, Janelle wrote: Hello, When I was working with OpenLDAP, and AD - and did not deal with RUVs the way I am with 389-ds and IPA. I am trying to understand what is normal for values. If I am looking at this (and seem to have no replication problems):

[Freeipa-users] Also attempting to integrate Solaris 10 clients with freeipa

2015-04-21 Thread Roderick Johnstone
Hi I also need to integrate Solaris 10 clients with freeipa servers. I've been round many resources, eg freeipa wiki, Fedora and Red Hat manuals, various bug trackers and the freeipa-users mailing list. It looks to me as if this:

Re: [Freeipa-users] Stuck getting sudo working with Ubuntu client

2015-04-21 Thread Lukas Slebodnik
On (20/04/15 17:54), Andrew Sacamano wrote: Thanks again, Lukas! I was wondering if the overlaps of names was a problem, so I redid parts of my IPA setup to rename them - thanks for pointing out the ticket! Also, your suggestion to use ldap_group_object_class = ipaUserGroup worked - which saves

Re: [Freeipa-users] HBAC and SUDO rules for legacy clients

2015-04-21 Thread Srdjan Dutina
Yes, it does. Thank you. On Mon, Apr 20, 2015 at 6:08 PM Srdjan Dutina sdut...@gmail.com wrote: Sorry for misunderstanding. I understand HBAC rules will not work for Centos 5. I just wanted to make sure disabling allow all rule and adding new HBAC rules won't interfere with AD users logging

Re: [Freeipa-users] understanding RUVs?

2015-04-21 Thread thierry bordaz
On 04/21/2015 09:11 AM, Martin Kosek wrote: On 04/21/2015 01:26 AM, Janelle wrote: Hello, When I was working with OpenLDAP, and AD - and did not deal with RUVs the way I am with 389-ds and IPA. I am trying to understand what is normal for values. If I am looking at this (and seem to have no

Re: [Freeipa-users] understanding RUVs?

2015-04-21 Thread Ludwig Krispenz
On 04/21/2015 01:26 AM, Janelle wrote: Hello, When I was working with OpenLDAP, and AD - and did not deal with RUVs the way I am with 389-ds and IPA. I am trying to understand what is normal for values. If I am looking at this (and seem to have no replication problems):

Re: [Freeipa-users] Common Name for the ipa-cacert-manage command

2015-04-21 Thread Rob Crittenden
William Graboyes wrote: Hi List, I am having yet another issue, when I run the following command: ipa-cacert-manage renew --external-ca It does output the CSR, however the CN is not a valid name (Certificate Authority). Is it possible to change the output of this command to use an

Re: [Freeipa-users] group membership listing?

2015-04-21 Thread Rob Crittenden
Janelle wrote: Hello - and happy day before Earth Day, Perhaps this is an easy one and related to replication, BUT: $ id some-user-name If I run that on every IPA master, should the listing not be identical? In other words, the listing of the uid, gid and groups, should show up in

[Freeipa-users] Common Name for the ipa-cacert-manage command

2015-04-21 Thread William Graboyes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi List, I am having yet another issue, when I run the following command: ipa-cacert-manage renew --external-ca It does output the CSR, however the CN is not a valid name (Certificate Authority). Is it possible to change the output of this

[Freeipa-users] Problems with users from AD trusted domain after update to IPA 4.1

2015-04-21 Thread Alexander Frolushkin
Hello. Not sure it happened after update, but now we are on 4.1 and on some servers we have only AD groups if it is primary for user, and have no IPA groups with AD external group in members. Fro example, on the IPA server we have # id afrolush...@ad.com uid=236658172(afrolush...@ad.com)

Re: [Freeipa-users] Problems with users from AD trusted domain after update to IPA 4.1

2015-04-21 Thread Alexander Bokovoy
On Wed, 22 Apr 2015, Alexander Frolushkin wrote: Hello. Not sure it happened after update, but now we are on 4.1 and on some servers we have only AD groups if it is primary for user, and have no IPA groups with AD external group in members. Fro example, on the IPA server we have # id

Re: [Freeipa-users] group membership listing?

2015-04-21 Thread Alexander Bokovoy
On Tue, 21 Apr 2015, Rob Crittenden wrote: Janelle wrote: Hello - and happy day before Earth Day, Perhaps this is an easy one and related to replication, BUT: $ id some-user-name If I run that on every IPA master, should the listing not be identical? In other words, the listing of the uid,

Re: [Freeipa-users] Slow user logon with IPA

2015-04-21 Thread Mateusz Malek
On 14.04.2015 at 21:30, Rich Megginson wrote: On 04/14/2015 12:35 PM, thierry bordaz wrote: On 04/10/2015 08:13 AM, Mateusz Malek wrote: I'm about to migrate my OpenLDAP-based environment to FreeIPA, however I've hit some weird performance problems. When I'm using IPA, it takes about 5-7

Re: [Freeipa-users] Slow user logon with IPA

2015-04-21 Thread Mateusz Malek
On 15.04.2015 at 15:08, Lukas Slebodnik wrote: On 04/10/2015 08:13 AM, Mateusz Malek wrote: I'm about to migrate my OpenLDAP-based environment to FreeIPA, however I've hit some weird performance problems. When I'm using IPA, it takes about 5-7 (or even more) seconds to get shell prompt after

Re: [Freeipa-users] web interface for FREEIPA runtime error

2015-04-21 Thread Petr Vobornik
On 04/21/2015 06:09 AM, Rob Crittenden wrote: Chamambo Martin wrote: Sometimes when I access the web URL where FreeIPA is installed for general administration ,I encounter this error below. Runtime error Web UI got in unrecoverable state during metadata phase I can only restore access

[Freeipa-users] group membership listing?

2015-04-21 Thread Janelle
Hello - and happy day before Earth Day, Perhaps this is an easy one and related to replication, BUT: $ id some-user-name If I run that on every IPA master, should the listing not be identical? In other words, the listing of the uid, gid and groups, should show up in exactly the same order?