Re: [Freeipa-users] User AD can not Login Client Linux

2015-08-28 Thread Lukas Slebodnik
On (23/08/15 17:53), alireza baghery wrote: Hi i install Centos 7.1 (IDM Server) and integrate with Windows SERVER 2008 R2 Trust USER AD can not Login on client (OLE 6.6) but User create idm can login name IDM SERVER= ipasrv.l.infotechpsp.net domain Windows = infotechpsp.net i execute [ kinit

Re: [Freeipa-users] stubborn old replicas

2015-08-28 Thread Vaclav Adamec
You could try this (RH recommended way). It works for me better than cleanallruv.pl as this sometimes leads to ldap freeze) unable to decode: {replica 30} 5548fa20001e 5548fa20001e unable to decode: {replica 26} 5548a9a8001a 5548a9a8001a for all of them,

Re: [Freeipa-users] Using IPA CA to sign SSL client certificates

2015-08-28 Thread Ian Pilcher
On 08/28/2015 10:41 AM, Jan Pazdziora wrote: That's new feature in FreeIPA 4.2: http://www.freeipa.org/page/V4/User_Certificates I'm glad to see that's being added. I have IPA 3.0 on CentOS 6 (on a 32-bit system), so I won't be able to use that feature. I'm basically asking if

Re: [Freeipa-users] ssh_exchange_identification: Connection closed by remote host

2015-08-28 Thread Sumit Bose
On Fri, Aug 28, 2015 at 05:10:31PM +0200, Roberto Cornacchia wrote: Hi, I have two hosts, photon and hadron, and an LDAP user roberto. The user can login successfully on both machines. The SSH pub key is uploaded . Running sss_ssh_authorizedkeys roberto from both clients returns the same

Re: [Freeipa-users] Using IPA CA to sign SSL client certificates

2015-08-28 Thread Ian Pilcher
On 08/28/2015 10:35 AM, Alexander Bokovoy wrote: This is all explained in the official guide: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/service-certificates.html I guess I should have been more clear. I

[Freeipa-users] ssh_exchange_identification: Connection closed by remote host

2015-08-28 Thread Roberto Cornacchia
Hi, I have two hosts, photon and hadron, and an LDAP user roberto. The user can login successfully on both machines. The SSH pub key is uploaded . Running sss_ssh_authorizedkeys roberto from both clients returns the same key. Port 22 is open on both clients, sshd is running on both clients. On

Re: [Freeipa-users] Using IPA CA to sign SSL client certificates

2015-08-28 Thread Alexander Bokovoy
On Fri, 28 Aug 2015, Ian Pilcher wrote: On 08/28/2015 10:35 AM, Alexander Bokovoy wrote: This is all explained in the official guide: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/service-certificates.html I

Re: [Freeipa-users] Failed to start pki-tomcatd Service

2015-08-28 Thread Alexandre Ellert
Le 28 août 2015 à 17:41, Alexander Bokovoy aboko...@redhat.com a écrit : On Fri, 28 Aug 2015, Alexandre Ellert wrote: Le 28 août 2015 à 17:09, Alexander Bokovoy aboko...@redhat.com a écrit : On Wed, 26 Aug 2015, Alexandre Ellert wrote: Le 28 juil. 2015 à 05:59, Alexander Bokovoy

Re: [Freeipa-users] Failed to start pki-tomcatd Service

2015-08-28 Thread Alexander Bokovoy
On Wed, 26 Aug 2015, Alexandre Ellert wrote: Le 28 juil. 2015 à 05:59, Alexander Bokovoy aboko...@redhat.com a écrit : If the problem is too hard to solve, maybe I should try to deploy another replica ? You may try that. Sorry for not responding, I have some other tasks that occupy my time

[Freeipa-users] Using IPA CA to sign SSL client certificates

2015-08-28 Thread Ian Pilcher
I need to create a few client certificates, and I'd like to use my pre- existing IPA CA. Is there a simple way to do this? Thanks! -- Ian Pilcher arequip...@gmail.com I

Re: [Freeipa-users] Failed to start pki-tomcatd Service

2015-08-28 Thread Alexandre Ellert
Le 28 août 2015 à 17:09, Alexander Bokovoy aboko...@redhat.com a écrit : On Wed, 26 Aug 2015, Alexandre Ellert wrote: Le 28 juil. 2015 à 05:59, Alexander Bokovoy aboko...@redhat.com a écrit : If the problem is too hard to solve, maybe I should try to deploy another replica ? You may try

Re: [Freeipa-users] Using IPA CA to sign SSL client certificates

2015-08-28 Thread Alexander Bokovoy
On Fri, 28 Aug 2015, Ian Pilcher wrote: I need to create a few client certificates, and I'd like to use my pre- existing IPA CA. Is there a simple way to do this? This is all explained in the official guide:

Re: [Freeipa-users] Using IPA CA to sign SSL client certificates

2015-08-28 Thread Jan Pazdziora
On Fri, Aug 28, 2015 at 10:38:46AM -0500, Ian Pilcher wrote: On 08/28/2015 10:35 AM, Alexander Bokovoy wrote: This is all explained in the official guide:

Re: [Freeipa-users] Failed to start pki-tomcatd Service

2015-08-28 Thread Alexander Bokovoy
On Fri, 28 Aug 2015, Alexandre Ellert wrote: Le 28 août 2015 à 17:09, Alexander Bokovoy aboko...@redhat.com a écrit : On Wed, 26 Aug 2015, Alexandre Ellert wrote: Le 28 juil. 2015 à 05:59, Alexander Bokovoy aboko...@redhat.com a écrit : If the problem is too hard to solve, maybe I should

Re: [Freeipa-users] stubborn old replicas

2015-08-28 Thread Guillermo Fuentes
Hi Janelle, Using the cleanallruv.pl tool was the only way I was able to get ride of the unable to decode: {replica x} entries. This is how I used it, cleaning a replica ID at a time: # For replica id: 40 cleanallruv.pl -v -D cn=directory manager -w - -b 'dc=example,dc=com' -r 40 Note that the

Re: [Freeipa-users] ssh_exchange_identification: Connection closed by remote host

2015-08-28 Thread Alexander Bokovoy
On Fri, 28 Aug 2015, Roberto Cornacchia wrote: Hi, I have two hosts, photon and hadron, and an LDAP user roberto. The user can login successfully on both machines. The SSH pub key is uploaded . Running sss_ssh_authorizedkeys roberto from both clients returns the same key. Port 22 is open on

[Freeipa-users] certificate renewal stuck

2015-08-28 Thread Mike LoSapio
Hey there - I¹m working a FreeIPA box (ipa-server-3.0.0-42) - Our original PKI ³master² was nuked a while ago and I have a suspicion that none of the other ³master² freeipa replicas were ³promoted² (sorry for the over-use of ³ ) So we went ahead and ran through these instructions and are

Re: [Freeipa-users] certificate renewal stuck

2015-08-28 Thread Mike LoSapio
I suspect that was the issue - Of course moved on to something else (hostname removed) Request ID '20140520151448': status: CA_UNREACHABLE ca-error: Server at https://ldapserver/ipa/xml failed request, will retry: 4301 (RPC failed at server. Certificate operation cannot be

Re: [Freeipa-users] Troubles with extending FreeIPA Web UI to fit my environment

2015-08-28 Thread Mateusz Małek
W dniu 27.08.2015 o 15:18, Rob Crittenden pisze: Mateusz Małek wrote: We're trying to adjust FreeIPA to our environment... quite a bit. Here are some bullet points: (...) 3. Passwords need to be generated automatically, so user administrator won't be required to invent them for every single