Re: [Freeipa-users] HBAC

2015-09-29 Thread Alexander Bokovoy
On Tue, 29 Sep 2015, TomK wrote: Hey Guy's, (Sending this again as I didn't have this email included in the freeipa-users mailing list so not sure if the other message will get posted.) Before I post a ticket to RH Support for an RFE, I'll post the request here to get some feedback on optio

[Freeipa-users] HBAC

2015-09-29 Thread TomK
Hey Guy's, (Sending this again as I didn't have this email included in the freeipa-users mailing list so not sure if the other message will get posted.) Before I post a ticket to RH Support for an RFE, I'll post the request here to get some feedback on options and what ideas folks have. I'v

[Freeipa-users] Antwort: Re: sudo options/sss_cache

2015-09-29 Thread Christoph Kaminski
oh thx! it would be really nice to have it... Greetz Christoph Kaminski Pavel Březina schrieb am 29.09.2015 13:48:14: > > Hi, I filed a ticket: > https://fedorahosted.org/freeipa/ticket/5332 -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listi

Re: [Freeipa-users] NFS Automount Domain Homedirs

2015-09-29 Thread Alexander Bokovoy
On Tue, 29 Sep 2015, Sadettin Albasan wrote: I have a freeipa server and a trust relation with AD domain with almost everything working the way I planned except automounting NFS home directories for domain users. I have been reading about this on the net for almost a week, ended up trying a lot o

[Freeipa-users] NFS Automount Domain Homedirs

2015-09-29 Thread Sadettin Albasan
I have a freeipa server and a trust relation with AD domain with almost everything working the way I planned except automounting NFS home directories for domain users. I have been reading about this on the net for almost a week, ended up trying a lot of different configurations, but I had no succes

Re: [Freeipa-users] FreeIPA with third-party wildcard certificate

2015-09-29 Thread Rob Crittenden
Brian Mathis wrote: > No. FreeIPA requires a *CA* certificate, which is a cert that has the > ability to sign other certs. Unless you're in a large company with an > expensive agreement in place with GoDaddy, that is not a permission they > grant to regular certs. A wildcard cert is only allowed

Re: [Freeipa-users] password resets - errors

2015-09-29 Thread Janelle
On 9/28/15 11:33 AM, Rob Crittenden wrote: Simo Sorce wrote: On 27/09/15 09:21, Janelle wrote: Hello, I continue to see these a lot, but only on some servers. It causes a lot of confusions with my users. There must be a way to troubleshoot this and find the issue. Also, there is nothing wrong

Re: [Freeipa-users] FreeIPA with third-party wildcard certificate

2015-09-29 Thread Brian Mathis
No. FreeIPA requires a *CA* certificate, which is a cert that has the ability to sign other certs. Unless you're in a large company with an expensive agreement in place with GoDaddy, that is not a permission they grant to regular certs. A wildcard cert is only allowed to be used on simple things

Re: [Freeipa-users] rhel 6.7 upgrade - sssd/sudo

2015-09-29 Thread Pavel Březina
On 09/21/2015 10:42 PM, Andy Thompson wrote: On Mon, Sep 21, 2015 at 07:39:01PM +, Andy Thompson wrote: -Original Message- From: Jakub Hrozek [mailto:jhro...@redhat.com] Sent: Monday, September 21, 2015 3:29 PM To: Andy Thompson Cc: freeipa-users@redhat.com; pbrez...@redhat.com Subj

Re: [Freeipa-users] Sudo entry not found by sssd in the cache db

2015-09-29 Thread Pavel Březina
On 09/15/2015 09:10 AM, Molnár Domokos wrote: "Molnár Domokos" írta: On 09/14/2015 03:08 PM, Pavel Březina wrote: On 09/11/2015 02:40 PM, Molnár Domokos wrote: Full log attached. "Molnár Domokos" írta: "Pavel Březina" írta: On 09/09/2015 09:31 PM, Mol

Re: [Freeipa-users] sudo options/sss_cache

2015-09-29 Thread Pavel Březina
On 09/25/2015 01:12 PM, Jakub Hrozek wrote: On Fri, Sep 25, 2015 at 11:48:27AM +0200, Pavel Březina wrote: On 09/25/2015 10:06 AM, Jakub Hrozek wrote: On Thu, Sep 24, 2015 at 03:39:48PM +0200, Christoph Kaminski wrote: Hi I have 3 problems/questions with ipa and sudo... 1. How to make a GLOB

[Freeipa-users] FreeIPA with third-party wildcard certificate

2015-09-29 Thread Srdjan Dutina
Hi! I'm testing FreeIPA 4.1.0 on Centos 7 (1503). I have a *wildcard *certificate for my domain issued by GoDaddy. Could I use it with FreeIPA primary and replica servers instead of self-signed certificate? If yes, how could I replace the self-signed certificate in existing two servers installatio

Re: [Freeipa-users] otp issue: can't log in with password+otp

2015-09-29 Thread Jan Pazdziora
On Mon, Sep 21, 2015 at 04:49:42PM -0600, Duncan McNaught wrote: > Dear freeipa-users, > > I'm having an issue with otp in freeipa. I can set up the service as > described in the blog post for TOTP or HOTP, and sync the token fine. > When I try to login to the admin tools or an ipa-managed client