Re: [Freeipa-users] 3.0.0-42 Replication issue after Centos6.5->6.6 upgrade

2014-12-15 Thread dbischof
Hi, On Tue, 25 Nov 2014, Rich Megginson wrote: On 11/25/2014 12:32 PM, dbisc...@hrz.uni-kassel.de wrote: with the help of Thierry and Rich I managed to debug the running ns-slapd on Server1 (see below). The failing attempt of decoding the SASL data returns a not very fruitful "-1" (SASL_FAI

Re: [Freeipa-users] Replica Setup Issue

2014-12-15 Thread dbischof
Hi Matt, I ran into this a couple of months ago. I ended up creating the replica without "--setup-ca" which first appeared to work, but then it turned out that replication is (at least for me) broken, cf. Ticket #4807 (https://fedorahosted.org/freeipa/ticket/4807). On Fri, 12 Dec 2014, Matt

Re: [Freeipa-users] 3.0.0-42 Replication issue after Centos6.5->6.6 upgrade

2014-12-15 Thread Martin Kosek
On 12/15/2014 10:16 AM, dbisc...@hrz.uni-kassel.de wrote: > Hi, > > On Tue, 25 Nov 2014, Rich Megginson wrote: > >> On 11/25/2014 12:32 PM, dbisc...@hrz.uni-kassel.de wrote: >>> >>> with the help of Thierry and Rich I managed to debug the running ns-slapd on >>> Server1 (see below). The failing a

[Freeipa-users] freeipa server 4.1 with ipa client 2.2

2014-12-15 Thread Chris Card
Should a machine running ipa client version 2.2 (because it's running Centos 6.3) be able to work with a freeipa server version 4.1?The ipa-client-install script works ok and I see client machine listed as one of the hosts in the freeipa admin gui, but I'm not sure if the version of sssd running

Re: [Freeipa-users] Forest trust and AD child domain

2014-12-15 Thread Sumit Bose
On Sat, Dec 13, 2014 at 02:13:30PM +0100, Manuel Lopes wrote: > Hi, > > As explained in the previous email, the getent is successful. > > > *[root@support1 ~]# getent group 'ACME\Domain Users' domain > us...@acme.windows.com:*:**365600513:administra...@acme.windows.com > <365600513%3aadministra.

Re: [Freeipa-users] Forest trust and AD child domain

2014-12-15 Thread Manuel Lopes
The file sssd_linux.com.log is empty. 2014-12-15 15:42 GMT+01:00 Sumit Bose : > > On Sat, Dec 13, 2014 at 02:13:30PM +0100, Manuel Lopes wrote: > > Hi, > > > > As explained in the previous email, the getent is successful. > > > > > > *[root@support1 ~]# getent group 'ACME\Domain Users' domain >

Re: [Freeipa-users] Forest trust and AD child domain

2014-12-15 Thread Sumit Bose
On Mon, Dec 15, 2014 at 04:39:29PM +0100, Manuel Lopes wrote: > The file sssd_linux.com.log is empty. please add debug_level = 10 to the [domain/...] section in sssd.conf to enable logging for this part of SSSD. bye, Sumit > > > > 2014-12-15 15:42 GMT+01:00 Sumit Bose : > > > > On Sat, Dec 1

Re: [Freeipa-users] freeipa server 4.1 with ipa client 2.2

2014-12-15 Thread Dmitri Pal
On 12/15/2014 08:18 AM, Chris Card wrote: Should a machine running ipa client version 2.2 (because it's running Centos 6.3) be able to work with a freeipa server version 4.1? It should work. The ipa-client-install script works ok and I see client machine listed as one of the hosts in the free

Re: [Freeipa-users] Forest trust and AD child domain

2014-12-15 Thread Sumit Bose
On Mon, Dec 15, 2014 at 05:38:05PM +0100, Manuel Lopes wrote: > Attached the sssd_linux.com.log file > > Regards Thank you, there is no request logged in the logs, did you run ipa group-add-member after restarting SSSD? Nevertheless I think I know what is happening, you hit an issue which should

[Freeipa-users] strange problem - IPA related?

2014-12-15 Thread Janelle
Hi all.. Not sure if this is IPA related, but here it is: 1. IPA 4.1.2 install on CentOS 7 2. IPA 4.1.2 install on Fedora 21 So both systems are systemd based - the fedora system reboots in less than 30 seconds. The CentOS system reboots and has strange timers showing that it is waiting on va

Re: [Freeipa-users] strange problem - IPA related?

2014-12-15 Thread Dmitri Pal
On 12/15/2014 01:28 PM, Janelle wrote: Hi all.. Not sure if this is IPA related, but here it is: 1. IPA 4.1.2 install on CentOS 7 2. IPA 4.1.2 install on Fedora 21 So both systems are systemd based - the fedora system reboots in less than 30 seconds. The CentOS system reboots and has strange

[Freeipa-users] trust non-IPA certificate client

2014-12-15 Thread Stephen Ingram
I have one client using a certificate issued by a third party provider such that any secure (TLS) LDAP queries are refused since the certificates were not issued by IPA. Since there are only a few clients with foreign certificates, can the CA simply be added to the NSS database used by the 389 dire

Re: [Freeipa-users] strange problem - IPA related?

2014-12-15 Thread Janelle
Identical configurations on the same subnet - using same DNS resolvers.. Both host-based FWs disabled just because I thought that too. Time to do some more studying of systemd and all the dependencies. ~J On 12/15/14 4:34 PM, Dmitri Pal wrote: On 12/15/2014 01:28 PM, Janelle wrote: Hi all..

[Freeipa-users] Clients in multiple domains, any known issues?

2014-12-15 Thread Eivind Olsen
Hello. I have so far been running IPA on RHEL6, with a single domain (and a matching realm). I now have a use-case where it looks like I'll need to set up a new IPA realm, with the IPA servers in one DNS domain and the IPA clients in multiple (2-4) other domains. The servers will be running RHEL6