[Freeipa-users] Announcing FreeIPA 4.1.3

2015-02-25 Thread Petr Vobornik
The FreeIPA team would like to announce FreeIPA v4.1.3 bug fix release! It can be downloaded from http://www.freeipa.org/page/Downloads . Fedora 21 builds are already on their way to updates-testing repository. Builds for Fedora 20 are available in the official COPR repository

[Freeipa-users] AD sync via polling?

2015-02-25 Thread Janne Blomqvist
Hi, is it possible to use winsync to sync stuff from AD without having to create domain trusts, or install some kind of sync services on the AD DC's? For some background, we want to fetch user/group info and authenticate against AD (managed by another department), but we also have a need to

Re: [Freeipa-users] AD sync via polling?

2015-02-25 Thread Dmitri Pal
On 02/25/2015 07:44 AM, Janne Blomqvist wrote: Hi, is it possible to use winsync to sync stuff from AD without having to create domain trusts, or install some kind of sync services on the AD DC's? For some background, we want to fetch user/group info and authenticate against AD (managed by

Re: [Freeipa-users] AD sync via polling?

2015-02-25 Thread Rich Megginson
On 02/25/2015 06:48 AM, Dmitri Pal wrote: On 02/25/2015 07:44 AM, Janne Blomqvist wrote: Hi, is it possible to use winsync to sync stuff from AD without having to create domain trusts, or install some kind of sync services on the AD DC's? For some background, we want to fetch user/group

[Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Hugh
All, We're running ipa-server-3.0.0-42/389-ds-base-1.2.11.15-48 on CentOS 6.5. We've set up synching between our IPA and AD and that seems to be working. What we'd like to do now is allow admins when they're creating users in IPA to be able to set those users up for synching to AD with the web UI

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Petr Vobornik
On 02/25/2015 09:12 AM, Hugh wrote: All, We're running ipa-server-3.0.0-42/389-ds-base-1.2.11.15-48 on CentOS 6.5. We've set up synching between our IPA and AD and that seems to be working. What we'd like to do now is allow admins when they're creating users in IPA to be able to set those users

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Endi Sukma Dewata
On 2/25/2015 6:35 PM, Martin Kosek wrote: yum -y remove pki-selinux pki-ca pki-common pki-setup pki-silent pki-java-tools pki-symkey pki-util pki-native-tools ipa-server-selinux ipa-server ipa-client ipa-admintools ipa-python ipa-pki-ca-theme ipa-pki-common-theme 389-ds-base 389-ds-base-libs

Re: [Freeipa-users] Forward first not working

2015-02-25 Thread Shaun Martin
Hi Martin, The zone name is the following for both servers. Zone name: 1.10.in-addr.arpa. I am using zone forwarders. With forward first enabled though it should try and return an answer from the local DNS, it clearly does not though. The only time I receive the local record is when

[Freeipa-users] Forward first not working

2015-02-25 Thread Shaun Martin
Hi, I am having an issue with the forward first not appear to be working. I have two separate IPA servers that server separate realms. I have for the reverse zone configured forwarders to point to the other realms IPA server. All versions are identical on the IPA servers. I have included

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Dmitri Pal
On 02/25/2015 09:53 AM, Petr Vobornik wrote: On 02/25/2015 09:12 AM, Hugh wrote: All, We're running ipa-server-3.0.0-42/389-ds-base-1.2.11.15-48 on CentOS 6.5. We've set up synching between our IPA and AD and that seems to be working. What we'd like to do now is allow admins when they're

Re: [Freeipa-users] Forward first not working

2015-02-25 Thread Martin Basti
On 25/02/15 17:59, Shaun Martin wrote: Hi, I am having an issue with the forward first not appear to be working. I have two separate IPA servers that server separate realms. I have for the reverse zone configured forwarders to point to the other realms IPA server. All versions are identical

[Freeipa-users] [Solaris 10] Cannot login through console or ssh with ipa users

2015-02-25 Thread nathan
I am having trouble logging in with an IPA user on Solaris 10. The machine is able to correctly initialize tickets using kinit. The issue appears to be PAM related. I am using FreeIPA 4.1.3. I have tried to follow the instructions here as best I can :

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Hugh
On 2/25/2015 11:02 AM, Dmitri Pal wrote: But let us step back and ask the question why do you need to create the users you sync manually first? The users in a specific OU will be synced anyways without you manually creating them in IPA. So this is unclear why the whole thing is actually

Re: [Freeipa-users] Forward first not working

2015-02-25 Thread Martin Basti
On 25/02/15 18:51, Shaun Martin wrote: Hi Martin, The zone name is the following for both servers. Zone name: 1.10.in-addr.arpa. I am using zone forwarders. With forward first enabled though it should try and return an answer from the local DNS, it clearly does not though. The only

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Dmitri Pal
On 02/25/2015 01:22 PM, Hugh wrote: On 2/25/2015 11:02 AM, Dmitri Pal wrote: But let us step back and ask the question why do you need to create the users you sync manually first? The users in a specific OU will be synced anyways without you manually creating them in IPA. So this is unclear why

Re: [Freeipa-users] [Solaris 10] Cannot login through console or ssh with ipa users

2015-02-25 Thread Dmitri Pal
On 02/25/2015 02:58 PM, nat...@nathanpeters.com wrote: I am having trouble logging in with an IPA user on Solaris 10. The machine is able to correctly initialize tickets using kinit. The issue appears to be PAM related. I am using FreeIPA 4.1.3. I have tried to follow the instructions here

[Freeipa-users] [SSSD] default_domain_suffix breaks IPA user logins

2015-02-25 Thread nathan
FreeIPA Server 4.1.2 FreeIPA client 3.0.0-42 I'm not sure how to go about fixing this or working around it. In our organization we have a trust relationship between ad.somedomain.net and ipadomain.net. We don't want our AD users having to type usern...@ad.somedomain.net when logging in to an

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Dmitri Pal
On 02/25/2015 02:15 PM, Hugh wrote: On 2/25/2015 12:50 PM, Dmitri Pal wrote: Will all users created via IPA interface synched to AD? Is there any harm to make all users be created with the attributes mentioned earlier in this thread? Almost all. We have some users that will be role accounts

Re: [Freeipa-users] [Solaris 10] Cannot login through console or ssh with ipa users

2015-02-25 Thread nathan
It does not seem to recognize the user in the secan attempt but the first attempt seems to authenticate and then disconnect. I do not see trace from accounting session but I suspect that your pam stack does not authorize authenticated user. Try to allow all authenticated users first. This

Re: [Freeipa-users] [SSSD] default_domain_suffix breaks IPA user logins

2015-02-25 Thread Jakub Hrozek
On Wed, Feb 25, 2015 at 12:11:10PM -0800, nat...@nathanpeters.com wrote: FreeIPA Server 4.1.2 FreeIPA client 3.0.0-42 I'm not sure how to go about fixing this or working around it. In our organization we have a trust relationship between ad.somedomain.net and ipadomain.net. We don't

Re: [Freeipa-users] [SSSD] default_domain_suffix breaks IPA user logins

2015-02-25 Thread nathan
On Wed, Feb 25, 2015 at 12:11:10PM -0800, nat...@nathanpeters.com wrote: FreeIPA Server 4.1.2 FreeIPA client 3.0.0-42 I'm not sure how to go about fixing this or working around it. In our organization we have a trust relationship between ad.somedomain.net and ipadomain.net. We don't

Re: [Freeipa-users] [Solaris 10] Cannot login through console or ssh with ipa users

2015-02-25 Thread nathan
It does not seem to recognize the user in the secan attempt but the first attempt seems to authenticate and then disconnect. I do not see trace from accounting session but I suspect that your pam stack does not authorize authenticated user. Try to allow all authenticated users first. This

Re: [Freeipa-users] 2-Factor and services

2015-02-25 Thread Steven Jones
Hi, So pass authentication to a RSA radius server and key fobs? Looks like RHEL7.1 can do this, I am waiting for its release to do just this. regards Steven Jones B.Eng (Hons) Technical Specialist - Linux RHCE Victoria University ITS, Level 8 Rankin Brown Building, Wellington, NZ 6012

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Les Stott
-Original Message- From: Martin Kosek [mailto:mko...@redhat.com] Sent: Wednesday, 25 February 2015 10:35 PM To: Les Stott; Rob Crittenden; freeipa-users@redhat.com; Endi Dewata; Jan Cholasta Subject: Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED On

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Endi Sukma Dewata
On 2/26/2015 8:02 AM, Les Stott wrote: rm -rf /etc/pki-ca /var/lib/pki-ca /var/log/pki-ca /etc/certmonger /etc/sysconfig/pki-ca /etc/sysconfig/pki /var/run/pki-ca.pid /usr/share/pki /etc/ipa /var/log/ipa* reboot Now you have a clean slate. Do you know which step of the steps above actually

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Hugh
On 2/25/2015 3:11 PM, Dmitri Pal wrote: I think you can start with adding ntUser object class into the list of the object classes in the IPA configuration in UI. That would apply it to the new entries automatically. How is that done? I'd rather not have to tweak the package files, since that

Re: [Freeipa-users] [Solaris 10] Cannot login through console or ssh with ipa users

2015-02-25 Thread Dmitri Pal
On 02/25/2015 04:37 PM, nat...@nathanpeters.com wrote: It does not seem to recognize the user in the secan attempt but the first attempt seems to authenticate and then disconnect. I do not see trace from accounting session but I suspect that your pam stack does not authorize authenticated user.

[Freeipa-users] 2-Factor and services

2015-02-25 Thread Matt Wells
I've got many of users setup with 2-Factor and I'd like to enforce it with some services. For example. Server vpn.example.com is an openvpn servers setup to use PAM. Since he's tied to my 4.X IDM servers I can use 2-Factor with him. However I want to enforce that users from this system/service

Re: [Freeipa-users] Web UI plugins or other extensions

2015-02-25 Thread Dmitri Pal
On 02/25/2015 05:39 PM, Hugh wrote: On 2/25/2015 3:11 PM, Dmitri Pal wrote: I think you can start with adding ntUser object class into the list of the object classes in the IPA configuration in UI. That would apply it to the new entries automatically. How is that done? I'd rather not have to

Re: [Freeipa-users] 2-Factor and services

2015-02-25 Thread Dmitri Pal
On 02/25/2015 04:54 PM, Matt Wells wrote: I've got many of users setup with 2-Factor and I'd like to enforce it with some services. For example. Server vpn.example.com http://vpn.example.com is an openvpn servers setup to use PAM. Since he's tied to my 4.X IDM servers I can use 2-Factor with

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Les Stott
-Original Message- From: Endi Sukma Dewata [mailto:edew...@redhat.com] Sent: Thursday, 26 February 2015 1:50 AM To: Martin Kosek Cc: Les Stott; Rob Crittenden; freeipa-users@redhat.com; Jan Cholasta Subject: Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

Re: [Freeipa-users] ipa-getcert list fails to report correctly - RESOLVED

2015-02-25 Thread Martin Kosek
On 02/25/2015 03:11 AM, Les Stott wrote: -Original Message- From: freeipa-users-boun...@redhat.com [mailto:freeipa-users- boun...@redhat.com] On Behalf Of Les Stott Sent: Monday, 23 February 2015 8:01 PM To: Rob Crittenden; Martin Kosek; freeipa-users@redhat.com; Endi Dewata; Jan