Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Rob Crittenden
"Răzvan Corneliu C.R. VILT" wrote: Hi Guys, I've done a small scale demo of using FreeIPA instead of an Open Directory Server to serve Apple OS X clients. This is based on my experiences from one year ago (Ticket #4813). I've also attached some screenshots. This is very cool and excellent

Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Alexander Bokovoy
On Thu, 04 Feb 2016, "Răzvan Corneliu C.R. VILT" wrote: On 4 feb. 2016, at 12:16, Rob Crittenden wrote: This is very cool and excellent work! Thanks. I've done most of the R 1 year ago for a client that has a medium Mac-only network. Since a year passed, I wanted to

Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Răzvan Corneliu C.R. VILT
>> It is probably best to stick with the Apple schema otherwise there could be >> pain later if something changes, requiring additional mapping. > > I wouldn't encourage it for two reasons: > 1) The Apple schema is designed to be remapped to any other schema. That's > the point of cn=config.

Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Răzvan Corneliu C.R. VILT
> On 4 feb. 2016, at 12:16, Rob Crittenden wrote: > This is very cool and excellent work! Thanks. I've done most of the R 1 year ago for a client that has a medium Mac-only network. Since a year passed, I wanted to share my results in order make sure that the information

Re: [Freeipa-users] client/authentication inside a docker container

2016-02-04 Thread Nordgren, Bryce L -FS
An RHEL 7 host filesystem may have the same basic structure as an Ubuntu trusty container filesystem, but may have different users defined, particularly for running services and for owning the files those services must touch. To what extent do you want the same users to be enforced between the

Re: [Freeipa-users] client/authentication inside a docker container

2016-02-04 Thread Prasun Gera
On Thu, Feb 4, 2016 at 4:23 PM, Nordgren, Bryce L -FS wrote: > An RHEL 7 host filesystem may have the same basic structure as an Ubuntu > trusty container filesystem, but may have different users defined, > particularly for running services and for owning the files those

Re: [Freeipa-users] ca install fails upgrading to 4.2.0

2016-02-04 Thread Robert van Veelen
I reran the replica-install and interrupted the script to set debug=1. The debug log didn't change very much at startup since the failure seems to occur already in the pre-start selftest. So it is still the same "java.lang.Exception: SystemCertsVerification: system certs verification failure"

[Freeipa-users] Using external certificate in IPA 4.1

2016-02-04 Thread Ossi Ahosalmi
I'm trying to use our organizations wildcard certificate in IPA. Certificate is signed by a trusted CA. Running: ipa-server-certinstall -w -d with next combinations: - separate .key, .crt and ca chain, all in PEM format - .crt and ca bundled into one file, .key as a separate file -

Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Răzvan Corneliu C.R. VILT
>> It's static data. It's a concatenation of multiple strings: a >> hard-coded one, the uid and the realm. It only changes if you rename >> the user account. It is used to route the authn phase to the Kerberos >> account (no PAM configuration!!!). > I wonder if we should use CoS plugin to get

[Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Rob Verduijn
Hello, I've noticed that the sudorule-add-runasuser no longer has en --external option What is the current method to add a local service account to a sud rule list so that users may run sudo as that service account (ie apache or jboss) Cheers Rob Verudijn -- Manage your subscription for the

Re: [Freeipa-users] Client Host isn't picking up the idduseroverrides

2016-02-04 Thread Jakub Hrozek
On Wed, Feb 03, 2016 at 11:10:50PM +, Simpson Lachlan wrote: > When my users log into the IPA server, the id user over rides work. > > But they don't when we log into a client host? > > What are we doing wrong? > > The overrides are in the "Default Trust View" so should be applied to all >

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Rob Verduijn
On Centos7.2 all patches applied I used the command: ipa-client-install --enable-dns-updates Rob 2016-02-04 16:45 GMT+01:00 Jakub Hrozek : > On Thu, Feb 04, 2016 at 03:52:25PM +0100, Rob Verduijn wrote: >> Hello, >> >> I've noticed that the sudorule-add-runasuser no longer

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Rob Verduijn
That does seem to work for me as well, however I can only add the external user via the web-gui Any idea how to do this with the command line tools ? Rob Verduijn 2016-02-04 17:00 GMT+01:00 Baird, Josh : > Actually, I use local (external) users in my sudo rules in IPA 4.2

[Freeipa-users] IPA-AD Login

2016-02-04 Thread Alan P
Hi, I just configured a trust between an IPA and an Active Directory to authenticate IPA users in Windows machines joined in AD domain. The login is successfull, but only after several minutes (nearly 25 minutes) in the first attempt; in the next attempts, the required time goes from 5 to 10

[Freeipa-users] [freeipa-users] How to manage Linux attributes for AD users (e.g. how do I set a shell for an AD User)

2016-02-04 Thread Jon
Hello, How does one manage linux attributes for AD users. Primarily in my case, I'm looking to change the default shell to either Bash or KSH depending on the user. I can create a .profile that either sources bash or ksh rcs... e.g.: >> $ cat ~/.profile >> bash ./.bashrc This is really less

Re: [Freeipa-users] [freeipa-users] How to manage Linux attributes for AD users (e.g. how do I set a shell for an AD User)

2016-02-04 Thread Baird, Josh
For AD users, I believe you have two options. 1) Set the POSIX value on the user in AD for the shell 2) Set the following in your client's sssd.conf: [nss] override_shell = /bin/bash This would obviously be global per IPA client. Josh From: freeipa-users-boun...@redhat.com

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Rob Verduijn
hi all, I tried and figured it out.. ipa sudorule-add-runasuser --users= Is the command syntax I was looking for. I guess that if the --users isn't an ipa user it is automatically flagged as an external user. Cheers Rob Verduijn 2016-02-04 17:33 GMT+01:00 Jakub Hrozek

Re: [Freeipa-users] Using external certificate in IPA 4.1

2016-02-04 Thread Martin Kosek
On 02/03/2016 06:02 PM, Ossi Ahosalmi wrote: > I'm trying to use our organizations wildcard certificate in IPA. Certificate > is > signed by a trusted CA. > > Running: > ipa-server-certinstall -w -d > > with next combinations: > > - separate .key, .crt and ca chain, all in PEM format > - .crt

Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Alexander Bokovoy
On Thu, 04 Feb 2016, "Răzvan Corneliu C.R. VILT" wrote: It's static data. It's a concatenation of multiple strings: a hard-coded one, the uid and the realm. It only changes if you rename the user account. It is used to route the authn phase to the Kerberos account (no PAM configuration!!!). I

Re: [Freeipa-users] Apple OpenDirectory Integration

2016-02-04 Thread Mauricio Tavares
I have a few Macs with 10.7 (mini) and 10.9 (MB air). Let me know if I can help using them as guinea piggies On Thu, Feb 4, 2016 at 11:57 AM, Alexander Bokovoy wrote: > On Thu, 04 Feb 2016, "Răzvan Corneliu C.R. VILT" wrote: >> >> It's static data. It's a concatenation

[Freeipa-users] client/authentication inside a docker container

2016-02-04 Thread Prasun Gera
I am trying to set up a docker image with a specific development environment. We use idm 4.2 for authentication, and non-kerberized nfs (including home) for data storage on the hosts. The goal is to run the docker container such that when the user calls docker run, it just drops into a shell with

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Baird, Josh
Actually, I use local (external) users in my sudo rules in IPA 4.2 with no problem. Example: Rule name: TestDBAs Description: access for members of the TestDBAs group Enabled: TRUE Command category: all User Groups: testdbas Host Groups: corp_oracle RunAs External User: oracle In

[Freeipa-users] OS migration from Fedora to CentOS?

2016-02-04 Thread Christophe TREFOIS
Hi all, We are currently running a 3-replica (all are setup with the —setup-ca flag) cluster on Fedora 21, with FreeIPA 4.1.4. We would like to slowly upgrade to the new version and move away from Fedora to CentOS 7.2. We were thinking of the following: - Create 3 CentOS machines with

[Freeipa-users] [freeipa-users] Configuring Automount on Ubuntu Clients

2016-02-04 Thread Jon
Hello, How do I configure automount for Ubuntu 14.04 clients? My procedure on CentOS has been: install free-ipa client, run ipa-client-install (auto configures with dns discovery), run ipa-client-automount. However, when I run this on the ubuntu client, I receive the following errors: >>

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Baird, Josh
Yeah, this seems strange: --externaluser=STRExternal User the rule applies to (sudorule-find only) --runasexternaluser=STR External User the commands can run as (sudorule-find only) --runasexternalgroup=STR External

Re: [Freeipa-users] client/authentication inside a docker container

2016-02-04 Thread Jan Pazdziora
On Thu, Feb 04, 2016 at 10:19:16AM -0500, Prasun Gera wrote: > I am trying to set up a docker image with a specific development > environment. We use idm 4.2 for authentication, and non-kerberized nfs > (including home) for data storage on the hosts. Are the hosts IPA-enrolled? > The goal is to

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Jakub Hrozek
On Thu, Feb 04, 2016 at 03:52:25PM +0100, Rob Verduijn wrote: > Hello, > > I've noticed that the sudorule-add-runasuser no longer has en --external > option > > What is the current method to add a local service account to a sud > rule list so that users may run sudo as that service account (ie

Re: [Freeipa-users] what is the sudo rule runasuser local user account

2016-02-04 Thread Jakub Hrozek
On Thu, Feb 04, 2016 at 04:00:50PM +, Baird, Josh wrote: > Actually, I use local (external) users in my sudo rules in IPA 4.2 with no > problem. > > Example: > > Rule name: TestDBAs > Description: access for members of the TestDBAs group > Enabled: TRUE > Command category: all >

Re: [Freeipa-users] client/authentication inside a docker container

2016-02-04 Thread Prasun Gera
On Thu, Feb 4, 2016 at 10:56 AM, Jan Pazdziora wrote: > On Thu, Feb 04, 2016 at 10:19:16AM -0500, Prasun Gera wrote: > > I am trying to set up a docker image with a specific development > > environment. We use idm 4.2 for authentication, and non-kerberized nfs > >

[Freeipa-users] IPA 4.2: pki-tomcatd in terrible shape

2016-02-04 Thread Timothy Geier
Greetings all, For the record,this is a CentOS 7.2 box with all current patches. (ipa-server-4.2.0-15.el7.centos.3.x86_64, etc.) The situation is that pki-tomcatd on the lone CA server in our IPA cluster refuses to start cleanly. The issues started earlier this week after the certs

Re: [Freeipa-users] Sudo privilege inheritance in FreeIPA (3.0.x branch)

2016-02-04 Thread sysadmin ofdoom
Note: sudo rule "testSudo" fails when using user group. But succeeds when using a directly defined user. sudo rule "sudo-1" fails when user defined directly, but hosts are defined with host group. The behaviour that I'm observing is: sudo rules are not functioning any time the user or

Re: [Freeipa-users] [freeipa-users] How to manage Linux attributes for AD users (e.g. how do I set a shell for an AD User)

2016-02-04 Thread Jon
Hi Josh, I think that's exactly the problem though, how does one set POSIX attributes in AD from Linux guests? The RedHat documentation has a big warning that the Microsoft IDMU has been deprecated. >>

Re: [Freeipa-users] PKINIT support in FreeIPA 4.2.0

2016-02-04 Thread Nik Lam
On Wed, Feb 3, 2016 at 8:08 PM, Sumit Bose wrote: > On Wed, Feb 03, 2016 at 10:29:49AM +1100, Nik Lam wrote: > > Hello, > > > > I installed ipa-server on Centos 7.1 and later did and upgrade of the > whole > > system to Centos 7.2. > > > > I think the FreeIPA version changed

Re: [Freeipa-users] Obtaining certificate private keys for Apache/etc.

2016-02-04 Thread Rob Crittenden
Christopher Young wrote: Thanks. That's good advice and good to know. I'm going to be trying to work this into an Ansible role, so having a command listing helps alot. That leads to a curious question if anyone has thought about building an Ansible module(s) for manipulating FreeIPA objects.