[Freeipa-users] Getting virtual aliases and domains via freeipa with Postfix

2012-10-30 Thread Peter Brown
Hi everyone, I have been trying to work out how to achieve this. I have freeipa 3.0.0 setup on a Fedora 18 server and I have postfix and dovecot on my new mail server authenticating against Freeipa. One last thing I would love to do it pull down the virtual users and aliases for the domains my

Re: [Freeipa-users] Getting virtual aliases and domains via freeipa with Postfix

2012-10-31 Thread Peter Brown
On 1 November 2012 15:07, Stephen Ingram sbing...@gmail.com wrote: On Wed, Oct 31, 2012 at 6:25 PM, Peter Brown rendhal...@gmail.com wrote: On 1 November 2012 08:20, Stephen Ingram sbing...@gmail.com wrote: On Tue, Oct 30, 2012 at 6:34 PM, Peter Brown rendhal...@gmail.com wrote: Hi

Re: [Freeipa-users] One time passwords - 2 factor

2012-11-29 Thread Peter Brown
On 30 November 2012 11:43, Rob Crittenden rcrit...@redhat.com wrote: Steven Jones wrote: Hi, Is it possible to use the freeipa API and and external program to do one time passwords? (password is sent by the external app, sms to smartphone). Not yet. The problem is lack of support in

Re: [Freeipa-users] Allow IPA users to create SSH tunnel with no shell

2012-12-16 Thread Peter Brown
Hi Albert, Have you tried putting that command in the public key for the user in freeipa and setting the user shell to /sbin/nologin or the equivalent? On 15 December 2012 02:09, Albert Adams bite...@gmail.com wrote: In our environment we have several systems where users require access to

Re: [Freeipa-users] Best OS to use with FreeIPA?

2013-01-20 Thread Peter Brown
On 19 January 2013 05:25, Brian Topping topp...@codehaus.org wrote: Hi Peter and Dimitri, Thanks for your responses. I think I am going to bite the bullet and put F18 into production. One of the elements that made that easier was recognizing that RHEL 7 was going to be based on Fedora of

Re: [Freeipa-users] Cannot obtain CA Certificate

2013-02-18 Thread Peter Brown
Hi John, I ran into a similar issue with setting up a 2.2 client with a 3.1 server. It turned out to be that port 80 wasn't open on the freeipa server. I would check your ports and see if the right ones are open. I also find that setting up the SRV and TXT records in your dns zone makes setting

Re: [Freeipa-users] Realm distrubuted across data centers

2013-03-12 Thread Peter Brown
I have no idea if this counts as best practice because I am not affiliated with the FreeIPA development team I personally think SRV records are probably the best idea in this situation. You would have to setup different zones to serve to each datacentre though if you know how to do that. It's not

Re: [Freeipa-users] LDAP authentication for 3rd party

2013-04-11 Thread Peter Brown
On 12 April 2013 05:04, John Dennis jden...@redhat.com wrote: On 04/11/2013 02:47 PM, Bartek Moczulski wrote: hi, I've got a problem with using IPA as authentication source over LDAP. Generally there are two approaches to LDAP authentication: 1. bind using admin account and read passwords

Re: [Freeipa-users] LDAP authentication for 3rd party

2013-04-12 Thread Peter Brown
to work properly. Slightly strange considering the ldap modules for all of them are the same as the one used in crowd. Regards Simon On 11 Apr 2013 23:36, Peter Brown rendhal...@gmail.com wrote: On 12 April 2013 05:04, John Dennis jden...@redhat.com wrote: On 04/11/2013 02:47 PM, Bartek

Re: [Freeipa-users] LDAP authentication for 3rd party

2013-04-15 Thread Peter Brown
On 12 April 2013 23:59, Rich Megginson rmegg...@redhat.com wrote: On 04/11/2013 11:58 PM, Peter Brown wrote: On 12 April 2013 15:51, Simon Williams simon.willi...@thehelpfulcat.comwrote: I use Atlassian products, but use Crowd to provide single signon. This means that Crowd is the only

[Freeipa-users] exporting ldap certificate

2013-04-25 Thread Peter Brown
Hi everyone. I am attempting to get Google Apps to sync with FreeIPA and I am having problems getting the sync utility to talk to freeipa. It complains about the ssl cert. I have it setup so it only accepts ssl or tls encrypted connections and I don't want to turn that off. I have imported the ca

Re: [Freeipa-users] exporting ldap certificate

2013-04-28 Thread Peter Brown
. -Dcom.sun.net.ssl.checkRevocation=false -Dcom.sun.security.enableCRLDP=false On 26 April 2013 18:30, Petr Viktorin pvikt...@redhat.com wrote: Hello, On 04/26/2013 07:22 AM, Peter Brown wrote: Hi everyone. I am attempting to get Google Apps to sync with FreeIPA and I am having problems getting the sync

Re: [Freeipa-users] exporting ldap certificate

2013-05-06 Thread Peter Brown
On 04/29/2013 06:59 AM, Peter Brown wrote: I finally got this to work. I managed to get an error message that told me it couldn't check the revocation of the certificates against a crl. I tried to find out how to tell java where to find that crl but I these discovered these options

Re: [Freeipa-users] exporting ldap certificate

2013-05-07 Thread Peter Brown
On 7 May 2013 16:50, Martin Kosek mko...@redhat.com wrote: On 05/07/2013 04:51 AM, Peter Brown wrote: On 6 May 2013 17:07, Martin Kosek mko...@redhat.com mailto:mko...@redhat.com wrote: I am glad you made it working. Just for the record, CRL and OCSP revocation URIs in FreeIPA