Re: [Freeipa-users] kinit - gui

2013-08-02 Thread Hebert, Henry
Rob I tried the command. How do I unlock the account using the DM? [hhebertXXX@hostname ~]$ kinit hhebertXXX Password for hhebert...@dc.com: [hhebertXXX@hostname ~]$* ipa user-unlock admin* ipa: ERROR: Server is unwilling to perform: Entry permanently locked. [hhebertXXX@hostname ~]$ and now my

Re: [Freeipa-users] kinit - gui

2013-08-02 Thread Hebert, Henry
I found this. http://directory.fedoraproject.org/wiki/Howto:PasswordReset Still trying to get the syntax down correctly but I think this is what I am looking for. On Fri, Aug 2, 2013 at 10:15 AM, Henry Hebert henry.heb...@roche.comwrote: Rob I tried the command. How do I unlock the

Re: [Freeipa-users] kinit - gui

2013-08-02 Thread Hebert, Henry
Resolution was a little different than the URL fedora project url. ldapmodify -x -D cn=directory manager -w *your bind password (for simple authentication)* dn: uid=admin,cn=users,cn=accounts,dc=XXX,dc=XXX,dc=com changetype: modify delete: krbLoginFailedCount (Ctrl-D) ipa user-status admin

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Rob Crittenden
Hebert, Henry wrote: I have inherited an ipa system that has been running fantastic. However the gui is no longer functioning. I was wondering if this list has seen this sort of error in the past. hostname# kinit admin kinit: Clients credentials have been revoked while getting initial

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Hebert, Henry
Thank you for the respons Rob. [root@hostname ~]# ipa user-show admin User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: GID: Account disabled: False Password: True Member of groups: admins, trust admins Indirect

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Rob Crittenden
Hebert, Henry wrote: Thank you for the respons Rob. [root@hostname ~]# ipa user-show admin User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash UID: GID: Account disabled: False Password: True Member of groups:

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Hebert, Henry
Aha! See Max failures below... [root@hostname ~]# ipa pwpolicy-show --user=admin Group: global_policy Max lifetime (days): 365 Min lifetime (hours): 1 History size: 1 Character classes: 1 Min length: 8 Max failures: 12 Failure reset interval: 0 Lockout duration: 0 is there a

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Rob Crittenden
Hebert, Henry wrote: Aha! See Max failures below... [root@hostname ~]# ipa pwpolicy-show --user=admin Group: global_policy Max lifetime (days): 365 Min lifetime (hours): 1 History size: 1 Character classes: 1 Min length: 8 Max failures: 12 Failure reset interval: 0

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Hebert, Henry
My user is in the admins group however not in the trust admins Group name: admins Description: Account administrators group GID: 98820 Member users: admin, X, hhebertXXX Member of HBAC rule: hostname Group name: trust admins Description: Trusts administrators group

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Hebert, Henry
I have the DM password how do i unlock with it? ipa user-find doesn't show any user named Directory Manager? On Thu, Aug 1, 2013 at 4:43 PM, Henry Hebert henry.heb...@roche.com wrote: My user is in the admins group however not in the trust admins Group name: admins Description: Account

Re: [Freeipa-users] kinit - gui

2013-08-01 Thread Rob Crittenden
Hebert, Henry wrote: My user is in the admins group however not in the trust admins Group name: admins Description: Account administrators group GID: 98820 Member users: admin, X, hhebertXXX Member of HBAC rule: hostname Group name: trust admins Description: