Re: [Freeipa-users] ipa-client password authentication failed

2016-05-02 Thread Petr Vobornik 
On 05/02/2016 02:05 AM, siology.io wrote:
> That plugins.py file does exist, but it's totally empty.

Following should be the content of the file. Adding it there should fix
the issue.

https://git.fedorahosted.org/cgit/freeipa.git/tree/install/wsgi/plugins.py

Question how it got into the state. What IPA version from what
repository do you use? Have you done any manual changes there?

> 
> And yes, all i get on the browser is an empty white screen window,

That is most-likely a result of the above.

> 
> On 30 April 2016 at 02:20, Petr Vobornik  > wrote:
> 
> On 04/29/2016 12:44 AM, siology.io  wrote:
> > On a clean centos 7 VM, after installation of ipa-server browsing to 
> the ipa web
> > UI gets me in the httpd error_logs:
> >
> > [Thu Apr 28 18:41:11.826134 2016] [:error] [pid 10162] 
> [remote10.0.4.10:244 
>  > ] mod_wsgi (pid=10162): Target WSGI script
> > '/usr/share/ipa/wsgi/plugins.py' does not contain WSGI application 
> 'application'.
> >
> > Is this a known issue ? I didn't get much out of google.
> >
> 
> I don't see this issue on RHEL 7.2 nor FreeIPA 4.3.x on F23. Could you
> paste here content of your /usr/share/ipa/wsgi/plugins.py file?
> 
> Does it prevent to load Web UI?
> --
> Petr Vobornik
> 
> 


-- 
Petr Vobornik

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] ipa-client password authentication failed

2016-05-01 Thread siology.io 
That plugins.py file does exist, but it's totally empty.

And yes, all i get on the browser is an empty white screen window,

On 30 April 2016 at 02:20, Petr Vobornik  wrote:

> On 04/29/2016 12:44 AM, siology.io wrote:
> > On a clean centos 7 VM, after installation of ipa-server browsing to the
> ipa web
> > UI gets me in the httpd error_logs:
> >
> > [Thu Apr 28 18:41:11.826134 2016] [:error] [pid 10162] [remote
> 10.0.4.10:244
> > ] mod_wsgi (pid=10162): Target WSGI script
> > '/usr/share/ipa/wsgi/plugins.py' does not contain WSGI application
> 'application'.
> >
> > Is this a known issue ? I didn't get much out of google.
> >
>
> I don't see this issue on RHEL 7.2 nor FreeIPA 4.3.x on F23. Could you
> paste here content of your /usr/share/ipa/wsgi/plugins.py file?
>
> Does it prevent to load Web UI?
> --
> Petr Vobornik
>
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] ipa-client password authentication failed

2016-04-29 Thread Petr Vobornik 
On 04/29/2016 12:44 AM, siology.io wrote:
> On a clean centos 7 VM, after installation of ipa-server browsing to the ipa 
> web 
> UI gets me in the httpd error_logs:
> 
> [Thu Apr 28 18:41:11.826134 2016] [:error] [pid 10162] [remote 10.0.4.10:244 
> ] mod_wsgi (pid=10162): Target WSGI script 
> '/usr/share/ipa/wsgi/plugins.py' does not contain WSGI application 
> 'application'.
> 
> Is this a known issue ? I didn't get much out of google.
> 

I don't see this issue on RHEL 7.2 nor FreeIPA 4.3.x on F23. Could you
paste here content of your /usr/share/ipa/wsgi/plugins.py file?

Does it prevent to load Web UI?
-- 
Petr Vobornik

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] ipa-client password authentication failed

2016-04-28 Thread siology.io 
On a clean centos 7 VM, after installation of ipa-server browsing to the
ipa web UI gets me in the httpd error_logs:

[Thu Apr 28 18:41:11.826134 2016] [:error] [pid 10162] [remote 10.0.4.10:244]
mod_wsgi (pid=10162): Target WSGI script '/usr/share/ipa/wsgi/plugins.py'
does not contain WSGI application 'application'.

Is this a known issue ? I didn't get much out of google.
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] ipa-client password authentication failed

2016-04-28 Thread Rakesh Rajasekharan 
somehow, i am no longer facing this issue.. the only change I did was,
corrected the /etc/openldap/ldap.conf file to point to the ipa master dns
rather than the older ldap dns.
the file had "#File modified by ipa-client-install" but it did not change
the ldap dns and still pointed to older entry. I jsut corrected it and
restarted sssd.

It though did not work initially after changing , however, I am no longer
facing that issue now.  may be it was a caching issue

Thanks,
Rakesh

On Sun, Apr 24, 2016 at 5:01 PM, Jakub Hrozek  wrote:

>
> > On 22 Apr 2016, at 19:21, Rakesh Rajasekharan <
> rakesh.rajasekha...@gmail.com> wrote:
> >
> > Hi Jakub
> >
> >
> > the child only had that much info..
> >
> > from the domain logs. it looks that it was able to resolve the master .
> However, the ldap results say found nothing.
> >
> > I was earlier running an openldap client on this host and then migrated
> to IPA.
> >
> > /etc/openldap/ldap.conf  was still pointing to the older ldap master..
> >
> > #File modified by ipa-client-install
> >
> > URI ldaps://older-ldap-master.com:636/
> > BASE dc=xyz,dc=com
> > TLS_CACERT /etc/ipa/ca.crt
> >
> > TLS_CACERTDIR /etc/openldap/cacerts]
> >
> > I corrected that to point to IPA and noticed that getent passwd now
> successfully lists all the users.
> > However, the authentication does not work yet. ( ldapsearch -x though
> shows all the users ).
> >
> > I re-tested it now...
> > below is the domain log
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): start
> ldb transaction (nesting: 3)
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added
> timed event "ltdb_callback": 0x118fab0
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added
> timed event "ltdb_timeout": 0x11925f0
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Running
> timer event 0x118fab0 "ltdb_callback"
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000):
> Destroying timer event 0x11925f0 "ltdb_timeout"
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Ending
> timer event 0x118fab0 "ltdb_callback"
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): cancel
> ldb transaction (nesting: 3)
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): commit
> ldb transaction (nesting: 2)
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): commit
> ldb transaction (nesting: 1)
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_save_users]
> (0x4000): User 0 processed!
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): commit
> ldb transaction (nesting: 0)
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_get_users_done]
> (0x4000): Saving 1 Users - Done
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_id_op_done]
> (0x4000): releasing operation connection
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added
> timed event "ltdb_callback": 0x118fd20
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added
> timed event "ltdb_timeout": 0x1182770
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Running
> timer event 0x118fd20 "ltdb_callback"
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000):
> Destroying timer event 0x1182770 "ltdb_timeout"
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Ending
> timer event 0x118fd20 "ltdb_callback"
> >
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]]
> [sdap_id_op_connect_step] (0x4000): reusing cached connection
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]]
> [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in
> view [Default Trust View] with filter
> [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:xyz.com:8
> c7e86dc-0536-11e6-94f8-0e49bd988575))].
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_print_server]
> (0x2000): Searching 10.0.4.175
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]]
> [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
> [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:xyz.com:8c7e86dc-0536-11e6-94f8-0e49bd988575))][cn=Default
> Trust View,cn=views,cn=accounts,dc=xyz,dc=com].
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]]
> [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 105
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_process_result]
> (0x2000): Trace: sh[0x1173050], connected[1], ops[0x115c810],
> ldap[0x1164b30]
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_process_result]
> (0x2000): Trace: ldap_result found nothing!
> > (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_process_result]
> (0x2000): Trace: sh[0x1173050], connected[1], ops[0x115c810], ldap[0x1164b30
> >
>
> This log snippet is again completely unrelated to login. It just says
> there are no overrides applicable for this user. Please run:
>
> date; ssh

Re: [Freeipa-users] ipa-client password authentication failed

2016-04-24 Thread Jakub Hrozek 

> On 22 Apr 2016, at 19:21, Rakesh Rajasekharan  
> wrote:
> 
> Hi Jakub
> 
> 
> the child only had that much info..
> 
> from the domain logs. it looks that it was able to resolve the master . 
> However, the ldap results say found nothing.
> 
> I was earlier running an openldap client on this host and then migrated to 
> IPA.
> 
> /etc/openldap/ldap.conf  was still pointing to the older ldap master..
> 
> #File modified by ipa-client-install
> 
> URI ldaps://older-ldap-master.com:636/
> BASE dc=xyz,dc=com
> TLS_CACERT /etc/ipa/ca.crt
> 
> TLS_CACERTDIR /etc/openldap/cacerts]
> 
> I corrected that to point to IPA and noticed that getent passwd now 
> successfully lists all the users.
> However, the authentication does not work yet. ( ldapsearch -x though shows 
> all the users ).
> 
> I re-tested it now...
> below is the domain log
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): start ldb 
> transaction (nesting: 3)
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added timed 
> event "ltdb_callback": 0x118fab0
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added timed 
> event "ltdb_timeout": 0x11925f0
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Running timer 
> event 0x118fab0 "ltdb_callback"
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Destroying 
> timer event 0x11925f0 "ltdb_timeout"
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Ending timer 
> event 0x118fab0 "ltdb_callback"
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): cancel ldb 
> transaction (nesting: 3)
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): commit ldb 
> transaction (nesting: 2)
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): commit ldb 
> transaction (nesting: 1)
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_save_users] (0x4000): 
> User 0 processed!
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): commit ldb 
> transaction (nesting: 0)
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_get_users_done] 
> (0x4000): Saving 1 Users - Done
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_id_op_done] (0x4000): 
> releasing operation connection
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added timed 
> event "ltdb_callback": 0x118fd20
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Added timed 
> event "ltdb_timeout": 0x1182770
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Running timer 
> event 0x118fd20 "ltdb_callback"
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Destroying 
> timer event 0x1182770 "ltdb_timeout"
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [ldb] (0x4000): Ending timer 
> event 0x118fd20 "ltdb_callback"
> 
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_id_op_connect_step] 
> (0x4000): reusing cached connection
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] 
> [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view 
> [Default Trust View] with filter 
> [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:xyz.com:8c7e86dc-0536-11e6-94f8-0e49bd988575))].
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_print_server] (0x2000): 
> Searching 10.0.4.175
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_get_generic_ext_step] 
> (0x0400): calling ldap_search_ext with 
> [(&(objectClass=ipaOverrideAnchor)(ipaAnchorUUID=:IPA:xyz.com:8c7e86dc-0536-11e6-94f8-0e49bd988575))][cn=Default
>  Trust View,cn=views,cn=accounts,dc=xyz,dc=com].
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_get_generic_ext_step] 
> (0x2000): ldap_search_ext called, msgid = 105
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x1173050], connected[1], ops[0x115c810], ldap[0x1164b30]
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_process_result] 
> (0x2000): Trace: ldap_result found nothing!
> (Fri Apr 22 16:57:21 2016) [sssd[be[xyz.com]]] [sdap_process_result] 
> (0x2000): Trace: sh[0x1173050], connected[1], ops[0x115c810], ldap[0x1164b30
> 

This log snippet is again completely unrelated to login. It just says there are 
no overrides applicable for this user. Please run:

date; ssh $user@$host; date;

and attach all logs between the two date outputs.


-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] ipa-client password authentication failed

2016-04-22 Thread Jakub Hrozek 
On Fri, Apr 22, 2016 at 08:29:06PM +0530, Rakesh Rajasekharan wrote:
> Hi There,
> 
> I have successfully set up and running freeipa in my environment.
> 
> I am running a freeipa master 4.2.x and my ipa clients are at 3.0.0-47
> 
> This set up works fine for majority of servers. But just on one host I am
> unable to authenticate the users.
> 
> it gives me password denied
> 
> Below is the error from /var/log/secure
> 
> Apr 22 14:25:26 localhost sshd[18785]: pam_unix(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.2.5.13
> user=q-testuser
> Apr 22 14:25:27 localhost sshd[18785]: pam_sss(sshd:auth): authentication
> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.2.5.213
> user=q-testuser
> Apr 22 14:25:27 localhost sshd[18785]: pam_sss(sshd:auth): received for
> user q-testuser: 4 (System error)
> 
> 
> and in my krb5_child.log, i see the below lines,
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [main] (0x0400):
> krb5_child started.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [unpack_buffer]
> (0x1000): total buffer size: [171]
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [unpack_buffer]
> (0x0100): cmd [241] uid [114201] gid [114201] validate [true]
> enterprise principal [false] offline [false] UPN [q-testu...@xyz.com]
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [unpack_buffer]
> (0x0100): ccname: [FILE:/tmp/krb5cc_114201_XX] old_ccname:
> [FILE:/tmp/krb5cc_114201_RjJBN2] keytab: [/etc/krb5.keytab]
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [switch_creds]
> (0x0200): Switch user to [114201][114201].
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [sss_krb5_cc_verify_ccache] (0x2000): TGT not found or expired.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [switch_creds]
> (0x0200): Switch user to [0][0].
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [k5c_check_old_ccache] (0x4000): Ccache_file is
> [FILE:/tmp/krb5cc_114201_RjJBN2] and is not active and TGT is  valid.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [k5c_precreate_ccache] (0x4000): Recreating ccache
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [k5c_setup_fast]
> (0x0100): SSSD_KRB5_FAST_PRINCIPAL is set to [host/10.2.2...@xyz.com]
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [find_principal_in_keytab] (0x4000): Trying to find principal host/
> 10.2.2...@xyz.com in keytab.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [match_principal]
> (0x1000): Principal matched to the sample (host/10.2.2...@xyz.com).
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [check_fast_ccache]
> (0x0200): FAST TGT is still valid.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [become_user]
> (0x0200): Trying to become user [114201][114201].
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [main] (0x2000):
> Running as [114201][114201].
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [k5c_setup]
> (0x2000): Running as [114201][114201].
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_RENEWABLE_LIFETIME]
> from environment.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [set_lifetime_options] (0x0100): Cannot read [SSSD_KRB5_LIFETIME] from
> environment.
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [set_canonicalize_option] (0x0100): SSSD_KRB5_CANONICALIZE is set to [true]
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [main] (0x0400):
> Will perform online auth
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [tgt_req_child]
> (0x1000): Attempting to get a TGT
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603 [get_and_save_tgt]
> (0x0400): Attempting kinit for realm [XYZ.COM]
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [sss_child_krb5_trace_cb] (0x4000): [19603] 1461335344.127643: Getting
> initial credentials for q-testu...@xyz.com
> 
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [sss_child_krb5_trace_cb] (0x4000): [19603] 1461335344.127715: FAST armor
> ccache: MEMORY:/var/lib/sss/db/fast_ccache_XYZ.COM
> 
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [sss_child_krb5_trace_cb] (0x4000): [19603] 1461335344.127767: Retrieving
> host/10.2.2...@xyz.com -> krb5_ccache_conf_data/fast_avail/krbtgt\/XYZ.COM
> \@XYZ.COM@X-CACHECONF: from MEMORY:/var/lib/sss/db/fast_ccache_XYZ.COM with
> result: -1765328243/Matching credential not found
> 
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [sss_child_krb5_trace_cb] (0x4000): [19603] 1461335344.127832: Sending
> request (185 bytes) to XYZ.COM
> 
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
> [sss_child_krb5_trace_cb] (0x4000): [19603] 1461335344.128056: Initiating
> TCP connection to stream 10.0.4.175:88
> 
> (Fri Apr 22 14:29:04 2016) [[sssd[krb5_child[19603
>