[Freeipa-users] Re: Compat tree question
On Tue, May 30, 2017 at 09:27:05PM +0300, Alexander Bokovoy via FreeIPA-users wrote: > On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: > > So I took a brand new user that I have never used in the system before (I > > checked that the entry was not in the compat tree) and just ran an "id" > > command on Solaris system. I then looked in the /var/log/dirsrv/slapd- > domain>/access log file on the ipa server, for the query and from the log > > file, the query came in as all caps. > > > > example: > > [~]$: id 831...@win.mydomin.com > > > > [~]$: cat /var/log/dirsrv/slapd-/access |grep 831413 > > [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH > > base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1 > > filter="(&(objectClass=posixAccount)(uid=831...@win.mydomin.com))" > > attrs="cn uid uidNumber gidNumber gecos description homeDirectory > > loginShell" > > [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0 > > tag=101 nentries=1 etime=0 > > > > However, the entry in the compat tree is all lowercase just like I > > reported. I can reproduce this easily. > memberUid value comes from SSSD look up. SSSD normalizes all names to > low case. > > For group names, I'm not sure they are normalized, though. with id_provider=ad (which is what is running under the hood of the sssd-on-idm-masters) everything should be normalized and there shouldn't even be an option to turn the normalization off. ___ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
[Freeipa-users] Re: Compat tree question
On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: Is there a option in SSSD or the plugin to turn off the normalization ? No. But as I said, you are not supposed to use all capital fqdn. You need to use your user/group name as it is. id user@ad.realm kinit user@AD.REALM are two different names -- the former is user name in POSIX and it is case sensitive to the operating system but is case-insensitive in LDAP. The latter is Kerberos principal which is case sensitive to Kerberos KDC. In LDAP 'uid' attribute is compared case-sensitive, 'cn' attribute is case-insensitive. For 'uid' we add a secondary value from SSSD (normalized) if it is different from the original in request because case-normalized searches wouldn't work otherwise. For 'cn' we don't change anything because 'cn' comparison syntax in LDAP is case-insensitive. On Tue, May 30, 2017 at 2:27 PM, Alexander Bokovoy wrote: On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: So I took a brand new user that I have never used in the system before (I checked that the entry was not in the compat tree) and just ran an "id" command on Solaris system. I then looked in the /var/log/dirsrv/slapd-/access log file on the ipa server, for the query and from the log file, the query came in as all caps. example: [~]$: id 831...@win.mydomin.com [~]$: cat /var/log/dirsrv/slapd-/access |grep 831413 [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=831...@win.mydomin.com))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell" [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0 tag=101 nentries=1 etime=0 However, the entry in the compat tree is all lowercase just like I reported. I can reproduce this easily. memberUid value comes from SSSD look up. SSSD normalizes all names to low case. For group names, I'm not sure they are normalized, though. Robert Johnson On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy wrote: On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: Red Hat Enterprise Linux Server release 7.3 ipa-server-4.4.0-14.el7_3.4.x86_64 389-ds-base-1.3.5.10-15.el7_3.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 When looking at entries in the "cn=groups,cn=compat" tree, I noticed that the entries for windows groups have the realm portion of the group name in all caps. This is true for the comment, the dn and the cn. example: # domain us...@win.mydomain.com, groups, compat, ipa.mydomain.com dn: cn=domain us...@win.mydomain.com ,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com memberUid: 123...@win.mydomain.com cn: domain us...@win.mydomain.com When I look at the entries in the "cn=users,cn=compat" tree, the realm portion of the user name is all lower case. Incidentally, these same user names are also all lowercase in the "memberUid" option on the groups above. example: # 123...@win.mydomain.com, users, compat, ipa.mydomain.com dn: uid=123...@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd omain,dc=com homeDirectory: /home/win.mydomain.com/123456 uid: 123...@win.mydomain.com Was this by design ? Users and groups for AD users are inserted into the compat tree on demand, when a request comes mentioning them via LDAP query. The name is taken from the LDAP query. So it is your application(s) that are asking fully qualified user/group names with domain part capitalized. The reason I ask, is that when I try to use the "kinit" feature on our Solaris 10 systems (which is joined to the IPA domain) for this windows user, I get an error. [~]$ kinit Password for 123...@win.mydomain.com: kinit(v5): KDC reply did not match expectations while getting initial credentials If I run it like this: [~]$ kinit 123...@win.mydomain.com Password for 123...@win.mydomain.com: [~]$ klist Ticket cache: FILE:/tmp/krb5cc_1683378846 Default principal: 123...@win.mydomain.com Valid startingExpiresService principal 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/ win.mydomain@win.mydomain.com renew until 06/06/17 11:44:35 I believe this is due to the fact that the Solaris 10 system is using the lowercase entry in the compat tree above. Here is the result of the ID command on this user: [~]$ id uid=1683378846(123...@win.mydomain.com) gid=1683378846( 123...@win.mydomain.com) I know this is a work around but I would prefer to make this easier on the end users. Any suggestions ? You mix up Kerberos principals and user identities. They are different. In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not the same realm as win.mydomain.com. On Active Directory side this is hidden behind the Windows UI facade but on UNIX systems Kerberos libraries aren't hiding this fact. That's why you get "KDC reply did not match expectations .." error message -- a realm name is used as part of Kerberos exchange and it is expected to be
[Freeipa-users] Re: Compat tree question
Is there a option in SSSD or the plugin to turn off the normalization ? On Tue, May 30, 2017 at 2:27 PM, Alexander Bokovoy wrote: > On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: > >> So I took a brand new user that I have never used in the system before (I >> checked that the entry was not in the compat tree) and just ran an "id" >> command on Solaris system. I then looked in the >> /var/log/dirsrv/slapd-> domain>/access log file on the ipa server, for the query and from the log >> file, the query came in as all caps. >> >> example: >> [~]$: id 831...@win.mydomin.com >> >> [~]$: cat /var/log/dirsrv/slapd-/access |grep 831413 >> [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH >> base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1 >> filter="(&(objectClass=posixAccount)(uid=831...@win.mydomin.com))" >> attrs="cn uid uidNumber gidNumber gecos description homeDirectory >> loginShell" >> [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0 >> tag=101 nentries=1 etime=0 >> >> However, the entry in the compat tree is all lowercase just like I >> reported. I can reproduce this easily. >> > memberUid value comes from SSSD look up. SSSD normalizes all names to > low case. > > For group names, I'm not sure they are normalized, though. > > > > >> Robert Johnson >> >> On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy >> wrote: >> >> On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: >>> >>> Red Hat Enterprise Linux Server release 7.3 ipa-server-4.4.0-14.el7_3.4.x86_64 389-ds-base-1.3.5.10-15.el7_3.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 When looking at entries in the "cn=groups,cn=compat" tree, I noticed that the entries for windows groups have the realm portion of the group name in all caps. This is true for the comment, the dn and the cn. example: # domain us...@win.mydomain.com, groups, compat, ipa.mydomain.com dn: cn=domain us...@win.mydomain.com ,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com memberUid: 123...@win.mydomain.com cn: domain us...@win.mydomain.com When I look at the entries in the "cn=users,cn=compat" tree, the realm portion of the user name is all lower case. Incidentally, these same user names are also all lowercase in the "memberUid" option on the groups above. example: # 123...@win.mydomain.com, users, compat, ipa.mydomain.com dn: uid=123...@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd omain,dc=com homeDirectory: /home/win.mydomain.com/123456 uid: 123...@win.mydomain.com Was this by design ? Users and groups for AD users are inserted into the compat tree on >>> demand, when a request comes mentioning them via LDAP query. The name is >>> taken from the LDAP query. >>> >>> So it is your application(s) that are asking fully qualified user/group >>> names with domain part capitalized. >>> >>> >>> The reason I ask, is that when I try to use the "kinit" feature on our >>> Solaris 10 systems (which is joined to the IPA domain) for this windows user, I get an error. [~]$ kinit Password for 123...@win.mydomain.com: kinit(v5): KDC reply did not match expectations while getting initial credentials If I run it like this: [~]$ kinit 123...@win.mydomain.com Password for 123...@win.mydomain.com: [~]$ klist Ticket cache: FILE:/tmp/krb5cc_1683378846 Default principal: 123...@win.mydomain.com Valid startingExpiresService principal 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/ win.mydomain@win.mydomain.com renew until 06/06/17 11:44:35 I believe this is due to the fact that the Solaris 10 system is using the lowercase entry in the compat tree above. Here is the result of the ID command on this user: [~]$ id uid=1683378846(123...@win.mydomain.com) gid=1683378846( 123...@win.mydomain.com) I know this is a work around but I would prefer to make this easier on the end users. Any suggestions ? You mix up Kerberos principals and user identities. They are different. >>> In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not >>> the same realm as win.mydomain.com. On Active Directory side this is >>> hidden behind the Windows UI facade but on UNIX systems Kerberos >>> libraries aren't hiding this fact. >>> >>> That's why you get "KDC reply did not match expectations .." error >>> message -- a realm name is used as part of Kerberos exchange and it is >>> expected to be all upper cases. >>> >>> On identity front you have probably configured your Solaris systems to >>> look up identities with upper cased fqdn and compat tree plugin inserts >>> those as it is. I certainly don't see this behavior with other systems. >>> >>> -- >>> / Alexander Bokovoy >>> >>> >
[Freeipa-users] Re: Compat tree question
On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: So I took a brand new user that I have never used in the system before (I checked that the entry was not in the compat tree) and just ran an "id" command on Solaris system. I then looked in the /var/log/dirsrv/slapd-/access log file on the ipa server, for the query and from the log file, the query came in as all caps. example: [~]$: id 831...@win.mydomin.com [~]$: cat /var/log/dirsrv/slapd-/access |grep 831413 [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=831...@win.mydomin.com))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell" [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0 tag=101 nentries=1 etime=0 However, the entry in the compat tree is all lowercase just like I reported. I can reproduce this easily. memberUid value comes from SSSD look up. SSSD normalizes all names to low case. For group names, I'm not sure they are normalized, though. Robert Johnson On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy wrote: On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: Red Hat Enterprise Linux Server release 7.3 ipa-server-4.4.0-14.el7_3.4.x86_64 389-ds-base-1.3.5.10-15.el7_3.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 When looking at entries in the "cn=groups,cn=compat" tree, I noticed that the entries for windows groups have the realm portion of the group name in all caps. This is true for the comment, the dn and the cn. example: # domain us...@win.mydomain.com, groups, compat, ipa.mydomain.com dn: cn=domain us...@win.mydomain.com ,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com memberUid: 123...@win.mydomain.com cn: domain us...@win.mydomain.com When I look at the entries in the "cn=users,cn=compat" tree, the realm portion of the user name is all lower case. Incidentally, these same user names are also all lowercase in the "memberUid" option on the groups above. example: # 123...@win.mydomain.com, users, compat, ipa.mydomain.com dn: uid=123...@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd omain,dc=com homeDirectory: /home/win.mydomain.com/123456 uid: 123...@win.mydomain.com Was this by design ? Users and groups for AD users are inserted into the compat tree on demand, when a request comes mentioning them via LDAP query. The name is taken from the LDAP query. So it is your application(s) that are asking fully qualified user/group names with domain part capitalized. The reason I ask, is that when I try to use the "kinit" feature on our Solaris 10 systems (which is joined to the IPA domain) for this windows user, I get an error. [~]$ kinit Password for 123...@win.mydomain.com: kinit(v5): KDC reply did not match expectations while getting initial credentials If I run it like this: [~]$ kinit 123...@win.mydomain.com Password for 123...@win.mydomain.com: [~]$ klist Ticket cache: FILE:/tmp/krb5cc_1683378846 Default principal: 123...@win.mydomain.com Valid startingExpiresService principal 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/ win.mydomain@win.mydomain.com renew until 06/06/17 11:44:35 I believe this is due to the fact that the Solaris 10 system is using the lowercase entry in the compat tree above. Here is the result of the ID command on this user: [~]$ id uid=1683378846(123...@win.mydomain.com) gid=1683378846( 123...@win.mydomain.com) I know this is a work around but I would prefer to make this easier on the end users. Any suggestions ? You mix up Kerberos principals and user identities. They are different. In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not the same realm as win.mydomain.com. On Active Directory side this is hidden behind the Windows UI facade but on UNIX systems Kerberos libraries aren't hiding this fact. That's why you get "KDC reply did not match expectations .." error message -- a realm name is used as part of Kerberos exchange and it is expected to be all upper cases. On identity front you have probably configured your Solaris systems to look up identities with upper cased fqdn and compat tree plugin inserts those as it is. I certainly don't see this behavior with other systems. -- / Alexander Bokovoy ___ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org -- / Alexander Bokovoy ___ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
[Freeipa-users] Re: Compat tree question
So I took a brand new user that I have never used in the system before (I checked that the entry was not in the compat tree) and just ran an "id" command on Solaris system. I then looked in the /var/log/dirsrv/slapd-/access log file on the ipa server, for the query and from the log file, the query came in as all caps. example: [~]$: id 831...@win.mydomin.com [~]$: cat /var/log/dirsrv/slapd-/access |grep 831413 [30/May/2017:13:34:38.637498942 -0400] conn=94124 op=622 SRCH base="cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uid=831...@win.mydomin.com))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell" [30/May/2017:13:34:38.651811322 -0400] conn=94124 op=622 RESULT err=0 tag=101 nentries=1 etime=0 However, the entry in the compat tree is all lowercase just like I reported. I can reproduce this easily. Robert Johnson On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy wrote: > On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: > >> Red Hat Enterprise Linux Server release 7.3 >> ipa-server-4.4.0-14.el7_3.4.x86_64 >> 389-ds-base-1.3.5.10-15.el7_3.x86_64 >> sssd-1.14.0-43.el7_3.11.x86_64 >> >> When looking at entries in the "cn=groups,cn=compat" tree, I noticed that >> the entries for windows groups have the realm portion of the group name in >> all caps. This is true for the comment, the dn and the cn. >> example: >> # domain us...@win.mydomain.com, groups, compat, ipa.mydomain.com >> dn: cn=domain us...@win.mydomain.com >> ,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com >> memberUid: 123...@win.mydomain.com >> cn: domain us...@win.mydomain.com >> >> When I look at the entries in the "cn=users,cn=compat" tree, the realm >> portion of the user name is all lower case. Incidentally, these same user >> names are also all lowercase in the "memberUid" option on the groups >> above. >> example: >> # 123...@win.mydomain.com, users, compat, ipa.mydomain.com >> dn: uid=123...@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=myd >> omain,dc=com >> homeDirectory: /home/win.mydomain.com/123456 >> uid: 123...@win.mydomain.com >> >> Was this by design ? >> > Users and groups for AD users are inserted into the compat tree on > demand, when a request comes mentioning them via LDAP query. The name is > taken from the LDAP query. > > So it is your application(s) that are asking fully qualified user/group > names with domain part capitalized. > > > The reason I ask, is that when I try to use the "kinit" feature on our >> Solaris 10 systems (which is joined to the IPA domain) for this windows >> user, I get an error. >> >> [~]$ kinit >> Password for 123...@win.mydomain.com: >> kinit(v5): KDC reply did not match expectations while getting initial >> credentials >> >> If I run it like this: >> [~]$ kinit 123...@win.mydomain.com >> Password for 123...@win.mydomain.com: >> [~]$ klist >> Ticket cache: FILE:/tmp/krb5cc_1683378846 >> Default principal: 123...@win.mydomain.com >> >> Valid startingExpiresService principal >> 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/ >> win.mydomain@win.mydomain.com >>renew until 06/06/17 11:44:35 >> >> I believe this is due to the fact that the Solaris 10 system is using the >> lowercase entry in the compat tree above. Here is the result of the ID >> command on this user: >> [~]$ id >> uid=1683378846(123...@win.mydomain.com) gid=1683378846( >> 123...@win.mydomain.com) >> >> I know this is a work around but I would prefer to make this easier on the >> end users. Any suggestions ? >> > You mix up Kerberos principals and user identities. They are different. > In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not > the same realm as win.mydomain.com. On Active Directory side this is > hidden behind the Windows UI facade but on UNIX systems Kerberos > libraries aren't hiding this fact. > > That's why you get "KDC reply did not match expectations .." error > message -- a realm name is used as part of Kerberos exchange and it is > expected to be all upper cases. > > On identity front you have probably configured your Solaris systems to > look up identities with upper cased fqdn and compat tree plugin inserts > those as it is. I certainly don't see this behavior with other systems. > > -- > / Alexander Bokovoy > ___ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
[Freeipa-users] Re: Compat tree question
On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: Red Hat Enterprise Linux Server release 7.3 ipa-server-4.4.0-14.el7_3.4.x86_64 389-ds-base-1.3.5.10-15.el7_3.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 When looking at entries in the "cn=groups,cn=compat" tree, I noticed that the entries for windows groups have the realm portion of the group name in all caps. This is true for the comment, the dn and the cn. example: # domain us...@win.mydomain.com, groups, compat, ipa.mydomain.com dn: cn=domain us...@win.mydomain.com ,cn=groups,cn=compat,dc=ipa,dc=mydomain,dc=com memberUid: 123...@win.mydomain.com cn: domain us...@win.mydomain.com When I look at the entries in the "cn=users,cn=compat" tree, the realm portion of the user name is all lower case. Incidentally, these same user names are also all lowercase in the "memberUid" option on the groups above. example: # 123...@win.mydomain.com, users, compat, ipa.mydomain.com dn: uid=123...@win.mydomain.com,cn=users,cn=compat,dc=ipa,dc=mydomain,dc=com homeDirectory: /home/win.mydomain.com/123456 uid: 123...@win.mydomain.com Was this by design ? Users and groups for AD users are inserted into the compat tree on demand, when a request comes mentioning them via LDAP query. The name is taken from the LDAP query. So it is your application(s) that are asking fully qualified user/group names with domain part capitalized. The reason I ask, is that when I try to use the "kinit" feature on our Solaris 10 systems (which is joined to the IPA domain) for this windows user, I get an error. [~]$ kinit Password for 123...@win.mydomain.com: kinit(v5): KDC reply did not match expectations while getting initial credentials If I run it like this: [~]$ kinit 123...@win.mydomain.com Password for 123...@win.mydomain.com: [~]$ klist Ticket cache: FILE:/tmp/krb5cc_1683378846 Default principal: 123...@win.mydomain.com Valid startingExpiresService principal 05/30/17 11:44:35 05/30/17 21:44:40 krbtgt/ win.mydomain@win.mydomain.com renew until 06/06/17 11:44:35 I believe this is due to the fact that the Solaris 10 system is using the lowercase entry in the compat tree above. Here is the result of the ID command on this user: [~]$ id uid=1683378846(123...@win.mydomain.com) gid=1683378846( 123...@win.mydomain.com) I know this is a work around but I would prefer to make this easier on the end users. Any suggestions ? You mix up Kerberos principals and user identities. They are different. In Kerberos protocol realm is case-sensitive. WIN.MYDOMAIN.COM is not the same realm as win.mydomain.com. On Active Directory side this is hidden behind the Windows UI facade but on UNIX systems Kerberos libraries aren't hiding this fact. That's why you get "KDC reply did not match expectations .." error message -- a realm name is used as part of Kerberos exchange and it is expected to be all upper cases. On identity front you have probably configured your Solaris systems to look up identities with upper cased fqdn and compat tree plugin inserts those as it is. I certainly don't see this behavior with other systems. -- / Alexander Bokovoy ___ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
