date:20150417

Re: [Freeipa-users] External group membership

2015-04-17 Thread Dmitri Pal


On 04/17/2015 09:12 PM, Benjamen Keroack wrote:

Hi,

We have a number of local groups on our IPA-managed servers that we 
add LDAP/IPA users to. This works fine locally on the server on an ad 
hoc basis:


$ usermod -a -G local-group test.user

However I'm trying to do this as part of user provisioning in IPA via 
user groups. I've created external user groups in IPA, then added 
those external groups to the user groups that new users are added to 
via automember rules. For example:


local-group [external] -> [is a member of] -> developers [IPA group]

Then I SSH into one of the servers as a user who is a member of 
developers:


test.user@qa$ groups
test.user developers qa_users

I do not see 'local-group' membership, even after restarting 
sssd/rebooting. Is it possible to achieve this kind of automatic local 
group membership? The only alternative I can see would be to write a 
SUID binary that .bash_profile runs on login to add them to the 
applicable groups, which seems like a bad hack.


This is IPA 4.1.0 running on RHEL 7.1. Client servers are Ubuntu Trusty.

Thanks for any help,

--
Benjamen Keroack
/Infrastructure/DevOps Engineer/
benja...@dollarshaveclub.com 





It looks like you are looking for this: 
https://fedorahosted.org/sssd/ticket/1591

It is on the roadmap for 1.13 alpha which should be out in couple months.
Would you be interested to test?

--
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Re: [Freeipa-users] 4.1.4 and OTP

2015-04-17 Thread Dmitri Pal

On 04/17/2015 11:21 PM, Janelle wrote:

On 4/17/15 5:59 PM, Dmitri Pal wrote:

On 04/17/2015 08:07 PM, Janelle wrote:

On Apr 17, 2015, at 16:36, Dmitri Pal > wrote:

On 04/17/2015 04:52 PM, Janelle wrote:

On 4/17/15 1:19 PM, Dmitri Pal wrote:

On 04/17/2015 01:20 PM, Janelle wrote:

On 4/17/15 9:53 AM, Dmitri Pal wrote:

On 04/17/2015 11:16 AM, Janelle wrote:

Hi,

Is anyone else having issues with OTP since upgrading? For the
life of me I can't get it to accept "Sync" for the tokens. No
matter what is put in, it just keeps saying the username,
password or tokens entered are incorrect.

To make it simple - I am tryign this on a brand new CentOS 7.1
system with a clean/fresh install of FreeIPA 4.1.4 and yet it
just refuses to work.

I create a user -- configure them. They work just fine with a
password. Then add a token. Sync with FreeOTP and that all
works. Then going back to the web UI and do Sync OTP and it
simply refuses to accept any values. And yet the same user can
login to the regular web UI with their password.

I have tried setting the user to both Password and OTP for
auth methods. And also just OTP and nothing works.

Please look in the logs to see what is going on.
You would need to look at the KDC, http and DS logs on the
server to sort out what is going on.

Do you change the password for the user first after creating him?

Can you reproduce the problem with demo instance?
http://www.freeipa.org/page/Demo
If you can then we can take a look at the logs right away.
Hints? Am I missing a step?

It appears to be the UI. If I go through the steps and let it
"fail", I can still login using OTP to servers. I made the
assumption that the error itself was not an error.. :-)

I am not sure I get what you are saying. Do you still see the
problem or you misinterpreted the UI and now the problem is gone?
If you did is there any recommendation how to improve the UI not
to confuse people?

The problem exists -- this is what it shows:
HOWEVER, it is still WORKING. Meaning, even if you get this error,
if you attempt to login with your FreeOTP token, it WORKS.

Does it give you this error when you use password or password and
token?

Can you please describe the flow of steps in more details?
I start browser, go here, click here, enter this, etc.

Are you using SSSD to login to servers? Is SSSD configured with IPA
provider or you configured it for LDAP manually. There is a
difference between LDAP and Kerberos authentication.

May be the following article will help you to understand the
expectations:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/authconfig-addl-auth.html#enable-otp

I suspect it is some combination of flags and protocols that is
confusing

Simple. And my test made it simple.
Stand up new vm running fc21/freeipa.
Configure user.
Add password.
Add token.

Login to web interface with admin. Change user to OTP only.
Go to web UI and click sync OTP.
Enter username, password and 2 OTP sequences. Click sync. Error appears.

Now, ssh to same vm using OTP username. Enter password + OTP value.
Login successful.

I can reproduce this issue with demo instance.
I will file a bug later today.
I think it is a bug with sync.
Which token do you use time based or event based?

TOTP...

Hmm, makes me wonder - with HOTP fail the same? Off to try it.

PS - is there a way to sync a token from command line? I can't think
of a way, but maybe...

Yes, there is a command line. But you do not really need to sync it. So
far it works without syncing as you have noticed.
It seems that the bug is with TOTP token. With HOTP token it seems to
work fine.

I filed a ticket
https://fedorahosted.org/freeipa/ticket/4990

I also filed another ticket
https://fedorahosted.org/freeipa/ticket/4991

And another one
https://fedorahosted.org/freeipa/ticket/4992

--
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project