[Freeipa-users] kdc certificate web interface expiration warning

2014-10-09 Thread Natxo Asenjo
hi, today our monitoring system started warning us that the web ui certificate for our first kdc will expire in 30 days. I have checked manually with this command: $ sudo getcert list |grep auto-renewauto-renew: yes auto-renew: yes auto-renew: yes auto-renew: yes auto-renew:

Re: [Freeipa-users] kdc certificate web interface expiration warning

2014-10-09 Thread Natxo Asenjo
On Thu, Oct 9, 2014 at 8:42 AM, Natxo Asenjo natxo.ase...@gmail.com wrote: hi, today our monitoring system started warning us that the web ui certificate for our first kdc will expire in 30 days. I have checked manually with this command: $ sudo getcert list |grep auto-renew

[Freeipa-users] yet another certificate question

2014-10-09 Thread Natxo Asenjo
hi, if during the enrollment of a host a host certificate is created, then this will be a nssdb type certificate. However, lots of applications use file certificates and we can very easily create one of those (even using configuration management tools): /usr/bin/ipa-getcert request -r -f

Re: [Freeipa-users] yet another certificate question

2014-10-09 Thread Natxo Asenjo
On Thu, Oct 9, 2014 at 2:33 PM, Natxo Asenjo natxo.ase...@gmail.com wrote: hi, if during the enrollment of a host a host certificate is created, then this will be a nssdb type certificate. However, lots of applications use file certificates and we can very easily create one of those (even

Re: [Freeipa-users] yet another certificate question

2014-10-09 Thread Rob Crittenden
Natxo Asenjo wrote: On Thu, Oct 9, 2014 at 2:33 PM, Natxo Asenjo natxo.ase...@gmail.com wrote: hi, if during the enrollment of a host a host certificate is created, then this will be a nssdb type certificate. However, lots of applications use file certificates and we can very easily create

[Freeipa-users] Migration from FreeIPA-Windows to FreeIPA-samba4

2014-10-09 Thread Carlos Raúl Laguna
Hello to everyone, for some time now i have been pretty much stalking the samba project site, looking forward to forest trust and it seem that they introduced new functions to support trust domains https://download.samba.org/pub/samba/rc/WHATSNEW-4.2.0rc1.txt i guess i an future will be possible.

[Freeipa-users] FreeIPA 3.0, OSX 10.7 and 10.8, and secondary groups

2014-10-09 Thread Scott Allen
Hello, I have managed to get most of the functionality working with OSX and FreeIPA. What I cannot seem to get is the secondary groups working. Posix security is working for primary groups but the security for people with a secondary group doesn't work. I can see in the Directory Utility on OSX

Re: [Freeipa-users] Migration from FreeIPA-Windows to FreeIPA-samba4

2014-10-09 Thread Dmitri Pal
On 10/09/2014 04:38 PM, Carlos Raúl Laguna wrote: Hello to everyone, for some time now i have been pretty much stalking the samba project site, looking forward to forest trust and it seem that they introduced new functions to support trust domains

Re: [Freeipa-users] Error: invalid 'AD domain controller' when establishing trust

2014-10-09 Thread Dmitri Pal
On 10/09/2014 07:07 PM, Genadi Postrilko wrote: Thank you for providing the reference. I understood that when creating a forest trust between two AD forests, the trust is transitive to all domains in both forests (by default). And it has to be established between the two forest root domain.

Re: [Freeipa-users] Error: invalid 'AD domain controller' when establishing trust

2014-10-09 Thread Alexander Bokovoy
On Fri, 10 Oct 2014, Genadi Postrilko wrote: Thank you for providing the reference. I understood that when creating a forest trust between two AD forests, the trust is transitive to all domains in both forests (by default). And it has to be established between the two forest root domain.