Hide Forgot
Description of problem: Attemps to log into IPA WebUI with an AD Trusted user fails. Version-Release number of selected component (if applicable): ipa-server-3.0.0-106.20121026T1837zgitf14dd98.el6.x86_64 sssd-1.9.90-0.el6.x86_64 httpd-2.2.15-22.el6.x86_64 How reproducible: alwayys Steps to Reproduce: 1. Setup IPA Master 2. Setup AD Trust and create user on AD side 3. Attempt to log into WebUI with AD user adtestuser@addomain.com Actual results: fails: And I see this in /var/log/httpd/error_log: [Thu Nov 01 10:42:18 2012] [error] ipa: INFO: *** PROCESS START *** [Thu Nov 01 10:46:35 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Client 'adtestuser1@TESTRELM.COM' not found in Kerberos database while getting initial credentials [Thu Nov 01 10:46:35 2012] [error] [Thu Nov 01 10:47:02 2012] [error] [client 192.168.122.23] gss_accept_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible (, Unknown error), referer: https://rhel6-1.testrelm.com/ipa/ui/index.html [Thu Nov 01 10:47:46 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Malformed representation of principal when parsing name adtestuser1@adtestdom.com@TESTRELM.COM [Thu Nov 01 10:47:46 2012] [error] [Thu Nov 01 10:49:45 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Client 'ADTESTDOMadtestuser1@TESTRELM.COM' not found in Kerberos database while getting initial credentials Expected results: can log in like with normal IPA user. Additional info:
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3242
Backend part was pushed upstream: master: https://fedorahosted.org/freeipa/changeset/b506fd178edbf1553ca581c44ac6697f88ead125
Fixed upstream master: https://pagure.io/freeipa/c/1dcdcd12f4336c98e7507fe0e7f0c0da2bc69eba https://pagure.io/freeipa/c/2992e3c5d480567cfdc71b38365d5d74f009b4d2 https://pagure.io/freeipa/c/ceedc3f7ecb1300ed5bfaf5db8ef1b1450c6288e ipa-4-5: https://pagure.io/freeipa/c/bee9c9f090e7808a2381054fa63c1d036743296c https://pagure.io/freeipa/c/01a0a38bdf53821bc420f01dc98fae577f83eabb https://pagure.io/freeipa/c/228e039e7d718ced7dce7c32cca3a89404c0a16e
Will OTP functionality also be supported for external/AD users as a pert of 2FA when this is released? Or do we have any other options to achieve MFA/2FA for external/AD members at this time? Thank you.
Continuation to my above comment #15 Here customer is using Radius server to enable 2FA for logging into specific web apps using AD credentials. Thanks, Abhinay Reddy.
Verified with scenarios Version used ipa-server-4.5.0-11.el7.x86_64 TC_0001: IDM-IPA-TC: IPA WebUI login for AD Trusted User Steps: 1. Setup IPA Master 2. Setup AD Trust and create user on AD side 3. Created ID override for an AD user in Web-UI a. Login as admin. b. Click on "ID Views" tab. c. Click "Default Trust View" under "ID View Name". d. Hit "ADD" button located near the top right corner. e. Enter AD username in "User to override" text box. f. Log-out 4. In Web-UI Log-in Page, Enter AD user login name(testuser@ad.com) and enter password Expected Result: AD user should log in successfully TC_0002: IDM-IPA-TC: IPA WebUI login for AD Trusted User without adding ID override Steps: 1. Setup IPA Master 2. Setup AD Trust and create user on AD side 3. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password Expected Result: AD user should not log-in Expected error: "The password you entered is incorrect." TC_0003: IDM-IPA-TC: Add and modify SSH keys for AD user in "Profile" page Steps: 1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password Expected output: Should open user's profile page 2. Click ADD button near "SSH public keys" label 3. Add SSH key in text area and click "Set" Button 4. Click Undo button Expected output: SSH key should not set 5. Repeat step 3 6. Click Undo All button Expected output: SSH key should not set 7. Repeat step 3 again 8. Click "Revert" button near Refresh and Save button on top left corner Expected output: SSH key should not set 9. Repeat step 3 again 10.Click "Save" button near Refresh button on top left corner Expected Result: SSH key should be added successfully 11. Click "Show/Set Key" button near "SSH public keys" label Expected Result: Should display ssh public key. TC_0004: IDM-IPA-TC: Add and modify Certificates for AD user in "Profile" page Steps: 1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password Expected output: Should open user's profile page 2. Click ADD button near "Certificates" label 3. Add Certificate in text area and click "Add" button Expected output: Certificate should be added successfully 4. Click "Action" drop down menu near certificate and then click "View" option Expected output: Should display Certificate details(Issued To, Issued By, Validity, Fingerprint) 5. Click "close" button 6. Click "Action" drop down menu near certificate and then click "Get" option Expected output: Should display Certificate. 7. Click "close" button 8. Click "Action" drop down menu near certificate and then click "Download" option 9. Expected output: Certificate should download successfully. 10.Click "Action" drop down menu near certificate and then click "Delete" option Expected output: Should prompt conformation dialog box for delete certificate TC_0005: IDM-IPA-TC: Change password for AD user in "Profile" page Steps: 1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password Expected output: Should open user's profile page 2. Click "username" located near the top right corner 3. Click "Change Password" option Expected output: "Change Password" option should be a freeze. (AD user not able to change password) TC_0006: IDM-IPA-TC: Update AD user's "Profile" page 1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password Expected output: Should open user's profile page 2. Add description in "Description" text area and click "Undo" button located near the "Description" text area Expected output: Description should not be update 3. Add Comment in "GECOS" text box and click "Undo" button near the "GECOS" text box Expected output: Comment should not be update 4. Add log-in shell in "Login shell" text box and click "Undo" button near the "Login shell" text box Expected output: log-in shell should not be the update 5. Add description in "Description" text area, add comment in "GECOS" text box and add log-in shell in "Login shell" text box 6. Hit "Save" button on top left corner Expected output: All fields should be updated
Created attachment 1279005 [details] Snapshot Attached Snapshots for below scenarios TC_0001: IDM-IPA-TC: IPA WebUI login for AD Trusted User TC_0002: IDM-IPA-TC: IPA WebUI login for AD Trusted User without adding ID override TC_0003: IDM-IPA-TC: Add and modify SSH keys for AD user in "Profile" page TC_0004: IDM-IPA-TC: Add and modify Certificates for AD user in "Profile" page TC_0005: IDM-IPA-TC: Change password for AD user in "Profile" page
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304