Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 872671

Summary: IPA WebUI login for AD Trusted User fails
Product: Red Hat Enterprise Linux 7 Reporter: Scott Poore <spoore>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED ERRATA QA Contact: Varun Mylaraiah <mvarun>
Severity: unspecified Docs Contact: Aneta Šteflová Petrová <apetrova>
Priority: high    
Version: 7.0CC: apeddire, avaddara, dpal, ipa-qe, jgalipea, ksiddiqu, ktadimar, ldelouw, mbabinsk, mkosek, nsoman, parsonsa, pvoborni, pvomacka, smeyer
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-4.5.0-3.el7 Doc Type: Enhancement
Doc Text:
AD users can log in to the web UI to access their self-service page Previously, Active Directory (AD) users were only able to authenticate using the *kinit* utility from the command line. With this update, AD users can also log in to the Identity Management (IdM) web UI. Note that the IdM administrator must create an ID override for an AD user before the user is able to log in. As a result, AD users can access their self-service page through the IdM web UI. The self-service page displays the information from the AD users' ID override. For details, see https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/using-the-ui.html#ad-users-idm-web-ui.
 Story Points: ---
Clone Of:
: 875261 1430656 (view as bug list) Environment:
Last Closed: 2017-08-01 09:37:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 875261, 1396494, 1399979, 1411762, 1430656    
Attachments:
Description Flags
Snapshot none

Description Scott Poore 2012-11-02 17:01:32 UTC 
Description of problem:

Attemps to log into IPA WebUI with an AD Trusted user fails.

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-106.20121026T1837zgitf14dd98.el6.x86_64
sssd-1.9.90-0.el6.x86_64
httpd-2.2.15-22.el6.x86_64

How reproducible:
alwayys

Steps to Reproduce:
1.  Setup IPA Master
2.  Setup AD Trust and create user on AD side
3.  Attempt to log into WebUI with AD user adtestuser
  
Actual results:
fails:

And I see this in /var/log/httpd/error_log:

[Thu Nov 01 10:42:18 2012] [error] ipa: INFO: *** PROCESS START ***
[Thu Nov 01 10:46:35 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Client 'adtestuser1' not found in Kerberos database while getting initial credentials
[Thu Nov 01 10:46:35 2012] [error]
[Thu Nov 01 10:47:02 2012] [error] [client 192.168.122.23] gss_accept_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible (, Unknown error), referer: https://rhel6-1.testrelm.com/ipa/ui/index.html
[Thu Nov 01 10:47:46 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Malformed representation of principal when parsing name adtestuser1@TESTRELM.COM
[Thu Nov 01 10:47:46 2012] [error]
[Thu Nov 01 10:49:45 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Client 'ADTESTDOMadtestuser1' not found in Kerberos database while getting initial credentials

Expected results:
can log in like with normal IPA user.

Additional info:
Comment 4 Martin Kosek 2012-11-06 15:38:37 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3242
Comment 8 Petr Vobornik 2016-06-10 11:42:54 UTC 
Backend part was pushed upstream:

master:
https://fedorahosted.org/freeipa/changeset/b506fd178edbf1553ca581c44ac6697f88ead125
Comment 13 Martin Babinsky 2017-03-27 06:59:51 UTC 
Fixed upstream
master:
https://pagure.io/freeipa/c/1dcdcd12f4336c98e7507fe0e7f0c0da2bc69eba
https://pagure.io/freeipa/c/2992e3c5d480567cfdc71b38365d5d74f009b4d2
https://pagure.io/freeipa/c/ceedc3f7ecb1300ed5bfaf5db8ef1b1450c6288e
ipa-4-5:
https://pagure.io/freeipa/c/bee9c9f090e7808a2381054fa63c1d036743296c
https://pagure.io/freeipa/c/01a0a38bdf53821bc420f01dc98fae577f83eabb
https://pagure.io/freeipa/c/228e039e7d718ced7dce7c32cca3a89404c0a16e
Comment 15 Abhinay Reddy Peddireddy 2017-04-13 22:58:37 UTC 
Will OTP functionality also be supported for external/AD users as a pert of 2FA when this is released? 

Or do we have any other options to achieve MFA/2FA for external/AD members at this time? 

Thank you.
Comment 16 Abhinay Reddy Peddireddy 2017-04-19 18:05:35 UTC 
Continuation to my above comment #15 

Here customer is using Radius server to enable 2FA for logging into specific web apps using AD credentials.

Thanks,
Abhinay Reddy.
Comment 21 Varun Mylaraiah 2017-05-15 12:11:28 UTC 
Verified with scenarios

Version used
ipa-server-4.5.0-11.el7.x86_64

TC_0001: IDM-IPA-TC: IPA WebUI login for AD Trusted User

Steps:
1. Setup IPA Master
2. Setup AD Trust and create user on AD side
3. Created ID override for an AD user in Web-UI
    a. Login as admin.
    b. Click on "ID Views" tab.
    c. Click "Default Trust View" under "ID View Name".
    d. Hit "ADD" button located near the top right corner.
    e. Enter AD username in "User to override" text box.
  f. Log-out
4. In Web-UI Log-in Page, Enter AD user login name(testuser) and enter password

Expected Result:
AD user should log in successfully


TC_0002: IDM-IPA-TC: IPA WebUI login for AD Trusted User without adding ID override

Steps:
1. Setup IPA Master
2. Setup AD Trust and create user on AD side
3. In Web-UI Log-in Page, Enter AD user login name(testuser1) and enter password

Expected Result:
AD user should not log-in
Expected error: "The password you entered is incorrect."


TC_0003: IDM-IPA-TC: Add and modify SSH keys for AD user in "Profile" page

Steps:
1. In Web-UI Log-in Page, Enter AD user login name(testuser1) and enter password
	Expected output:
		Should open user's profile page
2. Click ADD button near "SSH public keys" label
3. Add SSH key in text area and click "Set" Button
4. Click Undo button
	Expected output:
		SSH key should not set
5. Repeat step 3
6. Click Undo All button 
	Expected output:
		SSH key should not set
7. Repeat step 3 again
8. Click "Revert" button near Refresh and Save button on top left corner
	Expected output:
		SSH key should not set
9. Repeat step 3 again
10.Click "Save" button near Refresh button on top left corner
	Expected Result:
		SSH key should be added successfully
11. Click "Show/Set Key" button near "SSH public keys" label 
	Expected Result:
		Should display ssh public key.

	
TC_0004: IDM-IPA-TC: Add and modify Certificates for AD user in "Profile" page

Steps:
1. In Web-UI Log-in Page, Enter AD user login name(testuser1) and enter password
	Expected output:
		Should open user's profile page
2. Click ADD button near "Certificates" label
3. Add Certificate in text area and click "Add" button
	Expected output:
		Certificate should be added successfully
4. Click "Action" drop down menu near certificate and then click "View" option
	Expected output:
		Should display Certificate details(Issued To, Issued By, Validity, Fingerprint)
5. Click "close" button
6. Click "Action" drop down menu near certificate and then click "Get" option
	Expected output:
		Should display Certificate.
7. Click "close" button
8. Click "Action" drop down menu near certificate and then click "Download" option
9. 	Expected output:
		Certificate should download successfully.
10.Click "Action" drop down menu near certificate and then click "Delete" option
	Expected output:
		Should prompt conformation dialog box for delete certificate


TC_0005: IDM-IPA-TC: Change password for AD user in "Profile" page

Steps:
1. In Web-UI Log-in Page, Enter AD user login name(testuser1) and enter password
	Expected output:
		Should open user's profile page
2. Click "username"	located near the top right corner	
3. Click "Change Password" option 
	Expected output:
		"Change Password" option should be a freeze.
		 (AD user not able to change password)

TC_0006: IDM-IPA-TC: Update AD user's "Profile" page
1. In Web-UI Log-in Page, Enter AD user login name(testuser1) and enter password
	Expected output:
		Should open user's profile page
2. Add description in "Description" text area and click "Undo" button located near the "Description" text area
	Expected output:
		Description should not be update
3. Add Comment in "GECOS" text box and click "Undo" button near the "GECOS" text box
	Expected output:
		Comment should not be update
4. Add log-in shell in "Login shell" text box and click "Undo" button near the "Login shell" text box
	Expected output:
		log-in shell should not be the update
5. Add description in "Description" text area, add comment in "GECOS" text box and add log-in shell in "Login shell" text box
6. Hit "Save" button on top left corner
	Expected output:
		All fields should be updated
Comment 22 Varun Mylaraiah 2017-05-15 14:00:44 UTC 
Created attachment 1279005 [details]
Snapshot

Attached Snapshots for below scenarios

TC_0001: IDM-IPA-TC: IPA WebUI login for AD Trusted User
TC_0002: IDM-IPA-TC: IPA WebUI login for AD Trusted User without adding ID override
TC_0003: IDM-IPA-TC: Add and modify SSH keys for AD user in "Profile" page
TC_0004: IDM-IPA-TC: Add and modify Certificates for AD user in "Profile" page
TC_0005: IDM-IPA-TC: Change password for AD user in "Profile" page
Comment 26 errata-xmlrpc 2017-08-01 09:37:23 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304