Bug 872671 - IPA WebUI login for AD Trusted User fails
Summary: IPA WebUI login for AD Trusted User fails
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.0
Hardware: Unspecified
OS: Unspecified
high
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Varun Mylaraiah
Aneta Šteflová Petrová
URL:
Whiteboard:
Depends On:
Blocks: 1396494 1399979 875261 1411762 1430656
TreeView+ depends on / blocked
 
Reported: 2012-11-02 17:01 UTC by Scott Poore
Modified: 2018-12-06 18:26 UTC (History)
15 users (show)

Fixed In Version: ipa-4.5.0-3.el7
Doc Type: Enhancement
Doc Text:
AD users can log in to the web UI to access their self-service page Previously, Active Directory (AD) users were only able to authenticate using the *kinit* utility from the command line. With this update, AD users can also log in to the Identity Management (IdM) web UI. Note that the IdM administrator must create an ID override for an AD user before the user is able to log in. As a result, AD users can access their self-service page through the IdM web UI. The self-service page displays the information from the AD users' ID override. For details, see https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/using-the-ui.html#ad-users-idm-web-ui.
Clone Of:
: 875261 1430656 (view as bug list)
Environment:
Last Closed: 2017-08-01 09:37:23 UTC


Attachments (Terms of Use)
Snapshot (391.86 KB, application/zip)
2017-05-15 14:00 UTC, Varun Mylaraiah
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2304 normal SHIPPED_LIVE ipa bug fix and enhancement update 2017-08-01 12:41:35 UTC

Description Scott Poore 2012-11-02 17:01:32 UTC
Description of problem:

Attemps to log into IPA WebUI with an AD Trusted user fails.

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-106.20121026T1837zgitf14dd98.el6.x86_64
sssd-1.9.90-0.el6.x86_64
httpd-2.2.15-22.el6.x86_64

How reproducible:
alwayys

Steps to Reproduce:
1.  Setup IPA Master
2.  Setup AD Trust and create user on AD side
3.  Attempt to log into WebUI with AD user adtestuser@addomain.com
  
Actual results:
fails:

And I see this in /var/log/httpd/error_log:

[Thu Nov 01 10:42:18 2012] [error] ipa: INFO: *** PROCESS START ***
[Thu Nov 01 10:46:35 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Client 'adtestuser1@TESTRELM.COM' not found in Kerberos database while getting initial credentials
[Thu Nov 01 10:46:35 2012] [error]
[Thu Nov 01 10:47:02 2012] [error] [client 192.168.122.23] gss_accept_sec_context() failed: No credentials were supplied, or the credentials were unavailable or inaccessible (, Unknown error), referer: https://rhel6-1.testrelm.com/ipa/ui/index.html
[Thu Nov 01 10:47:46 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Malformed representation of principal when parsing name adtestuser1@adtestdom.com@TESTRELM.COM
[Thu Nov 01 10:47:46 2012] [error]
[Thu Nov 01 10:49:45 2012] [error] ipa: INFO: 401 Unauthorized: kinit: Client 'ADTESTDOMadtestuser1@TESTRELM.COM' not found in Kerberos database while getting initial credentials

Expected results:
can log in like with normal IPA user.

Additional info:

Comment 4 Martin Kosek 2012-11-06 15:38:37 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3242

Comment 8 Petr Vobornik 2016-06-10 11:42:54 UTC
Backend part was pushed upstream:

master:
https://fedorahosted.org/freeipa/changeset/b506fd178edbf1553ca581c44ac6697f88ead125

Comment 15 Abhinay Reddy Peddireddy 2017-04-13 22:58:37 UTC
Will OTP functionality also be supported for external/AD users as a pert of 2FA when this is released? 

Or do we have any other options to achieve MFA/2FA for external/AD members at this time? 

Thank you.

Comment 16 Abhinay Reddy Peddireddy 2017-04-19 18:05:35 UTC
Continuation to my above comment #15 

Here customer is using Radius server to enable 2FA for logging into specific web apps using AD credentials.

Thanks,
Abhinay Reddy.

Comment 21 Varun Mylaraiah 2017-05-15 12:11:28 UTC
Verified with scenarios

Version used
ipa-server-4.5.0-11.el7.x86_64

TC_0001: IDM-IPA-TC: IPA WebUI login for AD Trusted User

Steps:
1. Setup IPA Master
2. Setup AD Trust and create user on AD side
3. Created ID override for an AD user in Web-UI
    a. Login as admin.
    b. Click on "ID Views" tab.
    c. Click "Default Trust View" under "ID View Name".
    d. Hit "ADD" button located near the top right corner.
    e. Enter AD username in "User to override" text box.
  f. Log-out
4. In Web-UI Log-in Page, Enter AD user login name(testuser@ad.com) and enter password

Expected Result:
AD user should log in successfully


TC_0002: IDM-IPA-TC: IPA WebUI login for AD Trusted User without adding ID override

Steps:
1. Setup IPA Master
2. Setup AD Trust and create user on AD side
3. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password

Expected Result:
AD user should not log-in
Expected error: "The password you entered is incorrect."


TC_0003: IDM-IPA-TC: Add and modify SSH keys for AD user in "Profile" page

Steps:
1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password
	Expected output:
		Should open user's profile page
2. Click ADD button near "SSH public keys" label
3. Add SSH key in text area and click "Set" Button
4. Click Undo button
	Expected output:
		SSH key should not set
5. Repeat step 3
6. Click Undo All button 
	Expected output:
		SSH key should not set
7. Repeat step 3 again
8. Click "Revert" button near Refresh and Save button on top left corner
	Expected output:
		SSH key should not set
9. Repeat step 3 again
10.Click "Save" button near Refresh button on top left corner
	Expected Result:
		SSH key should be added successfully
11. Click "Show/Set Key" button near "SSH public keys" label 
	Expected Result:
		Should display ssh public key.

	
TC_0004: IDM-IPA-TC: Add and modify Certificates for AD user in "Profile" page

Steps:
1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password
	Expected output:
		Should open user's profile page
2. Click ADD button near "Certificates" label
3. Add Certificate in text area and click "Add" button
	Expected output:
		Certificate should be added successfully
4. Click "Action" drop down menu near certificate and then click "View" option
	Expected output:
		Should display Certificate details(Issued To, Issued By, Validity, Fingerprint)
5. Click "close" button
6. Click "Action" drop down menu near certificate and then click "Get" option
	Expected output:
		Should display Certificate.
7. Click "close" button
8. Click "Action" drop down menu near certificate and then click "Download" option
9. 	Expected output:
		Certificate should download successfully.
10.Click "Action" drop down menu near certificate and then click "Delete" option
	Expected output:
		Should prompt conformation dialog box for delete certificate


TC_0005: IDM-IPA-TC: Change password for AD user in "Profile" page

Steps:
1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password
	Expected output:
		Should open user's profile page
2. Click "username"	located near the top right corner	
3. Click "Change Password" option 
	Expected output:
		"Change Password" option should be a freeze.
		 (AD user not able to change password)

TC_0006: IDM-IPA-TC: Update AD user's "Profile" page
1. In Web-UI Log-in Page, Enter AD user login name(testuser1@ad.com) and enter password
	Expected output:
		Should open user's profile page
2. Add description in "Description" text area and click "Undo" button located near the "Description" text area
	Expected output:
		Description should not be update
3. Add Comment in "GECOS" text box and click "Undo" button near the "GECOS" text box
	Expected output:
		Comment should not be update
4. Add log-in shell in "Login shell" text box and click "Undo" button near the "Login shell" text box
	Expected output:
		log-in shell should not be the update
5. Add description in "Description" text area, add comment in "GECOS" text box and add log-in shell in "Login shell" text box
6. Hit "Save" button on top left corner
	Expected output:
		All fields should be updated

Comment 22 Varun Mylaraiah 2017-05-15 14:00:44 UTC
Created attachment 1279005 [details]
Snapshot

Attached Snapshots for below scenarios

TC_0001: IDM-IPA-TC: IPA WebUI login for AD Trusted User
TC_0002: IDM-IPA-TC: IPA WebUI login for AD Trusted User without adding ID override
TC_0003: IDM-IPA-TC: Add and modify SSH keys for AD user in "Profile" page
TC_0004: IDM-IPA-TC: Add and modify Certificates for AD user in "Profile" page
TC_0005: IDM-IPA-TC: Change password for AD user in "Profile" page

Comment 26 errata-xmlrpc 2017-08-01 09:37:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2304


Note You need to log in before you can comment on or make changes to this bug.