freeipa

#4732 Questions about command ipa user-add used to import NIS accounts
Closed: Invalid Opened by edg91.

Closed: Invalid
Reopen Issue

Hello,

I followed the instructions of this page :
http://www.freeipa.org/page/NIS_accounts_migration_preserving_Passwords

in order to integrate NIS accounts over IPA with preserving passwords.

However, I do not succeed to import user as indicate on documentation :

# ipa user-add user1--setattr=userpassword={CRYPT}xxxxxxxxxxxx
return :
"ipa: ERROR: Constraint violation : invalid password syntax - passwords with storage scheme are not allowed"

Someone could help ?

Ed

This should work with #4450 fixed. What 389-ds-base and freeipa-server versions do you use?

Hello,

I am using :

# rpm -q 389-ds-base
389-ds-base-1.3.2.23-1.fc20.x86_64
# yum list freeipa-server.x86_64
freeipa-server.x86_64

under fedora 20

I looked also (before your answer) for more informations about error message, and I found that :
http://comments.gmane.org/gmane.linux.redhat.freeipa.user/11952

So I changed cn=config :

ldapmodify -x -D "cn=directory manager" -w password
dn: cn=config
changetype: modify
replace: nsslapd-allow-hashed-passwords
nsslapd-allow-hashed-passwords: on
Then try again :
# ipa user-add user1 --last="User1" --first="myuser1" --setattr userpassword="{crypt}xxxxxxxxxxxx"
---------------------------
Utilisateur "user1" ajouté
---------------------------
  Identifiant de connexion: user1
  Prénom: myuser1
  Nom: User1
  Nom complet: myuser1 User1
  Nom affiché: myuser1 User1
  Initiales: MU
  Répertoire utilisateur: /home/user1
  GECOS: myuser1 User1
  Shell de connexion: /bin/sh
  Principal Kerberos: User1@LMSIPA.POLYTECHNIQUE.FR
  Adresse courriel: User1@lmscipa1.lmsipa.polytechnique.fr
  UID: 1594400005
  GID: 1594400005
  Mot de passe: True
  Membre des groupes: ipausers
  Clés Kerberos disponibles: False

Ok, seems to be good... however, if I try kinit :

# kinit user1
kinit: Generic preauthentication failure while getting initial credentials

It still does not work.

I identified the algorithm used in the NIS server :

#authconfig --test | grep hashing
 password hashing algorithm is '''bigcrypt'''

Is it supposed to work with this command line :

# ipa user-add user1 --last="User1" --first="myuser1" --setattr userpassword="{crypt}xxxxxxxxxxxx"

I let {crypt} as indicate on the old documentation. But maybe that do not work with bigcrypt passwords ?

Note that if you created a user with hashed password, kinit will not work as Kerberos keys were not generated (can be only generated from clear text password).

You would need to go through special migration procedure for the user so that keys are regenerated, described for example here:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/Identity_Management_Guide/index.html#migr-kerb

documented in downstream documentation as stated in comment 5

Metadata Update from @edg91:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
Migration
0
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.