<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-IE" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi,<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I think you are copying and pasting the exact same commands from the article, which is of course a wrong approach. Never copy/paste from web to execute on your server. That $ signs indicates you can give any name you’d like.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Follow this article here:<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="https://access.redhat.com/solutions/308623">https://access.redhat.com/solutions/308623</a><o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Stefan<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] <b>On Behalf Of </b>Callum Guy<br> <b>Sent:</b> 05 December 2016 13:38<br> <b>To:</b> Florence Blanc-Renaud; freeipa-users@redhat.com<br> <b>Subject:</b> Re: [Freeipa-users] Directory Manager Password Change<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">Hi Flo,<o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I have indeed executed every step in order, including the one you have indicated.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">The password I has used included a dollar sign and this meant that <span style="font-family:Consolas;color:#333333;background:whitesmoke">echo -n $DM_PASSWORD > /root/dm_password </span>didn't work as I had expected meaning everything after the dollar was interpreted as a variable and was missing in the file. I have corrected this and performed the full process again, starting with the 389 reset however it is still not working correctly.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">I remain in the same state as before where the admin password has not been changed - this confuses me as my understanding is that admin only exists as the FreeIPA web admin user whose password I can change separately. Am i misunderstanding, is there another admin user within FreeIPA which is directly linked to the directory manager?<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Having run out of ideas I have just executed ipa-server-upgrade however this hasn't helped. My situation remains as follows:<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal"><b>Works:</b> ldapsearch -x -D "cn=directory manager" -w <b>NEW_DM_PW </b>-s base -b "" "objectclass=*"<o:p></o:p></p> </div> <div> <p class="MsoNormal"><b>Fails: </b>ldapsearch -h localhost -ZZ -p 389 -x -D "uid=admin,ou=people,o=ipaca" -w <b>NEW_DM_PW </b>-b "" -s base<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Are you able to offer any other ideas? <o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Other information:<o:p></o:p></p> </div> <div> <p class="MsoNormal">I can confirm that cacert.p12 has been updated by the actions performed.<o:p></o:p></p> </div> <div> <p class="MsoNormal">File /etc/pki/pki-tomcat/password.conf now contains a new line internaldb=<b>NEW_DM_PW </b>(as per instruction 1 on FreeIPA link) <o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Best Regards,<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Callum<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <div> <p class="MsoNormal">On Mon, Dec 5, 2016 at 1:08 PM Florence Blanc-Renaud <<a href="mailto:flo@redhat.com">flo@redhat.com</a>> wrote:<o:p></o:p></p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <p class="MsoNormal" style="margin-bottom:12.0pt">On 12/05/2016 01:05 PM, Callum Guy wrote:<br> > Hi All,<br> ><br> > I have been testing FreeIPA and now plan to migrate to production use -<br> > thanks for creating such a great application!<br> ><br> > During the test phase we have been using simple passwords for the admin<br> > and directory manager users however we need these changed before moving<br> > into production. I believe we can change the admin password using the<br> > web interface however as I understand it amending the directory manager<br> > password is not so straightforward.<br> ><br> > I have found this<br> > link <a href="https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password" target="_blank"> https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password</a> however<br> > I am unsure if this is the correct procedure for our installation -<br> > certainly i am having no luck so far.<br> ><br> > We have the following setup:<br> ><br> > FreeIPA 4.2.0 - single master server (no replicas), multiple clients<br> > CentOS 7.2<br> ><br> > I have tried the following steps in order:<br> ><br> > <a href="http://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassword.html" target="_blank"> http://directory.fedoraproject.org/docs/389ds/howto/howto-resetdirmgrpassword.html</a><br> > followed by<br> > <a href="https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password" target="_blank"> https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password</a><br> ><br> > After completing that I am no longer able to authenticate user logins.<br> > The below covers my current situation:<br> ><br> > This works:<br> > ldapsearch -x -D "cn=directory manager" -w NEWPASSWORD -s base -b ""<br> > "objectclass=*"<br> ><br> > This does not work:<br> > ldapsearch -x -D "cn=directory manager" -w OLDPASSWORD -s base -b ""<br> > "objectclass=*"<br> ><br> > This works:<br> > ldapsearch -h localhost -ZZ -p 389 -x -D "uid=admin,ou=people,o=ipaca"<br> > -W -b "" -s base<br> > OLDPASSWORD<br> ><br> > This does not work:<br> > ldapsearch -h localhost -ZZ -p 389 -x -D "uid=admin,ou=people,o=ipaca"<br> > -W -b "" -s base<br> > NEWPASSWORD<br> ><br> Hi,<br> <br> your commands show that the Directory Manager password was properly<br> modified, but not admin's password. Did you run the step 3 Updating PKI<br> admin password of the procedure [1]?<br> ldappasswd -h localhost -ZZ -p $CA_PORT -x -D "cn=Directory Manager" -W<br> -T /root/dm_password "uid=admin,ou=people,o=ipaca"<br> <br> Flo.<br> <br> [1]<br> <a href="https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password#3._Update_PKI_admin_password" target="_blank">https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password#3._Update_PKI_admin_password</a><br> <br> > So i'm i a mixed up state! Is anyone able to offer advise on resolving<br> > this issue?<br> ><br> > Thank you,<br> ><br> > Callum<br> ><br> ><br> ><br> ><br> ><br> > *^0333 332 0000 | <a href="http://www.x-on.co.uk" target="_blank">www.x-on.co.uk</a> <<a href="http://www.x-on.co.uk" target="_blank">http://www.x-on.co.uk</a>> | _<br> > **_^<<a href="https://twitter.com/xonuk" target="_blank">https://twitter.com/xonuk</a>><br> > <<a href="http://www.linkedin.com/company/x-on/products" target="_blank">http://www.linkedin.com/company/x-on/products</a>><br> > <<a href="https://www.facebook.com/XonTel" target="_blank">https://www.facebook.com/XonTel</a>> *<br> > X-on is a trading name of Storacall Technology Ltd a limited company<br> > registered in England and Wales.<br> > Registered Office : Avaland House, 110 London Road, Apsley, Hemel<br> > Hempstead, Herts, HP3 9SD. Company Registration No. 2578478.<br> > The information in this e-mail is confidential and for use by the<br> > addressee(s) only. If you are not the intended recipient, please notify<br> > X-on immediately on <a href="tel:+44%20333%20332%200000" target="_blank">+44(0)333 332 0000</a> and delete the<br> > message from your computer. If you are not a named addressee you must<br> > not use, disclose, disseminate, distribute, copy, print or reply to this<br> > email. Views or opinions expressed by an individual<br> > within this email may not necessarily reflect the views of X-on or its<br> > associated companies. Although X-on routinely screens for viruses,<br> > addressees should scan this email and any attachments<br> > for viruses. X-on makes no representation or warranty as to the absence<br> > of viruses in this email or any attachments.<br> ><br> ><br> ><o:p></o:p></p> </blockquote> </div> <p class="MsoNormal"><o:p> </o:p></p> <p class="MsoNormal"><img border="0" id="_x0000_i1025" src="http://www.x-on.co.uk/email/footer/banner-x-on.jpg"><o:p></o:p></p> <p><b><sup><span style="font-size:13.5pt;font-family:"Verdana","sans-serif"">0333 332 0000 | <a href="http://www.x-on.co.uk" target="_blank">www.x-on.co.uk</a> | </span></sup></b><b><sub><span style="font-size:13.5pt;font-family:"Verdana","sans-serif""> </span></sub></b><b><sup><span style="font-size:13.5pt;font-family:"Verdana","sans-serif""><a href="https://twitter.com/xonuk" target="_blank"><span style="text-decoration:none"><img border="0" width="24" height="24" id="_x0000_i1026" src="http://www.x-on.co.uk/images/icon/linkedin.png"></span></a> <a href="http://www.linkedin.com/company/x-on/products" target="_blank"><span style="text-decoration:none"><img border="0" width="24" height="24" id="_x0000_i1027" src="http://www.x-on.co.uk/images/icon/facebook.png"></span></a> <a href="https://www.facebook.com/XonTel" target="_blank"><span style="text-decoration:none"><img border="0" width="24" height="24" id="_x0000_i1028" src="http://www.x-on.co.uk/images/icon/twitter.png"></span></a></span></sup></b><b><span style="font-size:13.5pt"> </span></b><span style="font-size:6.0pt;font-family:"Verdana","sans-serif";color:black"><br> X-on is a trading name of Storacall Technology Ltd a limited company registered in England and Wales.<br> Registered Office : Avaland House, 110 London Road, Apsley, Hemel Hempstead, Herts, HP3 9SD. Company Registration No. 2578478.<br> The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient, please notify X-on immediately on +44(0)333 332 0000 and delete the<br> message from your computer. If you are not a named addressee you must not use, disclose, disseminate, distribute, copy, print or reply to this email. Views or opinions expressed by an individual<br> within this email may not necessarily reflect the views of X-on or its associated companies. Although X-on routinely screens for viruses, addressees should scan this email and any attachments<br> for viruses. X-on makes no representation or warranty as to the absence of viruses in this email or any attachments.</span><o:p></o:p></p> </div> </body> </html>