Hi Alexander, That is great! I hope that someone can find this topic and use it as reference as it tool us some time to find the other one :) Thanks! Cheers, Matt <div class="gmail_quote"> 2013/7/29 Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi Matt,<div class="im"> On Mon, 29 Jul 2013, Matt . wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"> Hi all, Refering to this topic: <a href="https://www.redhat.com/archives/freeipa-users/2013-July/msg00318.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2013-July/msg00318.html</a> We are no able to do a show_user from a webserver on an IPA server, but user_add gives a problem in rights. On the IPA server there is added to the services: </div> HTTP/test-webserver.dev.domain.local@DEV.DOMAIN.LOCAL<<a href="https://test-zip.dev.msp.cullie.local/ipa/ui/#HTTP/test-zip-2.dev.msp.cullie.local@DEV.MSP.CULLIE.LOCAL" target="_blank">https://test-zip.dev.msp.cullie.local/ipa/ui/#HTTP/test-zip-2.dev.msp.cullie.local@DEV.MSP.CULLIE.LOCAL</a>><div class="im"> We installed mod_auth_kerb on the webserver and the IPA-server and created a keytab also on both servers. </div> <<a href="https://test-zip.dev.msp.cullie.local/ipa/ui/#HTTP/test-zip-2.dev.msp.cullie.local@DEV.MSP.CULLIE.LOCAL" target="_blank">https://test-zip.dev.msp.cullie.local/ipa/ui/#HTTP/test-zip-2.dev.msp.cullie.local@DEV.MSP.CULLIE.LOCAL</a>><div class="im"> With our script we still get the following error because the rights that the user has: ipa: ERROR: Insufficient access: Insufficient 'add' privilege to the 'userPassword' attribute When we add a user "apache" to the IPA server and give it admin rights and set it to the "User Administrator" Role we still don't have the right privileges to do so. We need to setup a S4U2Proxy where we thought of that we did by installing the mod_auth_kerb on the webserver, but this seems to be on the IPA servers. The same question for the keytab, where do we use it when we use a simple webserver form to add a user ? It's the same as in the topic here where there is spoken about the "User privileges": <a href="http://comments.gmane.org/gmane.linux.redhat.freeipa.user/8244" target="_blank">http://comments.gmane.org/gmane.linux.redhat.freeipa.user/8244</a> What do we have to do on which server ? We have put a lot of time into the user_show part and that works, now westill need the user_add (and so on). Has anyone some sort of sample/howto for this ? </div></blockquote> As I said on IRC, I'm working on the article which explains all that. Stay tuned. -- / Alexander Bokovoy </blockquote></div>