<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 01/14/2014 07:57 PM, Les Stott
wrote:<br>
</div>
<blockquote
cite="mid:4ED173A868981548967B4FCA270722260550F0@AACMBXP04.exchserver.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas","serif";
color:black;}
span.emailstyle17
{mso-style-name:emailstyle17;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Still no joy.
Although I don’t profess to be a schema changing expert.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Compat plugin
was already enabled. Ipa version is 3.0.0-37.el6<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">So I modified
/etc/dirsrv/slapd-MYDOMAIN-COM/dse.ldif…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Under <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">dn:
cn=users,cn=Schema Compatibility,cn=plugins,cn=config<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I set the
following…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">schema-compat-entry-attribute:
cn=%{cn}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">schema-compat-entry-rdn:
cn=%{cn}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Left the rest
as default. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">When I
ldapsearch against the compat tree, I see it working the way
I want (i.e. dn starts with cn instead of uid).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ldapsearch -x
-b "cn=compat,dc=mydomain,dc=com" "cn=Les Stott"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"># Les Stott,
users, compat, mydomain.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">dn: cn=Les
Stott,cn=users,cn=compat,dc=mydomain,dc=com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ILO Search
context was set as: cn=users,cn=compat,dc=mydomain,dc=com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">So it looks
good, but when I test from ILO it fails still.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Try..<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Les Stott<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">…It cant bind<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=47 op=0 BIND dn="CN=Les
Stott,cn=users,cn=compat,dc=mydomain,dc=com" method=128
version=2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=47 op=0 RESULT err=49 tag=97 nentries=0 etime=0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=47 op=1 UNBIND<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=48 op=0 BIND dn="Les Stott" authzid="(null)",
invalid bind dn<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=48 op=0 RESULT err=34 tag=97 nentries=0 etime=0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=48 op=1 BIND dn="CN=Les
Stott,cn=users,cn=compat,dc=mydomain,dc=com" method=128
version=2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=48 op=1 RESULT err=49 tag=97 nentries=0 etime=0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=48 op=2 UNBIND<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=50 op=0 BIND dn="CN=Les
Stott,cn=users,cn=compat,dc=mydomain,dc=com" method=128
version=2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=50 op=0 RESULT err=49 tag=97 nentries=0 etime=0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[14/Jan/2014:21:52:31
-0500] conn=50 op=1 UNBIND<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Is it just not
supporting to bind against the compat tree in 3.0.0.37? or
am I doing something wrong?</span></p>
</div>
</blockquote>
<br>
Not sure, but err=49 means wrong password, and err=34 means invalid
DN ("Les Stott" is not a DN).<br>
<br>
<blockquote
cite="mid:4ED173A868981548967B4FCA270722260550F0@AACMBXP04.exchserver.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Les<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US"> Dmitri Pal [<a class="moz-txt-link-freetext" href="mailto:dpal@redhat.com">mailto:dpal@redhat.com</a>]
<br>
<b>Sent:</b> Wednesday, 15 January 2014 8:36 AM<br>
<b>To:</b> Les Stott<br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>
<b>Subject:</b> Re: [Freeipa-users] HP ILO
Authentication via LDAP (or even kerberos)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On 01/14/2014 04:01 PM, Les Stott wrote: <o:p></o:p></p>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">I
had seen that thread...
<a moz-do-not-send="true"
href="https://www.redhat.com/archives/freeipa-users/2013-November/msg00019.html"
target="_blank">
https://www.redhat.com/archives/freeipa-users/2013-November/msg00019.html</a><br>
<br>
all it says is...<br>
<br>
On 11/05/2013 02:51 PM, KodaK wrote: <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">If
I use the whole connection string:
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">uid=jebalicki,cn=users,cn=accounts,dc=unix,dc=magellanhealth,dc=com<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">I
can authenticate.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Which
i can do successfully, but its not great to have to tell
everyone your username for ilo is
uid=blah,cn=users,cn=accounts..etc<br>
<br>
There is also mentioned in that thread...<br>
<br>
"The HP iLO documentation doesn't list using the uid value
as a supported form of specifying the login. You can use
the CN value or the full DN. They say that "DOMAIN\user"
and "user domain" forms are also accepted, but that likely
only works against Active Directory."<br>
<br>
CN doesn't work. full DN does.<br>
<br>
I don't see any reference to a workaround via compat
plugin in that thread.<br>
<br>
Have you got any more info on the compat workaround?<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><br>
You can create a compat tree using compat plugin of IPA. It is
used for NIS, support of Solaris clients and for AD trusts in
latest IPA.<br>
As a simple test you can enable the plugin: <span
style="font-size:12.0pt;font-family:"Times New
Roman","serif"">
<o:p></o:p></span></p>
<pre>ipa-compat-manage enable<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>That will expose the tree on the cn=compat hive but using 2307 schema.<o:p></o:p></pre>
<pre>You can then change the configuration of the plugin to use uid value instead of CN in this view, i.e expose CN as uid.<o:p></o:p></pre>
<pre>Then you can point your HP ILO to that tree.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>AFAIU in the past it was not possible because we did not allow bind against compat tree but now we allow it so it should work with the latest IPA 3.3.x bits.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Details on how to change compat configuration can be found in the plugin configuration here:<o:p></o:p></pre>
<pre><a moz-do-not-send="true" href="https://git.fedorahosted.org/cgit/slapi-nis.git/tree/doc">https://git.fedorahosted.org/cgit/slapi-nis.git/tree/doc</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I am not sure that would 100% work but IMO worth a shot.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<p class="MsoNormal"><br>
<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Thanks,<br>
<br>
Les<o:p></o:p></span></p>
<div>
<div class="MsoNormal" style="text-align:center"
align="center">
<hr align="center" size="2" width="100%">
</div>
<div id="divRpF768698">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a moz-do-not-send="true"
href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>
[<a moz-do-not-send="true"
href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>]
on behalf of Dmitri Pal [<a moz-do-not-send="true"
href="mailto:dpal@redhat.com">dpal@redhat.com</a>]<br>
<b>Sent:</b> Wednesday, January 15, 2014 3:30 AM<br>
<b>To:</b> <a moz-do-not-send="true"
href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>
<b>Subject:</b> Re: [Freeipa-users] HP ILO
Authentication via LDAP (or even kerberos)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">On 01/13/2014 10:44 PM, Les Stott
wrote: <o:p></o:p></p>
<div>
<p class="MsoNormal">Been banging my head against the
wall on this one for a few days, trying to get a
workable configuration for HP ILO to authenticate via
FreeIPA.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I have a standard rhel6 environment
(64 bit 6.4) with freeipa server (ipa-3.0.0-37.el6).<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The following works for me……<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">HP ILO4 Firmware 1.22<o:p></o:p></p>
<p class="MsoNormal">Default Directory Schema<o:p></o:p></p>
<p class="MsoNormal">Directory Server Address:
fqdn_of_myfreeipaserver<o:p></o:p></p>
<p class="MsoNormal">Directory Server LDAP Port: 636<o:p></o:p></p>
<p class="MsoNormal">Directory User Context 1:
cn=users,cn=accounts,dc=mydomain,dc=com<o:p></o:p></p>
<p class="MsoNormal">Directory Groups:
cn=sys_admins,cn=groups,cn=accounts,dc=mydomain,dc=com<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">….but only if I login with my full
dn….<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Username:
uid=less,cn=users,cn=accounts,dc=mydomain,dc=com<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The test settings button in the ILO
works only with the full dn.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">It doesn’t work if I use the uid
(less), or the cn (Les Stott).<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I can then login to ILO with ….<o:p></o:p></p>
<p class="MsoNormal">Username:
uid=less,cn=users,cn=accounts,dc=mydomain,dc=com<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">If I try to login with the cn, Les
Stott I see an error in the logs…<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">[13/Jan/2014:22:36:29 -0500]
ipalockout_postop - [file ipa_lockout.c, line 473]:
Failed to retrieve entry "CN=Les
Stott,cn=users,cn=accounts,dc=mydomain,dc=com": 32<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I’ve read a lot of things about
getting this to work. Apparently there are issues with
HP ILO requiring the username in cn format but its in
uid format in freeipa. You should also be able to
login with your cn, but that doesn’t work.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I had a crack at trying Kerberos
authentication as well, but it doesn’t work and errors
with “Additional Pre-authentication required”.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Has anyone successfully been able
to get HP ILO to work with FreeIPA such that you can
login with just the username (i.e. “less”) or the CN
(i.e. “Les Stott”)?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Are schema changes required?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Alternatively has anyone been able
to get HP ILO to work with Kerberos auth to FreeIPA?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Any help would be greatly
appreciated.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Les<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif""><br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Freeipa-users mailing list<o:p></o:p></pre>
<pre><a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><o:p></o:p></pre>
<pre><a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></pre>
<p class="MsoNormal"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif"">Have you searched
freeipa-users archives? The issue sounds familiar and
I vaguely recalled there was a workaround.<br>
This is the thread <a moz-do-not-send="true"
href="https://www.redhat.com/archives/freeipa-users/2013-November/msg00019.html"
target="_blank">
https://www.redhat.com/archives/freeipa-users/2013-November/msg00019.html</a><br>
<br>
I think you can use compat plugin on the IPA to expose
the tree in the way HP ILO expects.<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Thank you,<o:p></o:p></pre>
<pre>Dmitri Pal<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Sr. Engineering Manager for IdM portfolio<o:p></o:p></pre>
<pre>Red Hat Inc.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-------------------------------<o:p></o:p></pre>
<pre>Looking to carve out IT costs?<o:p></o:p></pre>
<pre><a moz-do-not-send="true" href="http://www.redhat.com/carveoutcosts/" target="_blank">www.redhat.com/carveoutcosts/</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
</div>
</div>
</div>
<p class="MsoNormal"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif""><br>
<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Thank you,<o:p></o:p></pre>
<pre>Dmitri Pal<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Sr. Engineering Manager for IdM portfolio<o:p></o:p></pre>
<pre>Red Hat Inc.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-------------------------------<o:p></o:p></pre>
<pre>Looking to carve out IT costs?<o:p></o:p></pre>
<pre><a moz-do-not-send="true" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
</body>
</html>