<div dir="ltr">I think I've solved this. I don't know what or who enabled it, but for some reason the original NIS service (ypserv) was running on the server. That was taking precedence over ipa's fake NIS, and causing problems. I have now deleted the maps and commented them out in the Makefile so that it doesn't get enabled accidentally again. <div><div><br></div><div>I do see another problem though. In an attempt to clean up a lot of old users, I have disabled them in the webui. This works for ipa clients and access is denied, but the users can still log in on the old NIS clients. Is this a known limitation ?</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 11, 2016 at 9:21 PM, Prasun Gera <span dir="ltr"><<a href="mailto:prasun.gera@gmail.com" target="_blank">prasun.gera@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>This is the output of the command:</div><div><br></div><div><span class=""><div>ldapsearch -LLL -H $(cat /etc/ipa/default.conf | grep ldap_uri|cut -d= -f2) -b cn=config '(nis-domain=*)' dn CreateTimestamp ModifyTimestamp</div></span><div>SASL/EXTERNAL authentication started</div><div>SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth</div><div>SASL SSF: 0</div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=auto.home,cn=NIS Server,cn=plugins,cn=config</div><div>CreateTimestamp: 20150321091139Z</div><div>ModifyTimestamp: 20150321091139Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=auto.local,cn=NIS Server,cn=plugins,cn=confi</div><div> g</div><div>CreateTimestamp: 20150321091209Z</div><div>ModifyTimestamp: 20150321091209Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=auto.master,cn=NIS Server,cn=plugins,cn=conf</div><div> ig</div><div>CreateTimestamp: 20150321091201Z</div><div>ModifyTimestamp: 20150321091201Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=ethers.byaddr,cn=NIS Server,cn=plugins,cn=co</div><div> nfig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=ethers.byname,cn=NIS Server,cn=plugins,cn=co</div><div> nfig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=group.bygid,cn=NIS Server,cn=plugins,cn=conf</div><div> ig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=group.byname,cn=NIS Server,cn=plugins,cn=con</div><div> fig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=netgroup,cn=NIS Server,cn=plugins,cn=config</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div></div><div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=netid.byname,cn=NIS Server,cn=plugins,cn=con</div><div> fig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=passwd.byname,cn=NIS Server,cn=plugins,cn=co</div><div> nfig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div><div><br></div><div>dn: nis-domain=<a href="http://domain.edu" target="_blank">domain.edu</a>+nis-map=passwd.byuid,cn=NIS Server,cn=plugins,cn=con</div><div> fig</div><div>CreateTimestamp: 20150320220124Z</div><div>ModifyTimestamp: 20150320220124Z</div></div><div><br></div><div><br></div><div>All the maps are listed from what I can tell. passwd is the one that is not working as expected. Autofs maps are working all right on nis clients. </div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 11, 2016 at 4:21 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>On Mon, 11 Jan 2016, Prasun Gera wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I upgraded ipa to 4.2 on my rhel 7.2 servers a few weeks ago. One of the<br>
users reported that he is not able to log in to certain systems any more.<br>
It turns out that there is some change in behaviour w.r.t NIS clients after<br>
this upgrade. I see that his username is not visible in "ypcat passwd" on<br>
the old clients that are using NIS. This user was added natively through<br>
ipa. The old users that were migrated from NIS still work as expected on<br>
the NIS clients. I can also confirm that if I add a new user now in ipa, it<br>
is not visible in NIS maps. Until we phase out the NIS clients completely,<br>
I would like all users to be able to log into them. This used to be the<br>
case, but a recent update seems to have changed that. I don't know if this<br>
is intentional. How do i revert to the old behaviour ?<br>
</blockquote></div></div>
Do you see all the maps configured?<br>
<br>
# ldapsearch -LLL -H $(cat /etc/ipa/default.conf | grep ldap_uri|cut -d= -f2) -b cn=config '(nis-domain=*)' dn CreateTimestamp ModifyTimestamp<br>
<br>
We have a bug in the upgrade script that was fixed this morning<br>
<a href="https://www.redhat.com/archives/freeipa-devel/2016-January/msg00154.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-devel/2016-January/msg00154.html</a><span><font color="#888888"><br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>