<html><head><style type="text/css"></style></head><body><div style="font-size: 13px;color: rgb(0, 0, 0);font-family: arial,sans-serif;"><style type="text/css"></style><div style="font-size: 13px;color: rgb(0, 0, 0);font-family: arial,sans-serif;">I was able to get an older version of PWM (v.1.6.4 b1185) with an older FreeIPA v.3.0.0 working together. It's been a few years since I initially set it up, but I recall it was not easy getting PWM to cooperate with IPA. I do recall that I had to grant some extra privileges for the "proxy" user. We created a user called "svc_pwmproxy" and created a new role called "PWM Proxy", with the following privileges called "Modify PWM and passwords". Then for that Privilege, we granted the following permission "change a user password". Which has "write" permissions to the following attributes: (krbprincipalkey, userpassword, sambalmpassword, sambantpassword, passwordhistory), as Type: User and Filter: (!(memberOf=cn=admins,cn=groups,cn=accounts,dc=ipadomain,dc=local)). We probably didn't need write access to all those attributes, but it worked so I left it alone once I got it working.<br><br>-Mike<br><br><blockquote style="padding-left: 5px; margin-left: 0px; border-left: #0000ff 2px solid; font-weight: normal; font-style: normal; text-decoration: none; font-size: 10pt; font-family: arial,sans-serif; color: black;">-----Original Message----- <br>From: Tiemen Ruiten <t.ruiten@rdmedia.com> <br>Sent: Apr 20, 2016 11:23 AM <br>To: freeipa-users@redhat.com <br>Subject: [Freeipa-users] FreeIPA and PWM <br><br><div dir="ltr">Hello,<div><br></div><div>I'm trying to set up a self-service page for a new IPA domain and I'm trying to use PWM for that.</div><div><br></div><div>When I try to bind to FreeIPA from within PWM, with the configured "LDAP Proxy User", I get the following error:</div><div><br></div><div><span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">error connecting to ldap server 'ldaps://<a target="_blank" href="http://polonium.ipa.rdmedia.com:636">polonium.ipa.rdmedia.com:636</a>': unable to create connection: unable to bind to ldaps://<a target="_blank" href="http://polonium.ipa.rdmedia.com:636">polonium.ipa.rdmedia.com:636</a> as cn=svcpwmproxy,cn=groups,cn=accounts,dc=ipa,dc=rdmedia,dc=com reason: [LDAP: error code 48 - Inappropriate Authentication]</span></div><div><font face="Arial, Helvetica, sans-serif" color="#000000"><span style="font-size:12px"><br></span></font></div><div><font face="Arial, Helvetica, sans-serif" color="#000000"><span style="font-size:12px">In /var/log/krb5kdc.log I see:</span></font></div><div><font face="Arial, Helvetica, sans-serif" color="#000000"><span style="font-size:12px"><br></span></font></div><div><font face="Arial, Helvetica, sans-serif" color="#000000"><div><span style="font-size:12px">Apr 20 17:12:29 <a target="_blank" href="http://polonium.ipa.rdmedia.com">polonium.ipa.rdmedia.com</a> krb5kdc[25760](info): AS_REQ (6 etypes {18 17 16 23 25 26}) <a target="_blank" href="http://192.168.50.33">192.168.50.33</a>: NEEDED_PREAUTH: host/<a target="_blank" href="mailto:protactinium.ipa.rdmedia.com@IPA.RDMEDIA.COM">protactinium.ipa.rdmedia.com@IPA.RDMEDIA.COM</a> for krbtgt/<a target="_blank" href="mailto:IPA.RDMEDIA.COM@IPA.RDMEDIA.COM">IPA.RDMEDIA.COM@IPA.RDMEDIA.COM</a>, Additional pre-authentication required</span></div><div><span style="font-size:12px">Apr 20 17:12:29 <a target="_blank" href="http://polonium.ipa.rdmedia.com">polonium.ipa.rdmedia.com</a> krb5kdc[25760](info): closing down fd 12</span></div><div><span style="font-size:12px">Apr 20 17:12:29 <a target="_blank" href="http://polonium.ipa.rdmedia.com">polonium.ipa.rdmedia.com</a> krb5kdc[25760](info): AS_REQ (6 etypes {18 17 16 23 25 26}) <a target="_blank" href="http://192.168.50.33">192.168.50.33</a>: ISSUE: authtime 1461165149, etypes {rep=18 tkt=18 ses=18}, host/<a target="_blank" href="mailto:protactinium.ipa.rdmedia.com@IPA.RDMEDIA.COM">protactinium.ipa.rdmedia.com@IPA.RDMEDIA.COM</a> for krbtgt/<a target="_blank" href="mailto:IPA.RDMEDIA.COM@IPA.RDMEDIA.COM">IPA.RDMEDIA.COM@IPA.RDMEDIA.COM</a></span></div><div><span style="font-size:12px">Apr 20 17:12:29 <a target="_blank" href="http://polonium.ipa.rdmedia.com">polonium.ipa.rdmedia.com</a> krb5kdc[25760](info): closing down fd 12</span></div><div><span style="font-size:12px">Apr 20 17:12:29 <a target="_blank" href="http://polonium.ipa.rdmedia.com">polonium.ipa.rdmedia.com</a> krb5kdc[25760](info): TGS_REQ (6 etypes {18 17 16 23 25 26}) <a target="_blank" href="http://192.168.50.33">192.168.50.33</a>: ISSUE: authtime 1461165149, etypes {rep=18 tkt=18 ses=18}, host/<a target="_blank" href="mailto:protactinium.ipa.rdmedia.com@IPA.RDMEDIA.COM">protactinium.ipa.rdmedia.com@IPA.RDMEDIA.COM</a> for ldap/<a target="_blank" href="mailto:polonium.ipa.rdmedia.com@IPA.RDMEDIA.COM">polonium.ipa.rdmedia.com@IPA.RDMEDIA.COM</a></span></div><div><span style="font-size:12px">Apr 20 17:12:29 <a target="_blank" href="http://polonium.ipa.rdmedia.com">polonium.ipa.rdmedia.com</a> krb5kdc[25760](info): closing down fd 12</span></div><div><span style="font-size:12px"><br></span></div><div><span style="font-size:12px">What is going on? What can I do to debug this more?</span></div><div style="font-size:12px"><br></div></font><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </div></div> </t.ruiten@rdmedia.com></blockquote></div></div></body></html>