Hi everyone,
My Foreman instance is configured to use FreeIPA as an LDAP server. I have created a FreeIPA group that is mapped to a Foreman group, to which I have assigned a role.
Here is the standard output from the foreman-rake command:
[root@poc-foreman foreman]# foreman-rake console
Loading production environment (Rails 6.1.7.9)
irb(main):002:0> source_now = AuthSourceLdap.find_by_id(6)
=>
#<AuthSourceLdap:0x00007fd40f842cf0
…
irb(main):003:0> conn = source_now.ldap_con
=>
#<LdapFluff:0x00007fd40f735538
…
irb(main):004:0> pp conn.find_group(‘manchester’)
[#<Net::LDAP::Entry:0x00007fd40f69b5a0
@myhash=
{:dn=>[“cn=manchester,cn=groups,cn=accounts,dc=42,dc=school”],
:ipantsecurityidentifier=>
[“S-1-5-21-1868054879-3371231054-2605299079-151679”],
:cn=>[“manchester”],
:objectclass=>
[“top”,
“groupofnames”,
“nestedgroup”,
“ipausergroup”,
“ipaobject”,
“posixgroup”,
“ipantgroupattrs”],
:ipauniqueid=>[“2b60612e-afe9-11ef-9041-022df3c3f43f”],
:gidnumber=>[“40950679”]}>]
=>
[#<Net::LDAP::Entry:0x00007fd40f69b5a0
@myhash=
{:dn=>[“cn=manchester,cn=groups,cn=accounts,dc=42,dc=school”],
:ipantsecurityidentifier=>[“S-1-5-21-1868054879-3371231054-2605299079-151679”],
:cn=>[“manchester”],
:objectclass=>[“top”, “groupofnames”, “nestedgroup”, “ipausergroup”, “ipaobject”, “posixgroup”, “ipantgroupattrs”],
:ipauniqueid=>[“2b60612e-afe9-11ef-9041-022df3c3f43f”],
:gidnumber=>[“40950679”]}>]
irb(main):005:0> conn.valid_group?(‘manchester’)
=> true
irb(main):006:0> conn.user_list(‘manchester’)
=> [“sylvain”, “users”]
irb(main):007:0> conn.valid_user?(‘sylvain’)
=> true
irb(main):008:0> conn.find_user(‘sylvain’)
=>
[#<Net::LDAP::Entry:0x00007fd42595f168
@myhash=
{:dn=>[“uid=sylvain,cn=users,cn=compat,dc=42,dc=school”],
:objectclass=>[“posixAccount”, “ipaOverrideTarget”, “top”],
:gecos=>[“sylvain sylvain”],
:cn=>[“sylvain sylvain”],
:uidnumber=>[“40800015”],
:gidnumber=>[“40800015”],
:loginshell=>[“/bin/sh”],
:homedirectory=>[“/home/sylvain”],
:ipaanchoruuid=>[“:IPA:42.school:f274cdbc-8cb8-11ef-8532-022df3c3f43f”],
:uid=>[“sylvain”]}>,
#<Net::LDAP::Entry:0x00007fd42596a298
@myhash=
{:dn=>[“uid=sylvain,cn=users,cn=accounts,dc=42,dc=school”],
:krbloginfailedcount=>[“0”],
:krblastfailedauth=>[“20241204112132Z”],
:memberof=>
[“cn=admins,cn=groups,cn=accounts,dc=42,dc=school”,
“cn=Replication Administrators,cn=privileges,cn=pbac,dc=42,dc=school”,
“cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Modify DNA Range,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Read DNA Range,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=Host Enrollment,cn=privileges,cn=pbac,dc=42,dc=school”,
“cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=42,dc=school”,
“cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=42,dc=school”,
“ipaUniqueID=a9dd50f8-8afe-11ef-ba89-022df3c3f43f,cn=hbac,dc=42,dc=school”,
“ipaUniqueID=b8b42c0a-8afe-11ef-81eb-022df3c3f43f,cn=sudorules,cn=sudo,dc=42,dc=school”,
“cn=ipausers,cn=groups,cn=accounts,dc=42,dc=school”,
“cn=manchester,cn=groups,cn=accounts,dc=42,dc=school”,
“ipaUniqueID=e3418690-ad75-11ef-bedc-022df3c3f43f,cn=hbac,dc=42,dc=school”],
:mail=>[“sylvain.cordier-ext@42.fr”],
:givenname=>[“Sylvain”],
:sn=>[“Cordier”],
:gidnumber=>[“40800015”],
:uidnumber=>[“40800015”],
:ipauniqueid=>[“f274cdbc-8cb8-11ef-8532-022df3c3f43f”],
:krbcanonicalname=>[“sylvain@42.SCHOOL”],
:homedirectory=>[“/home/sylvain”],
:loginshell=>[“/bin/sh”],
:objectclass=>
[“top”,
“person”,
“organizationalperson”,
“inetorgperson”,
“inetuser”,
“posixaccount”,
“krbprincipalaux”,
“krbticketpolicyaux”,
“ipaobject”,
“ipasshuser”,
“ipaSshGroupOfPubKeys”,
“mepOriginEntry”,
“ipantuserattrs”],
:krbprincipalname=>[“sylvain@42.SCHOOL”],
:gecos=>[“sylvain sylvain”],
:initials=>[“ss”],
:displayname=>[“sylvain sylvain”],
:cn=>[“sylvain sylvain”],
:uid=>[“sylvain”],
:mepmanagedentry=>[“cn=sylvain,cn=groups,cn=accounts,dc=42,dc=school”],
:ipantsecurityidentifier=>[“S-1-5-21-1868054879-3371231054-2605299079-1015”],
:krblastpwdchange=>[“20241017190504Z”],
:krbpasswordexpiration=>[“20250115190504Z”],
:krbextradata=>[“\x00\x02\xE0_\x11gsylvain@42.SCHOOL\x00”]}>]
The version of Foreman is 3.12.1
The output suggests that everything is okay: the group appears to be correctly associated with my user.
Problem:
When I log in with my user, the role is not assigned. Moreover, when I check the User Groups page in the UI, the external group disappears and is no longer associated with the Foreman group.
This behavior is driving me crazy, and I can’t find anything relevant in the logs to debug the issue.
Thank you in advance for your help.
Sylvain