Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is built on top of well known Open Source components and standard protocols with a very strong focus on ease of management and automation of installation and configuration tasks.

Multiple FreeIPA servers can easily be configured in a FreeIPA Domain in order to provide redundancy and scalability. The 389 Directory Server is the main data store and provides a full multi-master LDAPv3 directory infrastructure. Single-Sign-on authentication is provided via the MIT Kerberos KDC. Authentication capabilities are augmented by an integrated Certificate Authority based on the Dogtag project. Optionally Domain Names can be managed using the integrated ISC Bind server.

Security aspects related to access control, delegation of administration tasks and other network administration tasks can be fully centralized and managed via the Web UI or the ipa Command Line tool.

230 questions
1
vote
2 answers

Have the Certificate Signing Request (CSR) signed by a Freeipa CA

We have a certificate authority with Freeipa and I try to put in place a subordinate CA with Freeipa too. I started the installation of the subordinate CA with the ipa-server-install --external-ca command. The result is an ipa.csr file. The Freeipa…
Beretta
  • 11
  • 3
1
vote
1 answer

FreeIPA on Azure setup

I am trying to setup FreeIPA on Azure as 1 Server ---> 2 Clients without actually utilizing a domain name i.e. I want to use a fictitious domain name such as "example.azure.local" and still have the connectivity between the server and the clients.…
1
vote
1 answer

FreeIPA configuration on private network

We have an vpc setup on a private cloud provider (it looks like a cheap knock off of aws…) and I wanted to install freeipa for easier user management. I installed freeipa with its dns management (bind) because from what I’ve read in the…
1
vote
1 answer

FreeIPA Unable to establish trust with Active Directory

I am trying to establish a trust between FreeIPA and Active Directory. Details on the infrastructure: 3 x IPA Servers all with replication between eachother (CentOS 7) 3 x Domain Controllers for AD (Windows Server 2016) When attempting to run the…
RedBullNinja
  • 123
  • 3
1
vote
0 answers

SSSD Default Domain Suffix no longer works

We have several EC-2 instances in an IPA domain with a trust relationship to our Active Directory Domain. On older instances ssh doesn't require the domain suffix from a Windows machine. But on newer instances the username is invalid and only works…
Juna
  • 11
  • 3
1
vote
1 answer

Kerberos delegation with Apache, SSSD and FreeIPA

Let me start from describing my real goal, because I am not sure that I am trying to solve it in a proper way =) I am simply trying to make my web application obtain Kerberos credentials on behalf of the user who logs in. The webserver is part of my…
1
vote
0 answers

FreeRADIUS default vs. inner-tunnel sites and EAP-TLS workflow

I am trying to setup EAP-TLS with FreeRADIUS and an IPA backend. I understand that a typical workflow is to authorize the user against LDAP first and then to authenticate the user using a certificate. Is this workflow typical or correct? I also…
user3814483
  • 183
  • 1
  • 10
1
vote
1 answer

Client setting for FreeIPA Puppet module not working

I'm trying to use the FreeIPA Puppet module, and I copied the below module, changing the data to reflect my environment. class {'freeipa': ipa_role => 'client', domain => 'example.lan', domain_join_password =>…
AndreasKralj
  • 331
  • 1
  • 6
  • 16
1
vote
1 answer

FreeIPA : new/existing accounts expired when ssh'ing into replica

I have two FreeIPA servers running on Centos 7 - one a master the other a replica. I can create a new user account on the master using e.g. the GUI and it appears on both servers, is active and not locked. I can login using the FreeIPA gui on either…
rabidstoat
  • 11
  • 1
  • 2
1
vote
2 answers

FreeRADIUS with LDAP vs Kerberos

The following site discusses how to setup FreeRADIUS to authenticate against an LDAP backend (it goes through a tutorial showing how to expose NT hashed passwords in FreeIPA so that FreeRADIUS can read…
user3814483
  • 183
  • 1
  • 10
1
vote
1 answer

In a FreeIPA environment, how do I log in without specifying the domain name?

There are essentially two parts to this question. I have a FreeIPA domain example.com with a few Fedora domain members. On each of these domain members, I'm able to sign in as a domain user without having to specify the domain name. For example, at…
ADS103
  • 116
  • 1
  • 7
1
vote
1 answer

SSH login timeout while checking private key (sss_ssh_authorizedkeys)

I am having this issue right now with 3 servers at least. When attempting to connect to the server via ssh with a private key with a specific user, it shows the welcome banner, takes almost two minutes and then the connection is closed. ssh -i…
Alumino
  • 11
  • 4
1
vote
1 answer

FreeIPA - Please explain the enroll vs add host permission

I want to create a user in my FreeIPA domain that will be able to automatically add and delete a host created (or deleted) by Foreman. I found 2 permissions: "System: Add Host" and "System: Enroll a Host". What is their difference?
Peter
  • 822
  • 2
  • 10
  • 23
1
vote
0 answers

kerberos setup with freeipa installation

I tried installing freeipa on ubuntu v16 (cloud server) using the following: modified /etc/host to use the private IP address of the virtual machine and the corresponding host (the A name has propagated) ran the freeipa-server installation: sudo…
ali haider
  • 1,140
  • 3
  • 16
  • 29
1
vote
1 answer

Search for accented characters with regular characters in LDAP

I have a FreeIPA server in which some users' names (first and last) has accented characters (such as ī, ā, ū, ...). Is it possible to configure LDAP to search for these characters with regular characters (i, a, u, ...)? I have googled for this but I…
Muhmmad Aziz
  • 271
  • 2
  • 12