Questions tagged [freeipa]

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is an integrated security information management solution combining Linux (Fedora), 389 Directory Server, MIT Kerberos, NTP, DNS, Dogtag (Certificate System). It consists of a web interface and command-line administration tools.

FreeIPA is an integrated Identity and Authentication solution for Linux/UNIX networked environments. A FreeIPA server provides centralized authentication, authorization and account information by storing data about user, groups, hosts and other objects necessary to manage the security aspects of a network of computers.

FreeIPA is built on top of well known Open Source components and standard protocols with a very strong focus on ease of management and automation of installation and configuration tasks.

Multiple FreeIPA servers can easily be configured in a FreeIPA Domain in order to provide redundancy and scalability. The 389 Directory Server is the main data store and provides a full multi-master LDAPv3 directory infrastructure. Single-Sign-on authentication is provided via the MIT Kerberos KDC. Authentication capabilities are augmented by an integrated Certificate Authority based on the Dogtag project. Optionally Domain Names can be managed using the integrated ISC Bind server.

Security aspects related to access control, delegation of administration tasks and other network administration tasks can be fully centralized and managed via the Web UI or the ipa Command Line tool.

105 questions
0
votes
1 answer

passwordless LDAP login and get user information using Kerberos ticket in PHP

I'm trying to implement SSO on some intranet sites in our company using FreeIPA/Kerberos. But information on this topic is very thin. I have three machines running in my test network: FreeIPA v4.9.8 Server on Centos 8 Stream Web Server (Apache…
FrashMan
  • 1
  • 3
0
votes
1 answer

krb5kdc client name mismatch in FreeIPA, authentication by certificate

the situation is that I am creating a user certificate for FreeIPA using standard certificate creation profiles. But every time I see the message "Client name mismatch" when I try to log in as a domain user using a certificate. This message, as I…
0
votes
1 answer

FREEIPA server. I cant auth with ldapsearch for users search in catalog

To authorize a user in the Microsoft AD catalog, the domain\login is specified for searching the catalog. Sample request to Microsoft AD - ldapsearch -h 172.16.100.3 -p 389 -W -D "mydomain\usersync" -b "cn=users,dc=mydomain,dc=ru" -s sub…
0
votes
1 answer

How to request host/service certificate when authenticated as Certificate Admin - FreeIPA?

Note: I've tried to keep things as simple as possible in this question as that is as far as my knowledge goes. Any form of help is appreciated I'm new to FreeIPA and I struggle to request a SSL certificate and key file from FreeIPA as Certificate…
N. J
  • 398
  • 2
  • 13
0
votes
1 answer

Smart card logon in Windows in domain FreeIPA

I create domain with FreeIPA. I connected Windows 10 to it. Login to Windows by login-password is successful. I create a profile in the FreeIPA settings to create certificates for Smart Card Login in…
0
votes
1 answer

"We're Sorry, Client not found" FreeIPA, Keycloak setup

I am setting up FreeIPA and Keycloak for user authentication for a django webapp. I have set up the client id and client secret in the .bashrc file and have included my path properly in django (the website loads, just not properly). The error…
qbush
  • 712
  • 2
  • 9
  • 28
0
votes
0 answers

LDAP Server with test data (users and groups) to test a Ansible Playbook

I am to retrieve users and groups from a LDAP server and transfer them to a FREE IPA server. I am using ansible:https://docs.ansible.com/ansible/latest/collections/community/general/ldap_search_module.html to test the scenario. Is there a public…
user1040730
  • 31
  • 2
  • 9
0
votes
1 answer

freeipa migrate from v3 to v4

My goal is to migrate from freeipa v3 to v4. Both versions are a cluster of two nodes. v3 is centos 6 and v4 is centos 7. I want to migrate the dns entries from the old cluster to the new one. Both have the same dns zone(s) and after all dns entries…
Mister Lamp
  • 345
  • 1
  • 4
  • 13
0
votes
1 answer

FreeIpa DatabaseError on Add user

I have an ipa server running for over a year now. Recently, when I try to add a new user via https or the terminal it fails with the following error message. IPA-Fehler 4203: DatabaseError Server is unwilling to perform: Managed Entry Plugin…
0
votes
1 answer

FreeIPA Multitenancy / Multi Organizations

I've been tasked with setting up FreeIPA for my company. What we are looking to do is have multiple "admins" that can only manage and see the users that belong to their team. For example, we have three organizations in our company orgA, orgB, orgC.…
wymangr
  • 189
  • 3
  • 16
0
votes
0 answers

FreeIPA, limiting LDAP access for hosts

I'm orientating around FreeIPA. I have a test setup with a couple of hosts and am experimenting with LDAP. Once thing I noticed is that the hosts are able to query the entirety of the LDAP directory in FreeIPA: kinit -kt /etc/krb5.keytab ldapsearch…
Jochem
  • 21
  • 2
0
votes
0 answers

SSH+FreeIPA: Execute Command From User Without a Home Directory?

I suspect this may not be possible, but just in case anyone has any thoughts... I have a server that users log into remotely purely to get access to a couple of resources through forwarded ports. The users authenticate using ssh keys that are stored…
Shaav
  • 1
0
votes
2 answers

how to setup cross realm trust between two instances of freeIPA

I have a need to setup cross realm trust between to freeIPA instances. I see documentation for setting up trust between freeIPA and AD but not to set it up between two freeIPA instances. I am using the version: VERSION: 4.6.6, API_VERSION: 2.231 Is…
akn
  • 587
  • 1
  • 7
  • 15
0
votes
0 answers

FreeIPA user not executing .bashrc or .bash_profile

I've found that users created in FreeIPA don't execute ~/.bashrc or ~/bash_profile when they log in. However, /etc/bashrc and /etc/profiles are executed. Alternatively, I have created a local user, and both files are executed, so it's something…
tapp
  • 3
  • 6
0
votes
2 answers

Gssapi+Freeipa+Python. Can't find client principal. But it exists. Why?

What I do first: >kinit Default principal: bob@R1.COM Valid starting Expires Service principal 18.06.2020 18:27:11 19.06.2020 18:26:26 postgres/c1.com.ru@R1.COM 18.06.2020 18:27:11 19.06.2020 18:26:26 …