FreeIPA

https://freeipa.readthedocs.io/en/ipa-4-11/
Admin
FreeIPA is an integrated security information management solution for Linux/UNIX networked...
Tokens:447,414
Snippets:3,666
Trust Score:8.3
Update:3 days ago
Show doc for...
Tokens:
Raw
### Add example user and groups via CLI

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/membermanager.md

Initial setup commands to create users and groups for testing member management.

```console
$ kinit admin
$ ipa user-add john --first John --last Doe --random
$ ipa user-add tom --first Tom --last Doe --random
$ ipa group-add project
$ ipa group-add project_admins
```

--------------------------------

### Run FreeIPA server installation

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/1-server-install.rst

Start the installation program on the server. The --no-host-dns flag is used for environments without reverse DNS, and --mkhomedir configures PAM to create home directories.

```bash
[server]$ sudo ipa-server-install --no-host-dns --mkhomedir
```

--------------------------------

### Install pykickstart package

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/building.rst

Install the pykickstart package to obtain the ksflatten tool.

```bash
$ sudo dnf install pykickstart
```

--------------------------------

### Initialize and start Keycloak

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/12-external-idp-support.rst

Initializes the Keycloak build and starts the service, followed by a status check.

```bash
[root@client ~]# su - keycloak -c '''
export KEYCLOAK_ADMIN=admin
export KEYCLOAK_ADMIN_PASSWORD=Secret123
export KC_HOSTNAME=$(hostname):8443
export KC_HTTPS_CERTIFICATE_FILE=/etc/pki/tls/certs/keycloak.crt
export KC_HTTPS_CERTIFICATE_KEY_FILE=/etc/pki/tls/private/keycloak.key
export KC_HTTPS_TRUST_STORE_FILE=/etc/pki/tls/private/keycloak.store
export KC_HTTPS_TRUST_STORE_PASSWORD=Secret123
export KC_HTTP_RELATIVE_PATH=/auth
/opt/keycloak-${KEYCLOAK_VERSION}/bin/kc.sh --verbose build
'''
```

```bash
[root@client ~]# systemctl start keycloak

[root@client ~]# systemctl status --lines 3 --no-pager keycloak 
● keycloak.service - Keycloak Server
     Loaded: loaded (/etc/systemd/system/keycloak.service; disabled; vendor preset: disabled)
     Active: active (running) since Fri 2022-05-06 10:43:06 UTC; 9min ago
   Main PID: 27170 (java)
      Tasks: 37 (limit: 2318)
     Memory: 297.1M
        CPU: 25.560s
     CGroup: /system.slice/keycloak.service
             └─27170 java -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -D…

May 06 10:43:28 client.ipademo.local kc.sh[27170]: 2022-05-06 10:43:28,411 INFO  [io.quarkus] (main) Keycloak 18.0.0 on …0.0:8443
May 06 10:43:28 client.ipademo.local kc.sh[27170]: 2022-05-06 10:43:28,412 INFO  [io.quarkus] (main) Profile prod activated.
May 06 10:43:28 client.ipademo.local kc.sh[27170]: 2022-05-06 10:43:28,412 INFO  [io.quarkus] (main) Installed features: [agroal…
Hint: Some lines were ellipsized, use -l to show in full.
```

--------------------------------

### ipa-migrate usage examples

Source: https://freeipa.readthedocs.io/en/ipa-4-11/designs/ipa_to_ipa_migration.html

Common command-line examples for performing migrations in production or staging modes with various options.

```bash
# ipa-migrate prod-mode remote.server.com

# ipa-migrate prod-mode remote.server.com --dryrun

# ipa-migrate prod-mode remote.server.com -D "cn=directory manager" -j ./passwd.txt

# ipa-migrate prod-mode remote.server.com --db-ldif=/tmp/remote-userroot.ldif

# ipa-migrate prod-mode remote.server.com --skip-config --skip-schema

# ipa-migrate stage-mode remote.server.com --dryrun-record=/tmp/dryrun-ops.ldif

# ipa-migrate stage-mode remote.server.com --config-ldif=/tmp/dse.ldif --schema-ldif=/tmp/schema.ldif --db-ldif=/tmp/remote-userroot.ldif

# ipa-migrate stage-mode remote.server.com --subtree="ou=my own data,dc=ipa,dc=com"
```

--------------------------------

### Perform initial server installation with HSM

Source: https://freeipa.readthedocs.io/en/ipa-4-11/designs/hsm.html

Installs an IPA server with DNS and HSM configuration using the specified token name and library path.

```bash
ipa-server-install -a password -p dmpassword -r EXAMPLE.TEST -U –setup-dns –allow-zone-overlap –no-forwarders -N –auto-reverse –token-name softhsm_token –library-path /usr/lib64/pkcs11/libsofthsm2.so
```

--------------------------------

### Install vagrant-libvirt on Fedora

Source: https://freeipa.readthedocs.io/en/ipa-4-11/workshop/workshop.html

Install the libvirt provider and documentation packages for Vagrant on Fedora.

```bash
$ sudo dnf install -y vagrant-libvirt vagrant-libvirt-doc
```

--------------------------------

### Install Vagrant, Git, and VirtualBox on Debian/Ubuntu

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/workshop.rst

Commands to install the necessary dependencies for the workshop on Debian or Ubuntu systems.

```bash
$ sudo apt-get install -y vagrant git
$ sudo apt-get install -y virtualbox-6.1
```

--------------------------------

### Start Samba services

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/adtrust/samba-domain-member.md

Start the smb and winbind systemd services, both of which are required for proper Samba functionality.

```console
# systemctl start smb winbind
```

--------------------------------

### Install FreeIPA server with HSM configuration

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/hsm.md

Performs an initial server installation using specific HSM token and library path parameters.

```bash
ipa-server-install -a password -p dmpassword -r EXAMPLE.TEST -U --setup-dns --allow-zone-overlap --no-forwarders -N --auto-reverse --token-name softhsm_token --library-path /usr/lib64/pkcs11/libsofthsm2.so
```

--------------------------------

### Configure VirtualBox Repository and Install

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/workshop.rst

Commands to download the VirtualBox repository configuration, verify its contents, and install the VirtualBox package.

```bash
$ sudo curl -o /etc/yum.repos.d/virtualbox.repo \
  http://download.virtualbox.org/virtualbox/rpm/fedora/virtualbox.repo

$ cat /etc/yum.repos.d/virtualbox.repo
[virtualbox]
name=Fedora $releasever - $basearch - VirtualBox
baseurl=http://download.virtualbox.org/virtualbox/rpm/fedora/$releasever/$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://www.virtualbox.org/download/oracle_vbox.asc

$ sudo dnf install -y VirtualBox-6.1
```

--------------------------------

### Install Vagrant and VirtualBox on Fedora

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/workshop.rst

Commands to install Vagrant, kernel headers, and DKMS for VirtualBox support.

```bash
$ sudo dnf install -y vagrant kernel-devel dkms
```

--------------------------------

### Start FreeIPA client enrolment

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/2-client-install.rst

Initiate the FreeIPA client enrolment program on the client machine.

```bash
[client]$ sudo ipa-client-install --mkhomedir
```

--------------------------------

### Start and verify Keycloak service

Source: https://freeipa.readthedocs.io/en/ipa-4-11/workshop/12-external-idp-support.html

Use systemctl to start the Keycloak service and check its status to ensure it is running correctly.

```bash
[root@client ~]# systemctl start keycloak

[root@client ~]# systemctl status --lines 3 --no-pager keycloak
● keycloak.service - Keycloak Server
     Loaded: loaded (/etc/systemd/system/keycloak.service; disabled; vendor preset: disabled)
     Active: active (running) since Fri 2022-05-06 10:43:06 UTC; 9min ago
   Main PID: 27170 (java)
      Tasks: 37 (limit: 2318)
     Memory: 297.1M
        CPU: 25.560s
     CGroup: /system.slice/keycloak.service
             └─27170 java -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -D…

May 06 10:43:28 client.ipademo.local kc.sh[27170]: 2022-05-06 10:43:28,411 INFO  [io.quarkus] (main) Keycloak 18.0.0 on …0.0:8443
May 06 10:43:28 client.ipademo.local kc.sh[27170]: 2022-05-06 10:43:28,412 INFO  [io.quarkus] (main) Profile prod activated.
May 06 10:43:28 client.ipademo.local kc.sh[27170]: 2022-05-06 10:43:28,412 INFO  [io.quarkus] (main) Installed features: [agroal…
Hint: Some lines were ellipsized, use -l to show in full.
```

--------------------------------

### Install Vagrant libvirt Provider on Fedora

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/workshop.rst

Commands to install the libvirt provider for Vagrant and configure user permissions.

```bash
$ sudo dnf install -y vagrant-libvirt vagrant-libvirt-doc
```

```bash
$ sudo gpasswd -a ${USER} libvirt
$ newgrp libvirt
```

```bash
$ systemctl restart libvirtd
```

--------------------------------

### Confirm server configuration

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/1-server-install.rst

Review the summary of the server configuration and confirm to begin installation.

```text
The IPA Master Server will be configured with:
Hostname:       server.ipademo.local
IP address(es): 192.168.33.10
Domain name:    ipademo.local
Realm name:     IPADEMO.LOCAL

The CA will be configured with:
Subject DN:   CN=Certificate Authority,O=IPADEMO.LOCAL
Subject base: O=IPADEMO.LOCAL
Chaining:     self-signed

BIND DNS server will be configured to serve IPA domain with:
Forwarders:       No forwarders
Forward policy:   only
Reverse zone(s):  33.168.192.in-addr.arpa.

Continue to configure the system with these values? [no]: yes
```

--------------------------------

### Install and configure Keycloak on IPA client

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/12-external-idp-support.rst

Commands to install Java, download and unpack Keycloak, and set up the necessary system user and permissions for Keycloak on an IPA-enrolled client.

```bash
[root@client ~]# dnf -y install java-11-openjdk-headless openssl

#### download keycloak ####
[root@client ~]# export KEYCLOAK_VERSION=18.0.0
[root@client ~]# wget https://github.com/keycloak/keycloak/releases/download/${KEYCLOAK_VERSION}/keycloak-${KEYCLOAK_VERSION}.tar.gz
[root@client ~]# tar zxf keycloak-${KEYCLOAK_VERSION}.tar.gz -C /opt

#### add keycloak system user/group and folder ####
[root@client ~]# groupadd keycloak
[root@client ~]# useradd -r -g keycloak -d /opt/keycloak-${KEYCLOAK_VERSION} keycloak
[root@client ~]# chown -R keycloak:keycloak /opt/keycloak-${KEYCLOAK_VERSION}
[root@client ~]# chmod o+x /opt/keycloak-${KEYCLOAK_VERSION}/bin/

[root@client ~]# restorecon -R /opt/keycloak-${KEYCLOAK_VERSION}
```

--------------------------------

### Check for wrong job prefix in gating

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/prci_checker.md

Example output when a job name does not start with the required 'fedora-latest/' prefix.

```bash
$ python3 ipatests/prci_definitions/prci_checker.py -f ipatests/prci_definitions/gating.yaml
BEGINNING PRCI JOB DEFINITIONS CHECKS
[File] gating [Jobs] 24
ERROR: In job 'fedora-latdest/test_installation_TestInstallMaster':
  Job name should start with prefix 'fedora-latest/'
CHECKS FINISHED WITH ERRORS
```

--------------------------------

### Minimum PKI installation override for HSM

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/hsm.md

The minimum configuration required to enable HSM support during PKI installation via the dogtagpki installer.

```ini
[DEFAULT]
pki_hsm_enable=True
pki_hsm_libfile=/usr/lib64/pkcs11/libsofthsm2.so
pki_hsm_modulename=softhsm2
pki_token_name=softhsm_token
pki_token_password=password
pki_sslserver_token=internal
```

--------------------------------

### Start Vagrant environment

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/1-server-install.rst

Bring up the Vagrant environment. Use the --provider virtualbox option if VirtualBox is not the default provider.

```bash
$ vagrant up --provider virtualbox
```

--------------------------------

### Run ipa-client-install with PKINIT

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/client-install-pkinit.md

Executes the client installation command using PKINIT identity and anchor files.

```console
$ ipa-client-install \
    --pkinit-identity=FILE:/path/to/cert.pem,/path/to/key.pem \
    --pkinit-anchor=FILE:/path/to/kdc-ca-bundle.pem \
    ...
```

--------------------------------

### Enable and start Certmonger

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/6-cert-management.rst

Enable and start the Certmonger service to manage certificate requests and renewals.

```bash
[client]$ sudo systemctl enable --now certmonger
Created symlink /etc/systemd/system/multi-user.target.wants/certmonger.service → /usr/lib/systemd/system/certmonger.service.
```

--------------------------------

### Install a hidden replica

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/hidden-replicas.md

Use the --hidden-replica flag during installation to create a new hidden replica.

```bash
ipa-replica-install --hidden-replica
```

--------------------------------

### Start FreeIPA client enrollment with ipa-client-install

Source: https://freeipa.readthedocs.io/en/ipa-4-11/workshop/2-client-install.html

Run the FreeIPA client enrollment program on the client machine. The server is detected via DNS autodiscovery; if that fails, you will be prompted to enter the domain and server hostname manually.

```bash
[client]$ sudo ipa-client-install --mkhomedir

```

--------------------------------

### Well-Formed Job Definition Example

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/prci_checker.md

An example of a complete, well-formed job definition that adheres to the specified requirements.

```yaml
389ds-fedora/simple_replication:
  requires: [389ds-fedora/build]
  priority: 50
  job:
    class: RunPytest
    args:
      build_url: '{389ds-fedora/build_url}'
      update_packages: True
      copr: '@389ds/389-ds-base-nightly'
      test_suite: test_integration/test_simple_replication.py
      template: *ci-master-latest
      timeout: 3600
      topology: *master_1repl
```

--------------------------------

### Run ipa-client-install for user enrollment

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/client-install-pkinit.md

Executes the client installation command using a specific user principal for enrollment.

```console
$ ipa-client-install \
    --pkinit-identity=FILE:/path/to/cert.pem,/path/to/key.pem \
    --pkinit-anchor=FILE:/path/to/kdc-ca-bundle.pem \
    -p enrollmentuser
    ...
```

--------------------------------

### Enter admin credentials for enrollment

Source: https://freeipa.readthedocs.io/en/ipa-4-11/workshop/2-client-install.html

The installer prompts for a user authorized to enroll hosts. Enter the username and password for the admin user.

```bash
User authorized to enroll computers: admin
Password for admin@IPADEMO.LOCAL:

```

--------------------------------

### Initial replication process output

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/7-replica-install.rst

Displays the status of the initial data replication to the new Directory Server instance during the installation process.

```text
[28/41]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 4 seconds elapsed
Update succeeded
```

--------------------------------

### ipa-client-install discovery output and confirmation

Source: https://freeipa.readthedocs.io/en/ipa-4-11/workshop/2-client-install.html

After running ipa-client-install, the autodetected server settings are displayed. Confirm to proceed by entering 'yes' when prompted.

```bash
[client]$ sudo ipa-client-install --mkhomedir
Discovery was successful!
Client hostname: client.ipademo.local
Realm: IPADEMO.LOCAL
DNS Domain: ipademo.local
IPA Server: server.ipademo.local
BaseDN: dc=ipademo,dc=local

Continue to configure the system with these values? [no]: yes

```

--------------------------------

### Run ipa-replica-install command

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/workshop/7-replica-install.rst

Execute the replica installation command on the replica machine. Note that reverse DNS resolution errors may occur and require confirmation to proceed.

```bash
[replica]$ sudo ipa-replica-install
Password for admin@IPADEMO.LOCAL:
ipaserver.install.server.replicainstall: ERROR    Reverse DNS resolution of address 192.168.33.10 (server.ipademo.local) failed. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.)
Continue? [no]: yes
Run connection check to master
Connection check OK
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/41]: creating directory server instance
  [2/41]: enabling ldapi
...
```

--------------------------------

### Example Definition for nightly_latest_389ds

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/designs/prci_checker.md

An example of a specific job definition requiring a prefix, package updates, and COPR repository usage.

```yaml
nightly_latest_389ds:
  job_prefix: '389ds-fedora/'
  update_packages: True
  copr_defined: True
```

--------------------------------

### Verbose logging output example

Source: https://freeipa.readthedocs.io/en/ipa-4-11/designs/ipa_to_ipa_migration.html

Example of the detailed log output generated when using the --verbose or -v CLI option.

```text
...
...
2024-02-28T15:30:53Z INFO Migrating database ... (this make take a while)
2024-02-28T15:30:53Z INFO Entry is different and will be updated: 'uid=admin,cn=users,cn=accounts,dc=hpe2,dc=lab,dc=eng,dc=bos,dc=redhat,dc=com' attribute 'ipaNTSecurityIdentifier' replaced with val 'S-1-5-21-404865364-1326736403-3398440945-501' old value: ['S-1-5-21-404865364-1326736403-3398440945-500']
2024-02-28T15:30:53Z INFO Add db entry 'uid=mark,cn=users,cn=accounts,dc=hpe2,dc=lab,dc=eng,dc=bos,dc=redhat,dc=com - users'
2024-02-28T15:30:53Z INFO Entry is different and will be updated: 'cn=HPE2.LAB.ENG.BOS.REDHAT.COM_id_range,cn=ranges,cn=etc,dc=hpe2,dc=lab,dc=eng,dc=bos,dc=redhat,dc=com' attribute 'ipaBaseID' replaced with val '9000999' old value: ['90000000']
2024-02-28T15:30:53Z INFO Entry is different and will be updated: 'cn=HPE2.LAB.ENG.BOS.REDHAT.COM_subid_range,cn=ranges,cn=etc,dc=hpe2,dc=lab,dc=eng,dc=bos,dc=redhat,dc=com' attribute 'ipaIDRangeSize' replaced with val '2147352575' old value: ['2147352576']
...
...
```

--------------------------------

### Bootstrap and finalize API

Source: https://freeipa.readthedocs.io/en/ipa-4-11/_sources/api/basic_usage.md

Initialize the API with the custom context and server mode enabled.

```python
from ipalib import api

api.bootstrap(context="custom", in_server=True)
api.finalize()
```
Tokens:
Raw