Network/Roadmap/LDAPAuthentication
Summary
We run an instance of FreeIPA that is used to manage all nurdspace users, groups and (internal) dns records. This setup will be made redundant as part of the Redundant Core Services project.
Using FreeIPA
FreeIPA can be used via a webbrowser, or via CLI commands. Depending on the group, you will be able to manage your own details, or all infra details.
Web UI
Navigate to the following url and login with your LDAP credentials. Users and groups can be found under Identity -> Users and Identity -> Groups. DNS records and zones can be edited under Network Services -> DNS.
CLI
Login to ipa.nurd.space using your LDAP credentials. Next, fetch a kerberos token using kinit. Once you have a valid ticket, you can use the ipa command to perform changes to users, groups and DNS. See ipa(1) for more information.
Doortoken
We use LDAP to store the doortokens that members use to open the front door. To add a new token, you need to perform a couple of steps, as described below:
First, open a shell on spacenanny.lan.nurd.space, and run the following command:
journalctl -fu tag-scanner
Ask the member to scan the token(s) they want to use at the front door. This will show the hash of the (as of yet) unknown tokens in the logging of tag-scanner. Make a note of these tokens.
Next, login to ipa.nurd.space using your LDAP credentials and fetch a kerberos token using kinit. Next, find the username of the member, and run the following command:
ipa user-mod USERNAME --dooraccesstoken=<hashoffirsttoken> --dooraccesstoken=<hashofsecondtoken>
Validate that the doortokens have been added using the following command. You should see a comma-separated list of base64 encoded tokens for the Door Access Token attribute:
ipa user-show USERNAME
Once you are satisfied, you need to upload the token using the following command:
doortoken.sh upload
This will generate a json file with a mapping of users+tokens, and uploads this to spacenanny.
Guest account for during events
Occasionally we have events where we want to grant guests temporary physical access. This is implemented using a set of tokens which are linked to the `nurdevent` user. There is a set of tokens in the infralalalala which are reserved for this purpose. To use this functionality, perform the following actions:
Before an event starts
- Enable the `nurdevent` user in IPA
- (optional) Bind tokens to the nurdevent user
- Upload the tokens using the `doortoken.sh` script
During an event
- Hand out tokens to guests
- Collect the tokens from the guests once they leave
Once an event is done
- Disable the `nurdevent` user in IPA
- Upload the tokens using the `doortoken.sh` script