(Created page with "= Summary = We would like to have LDAP auth on all our systems, based on OpenLDAP and sssd = Dependencies = * <s>TLS certificates (both client and server)</s> See https://nurdspace.nl/Network/TLS * Redundant LDAP (see https://nurdspace.nl/Network/Roadmap/RedundantCoreServices)") |
No edit summary |
||
| (3 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
= Summary = | = Summary = | ||
We | We run an instance of FreeIPA that is used to manage all nurdspace users, groups and (internal) dns records. This setup will be made redundant as part of the [[Network/Roadmap/RedundantCoreServices|Redundant Core Services]] project. | ||
= | = Using FreeIPA = | ||
FreeIPA can be used via a webbrowser, or via CLI commands. Depending on the group, you will be able to manage your own details, or all infra details. | |||
== Web UI == | |||
Navigate to the [https://ipa.nurd.space following url] and login with your LDAP credentials. Users and groups can be found under <tt>Identity -> Users</tt> and <tt>Identity -> Groups</tt>. DNS records and zones can be edited under <tt>Network Services -> DNS</tt>. | |||
== CLI == | |||
Login to <tt>ipa.nurd.space</tt> using your LDAP credentials. Next, fetch a kerberos token using <tt>kinit</tt>. Once you have a valid ticket, you can use the <tt>ipa</tt> command to perform changes to users, groups and DNS. See [https://linux.die.net/man/1/ipa ipa(1)] for more information. | |||
= Doortoken = | |||
We use LDAP to store the doortokens that members use to open the front door. To add a new token, you need to perform a couple of steps, as described below: | |||
First, open a shell on <tt>spacenanny.lan.nurd.space</tt>, and run the following command: | |||
journalctl -fu tag-scanner | |||
Ask the member to scan the token(s) they want to use at the front door. This will show the hash of the (as of yet) unknown tokens in the logging of <tt>tag-scanner</tt>. Make a note of these tokens. | |||
Next, login to <tt>ipa.nurd.space</tt> using your LDAP credentials and fetch a kerberos token using <tt>kinit</tt>. Next, find the username of the member, and run the following command: | |||
ipa user-mod USERNAME --dooraccesstoken=<hashoffirsttoken> --dooraccesstoken=<hashofsecondtoken> | |||
Validate that the doortokens have been added using the following command. You should see a comma-separated list of base64 encoded tokens for the <tt>Door Access Token</tt> attribute: | |||
ipa user-show USERNAME | |||
Once you are satisfied, you need to upload the token using the following command: | |||
doortoken.sh upload | |||
This will generate a json file with a mapping of users+tokens, and uploads this to spacenanny. | |||
Latest revision as of 22:25, 6 September 2024
Summary
We run an instance of FreeIPA that is used to manage all nurdspace users, groups and (internal) dns records. This setup will be made redundant as part of the Redundant Core Services project.
Using FreeIPA
FreeIPA can be used via a webbrowser, or via CLI commands. Depending on the group, you will be able to manage your own details, or all infra details.
Web UI
Navigate to the following url and login with your LDAP credentials. Users and groups can be found under Identity -> Users and Identity -> Groups. DNS records and zones can be edited under Network Services -> DNS.
CLI
Login to ipa.nurd.space using your LDAP credentials. Next, fetch a kerberos token using kinit. Once you have a valid ticket, you can use the ipa command to perform changes to users, groups and DNS. See ipa(1) for more information.
Doortoken
We use LDAP to store the doortokens that members use to open the front door. To add a new token, you need to perform a couple of steps, as described below:
First, open a shell on spacenanny.lan.nurd.space, and run the following command:
journalctl -fu tag-scanner
Ask the member to scan the token(s) they want to use at the front door. This will show the hash of the (as of yet) unknown tokens in the logging of tag-scanner. Make a note of these tokens.
Next, login to ipa.nurd.space using your LDAP credentials and fetch a kerberos token using kinit. Next, find the username of the member, and run the following command:
ipa user-mod USERNAME --dooraccesstoken=<hashoffirsttoken> --dooraccesstoken=<hashofsecondtoken>
Validate that the doortokens have been added using the following command. You should see a comma-separated list of base64 encoded tokens for the Door Access Token attribute:
ipa user-show USERNAME
Once you are satisfied, you need to upload the token using the following command:
doortoken.sh upload
This will generate a json file with a mapping of users+tokens, and uploads this to spacenanny.