Latest revision as of 21:48, 6 September 2024

LDAP

Participants	Fwd
Skills	Linux, FreeIPA
Status	Implemented
Niche	Software
Purpose	Infrastructure
Tool	Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

We are currently running on FreeIPA.

Connected machines and services

Virtual Machines

You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.

services-1.lan.nurd.space
services-2.lan.nurd.space
gitlab.vm.nurd.space
minio.vm.nurd.space
navi.vm.nurd.space
gh-runner-almalinux.vm.nurd.space
gh-runner-debian.vm.nurd.space

All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.

TODO: Make this available for members without BOFH being involved.

Wiki

Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.

Gitlab

See our Gitlab instance

Wifi (Spacenet)

TODO: Is broken as of now

DHCP

See the network page.

(Un)locking the front door

See the Door lock page.

@@ Line 1: / Line 1: @@
-{{Outdated}}
 {{Project
 |Name=LDAP
-|Skills=Linux, OpenLDAP, FreeRadius,
+|Skills=Linux, FreeIPA
-|Status=Finished
+|Status=Implemented
 |Niche=Software
 |Purpose=Infrastructure
@@ Line 9: / Line 8: @@
 }}
 = Status =
+We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]].
 = Connected machines and services =
-== Workstations ==
+== Virtual Machines ==
-* [[Hp_dc5800_sinterklaas|Sinterklaas]]
-* [[Dell_Optiplex_GX270|Vjdeb]]
+You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.
-* [[PrinterPC]]
-* [[Sun_Ultra_1|plankton]]
+* services-1.lan.nurd.space
-* [[BPM_Studio_Jukebox|BPM_Studio_Jukebox (all-in-one hark)]]
+* services-2.lan.nurd.space
+* gitlab.vm.nurd.space
+* minio.vm.nurd.space
+* navi.vm.nurd.space
+* gh-runner-almalinux.vm.nurd.space
+* gh-runner-debian.vm.nurd.space
-The workstations listed above are set up as follows:
+All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.
-* Homedirs mounted over NFS from [[dumpster-a]] (except user 'printer' on [[PrinterPC]])
-* Users in the LDAP 'sudo' group can sudo.
-* Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
-== VM's ==
+TODO: Make this available for members without BOFH being involved.
-* [[NURDServices]] (only users in group "admins" can log in)
-* [[Stroopwafel]] (a VM for all members to irssi or other processes)
 == Wiki ==
-Authentication on this wiki is done via SAML.
+Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.
-=== Limitations ===
+== Gitlab ==
-* The mediawiki login system converts the first character of usernames to uppercase due to [http://en.wikipedia.org/wiki/Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames restrictions on usernames]. To get around this we've enabled [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Changelog#v2.0a $wgLDAPLowercaseUsernameScheme]. This requires usernames to be all lowercase in the LDAP.
+See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]]
-* Users are maintained through the LDAP, so creating a user on the Wiki is no longer possible. It could be enabled, but that would require adding a user with write-access in the LDAP. That seems a little scary for now. It would however offer the possibility of changing your LDAP password through the Wiki.
 == Wifi (Spacenet) ==
-The LDAP serves as a userdb for [[Spacenet]], which is connected via FreeRADIUS. For full details see the [[Spacenet]]-page. Only users in group "spacenet" can log in.
+TODO: Is broken as of now
 == DHCP ==
@@ Line 42: / Line 42: @@
 == (Un)locking the front door ==
-See [[Spacelock]].
+See the [[Network/Services/DoorLock|Door lock page]].