Network/Roadmap/LDAPAuthentication: Difference between revisions

From NURDspace
No edit summary
No edit summary
Line 1: Line 1:
= Summary =
= Summary =
We would like to have LDAP auth on all our systems, based on FreeIPA.
We run an instance of FreeIPA that is used to manage all nurdspace users, groups and (internal) dns records. This setup will be made redundant as part of the [[Network/Roadmap/RedundantCoreServices|Redundant Core Services]] project.


= Dependencies =
= Using FreeIPA =
* <s>TLS certificates (both client and server)</s> See https://nurdspace.nl/Network/TLS
FreeIPA can be used via a webbrowser, or via CLI commands. Depending on the group, you will be able to manage your own details, or all infra details.
* Redundant LDAP (see https://nurdspace.nl/Network/Roadmap/RedundantCoreServices)
 
== Web UI ==
Navigate to the [https://ipa.nurd.space following url] and login with your LDAP credentials. Users and groups can be found under <tt>Identity -> Users</tt> and <tt>Identity -> Groups</tt>. DNS records and zones can be edited under <tt>Network Services -> DNS</tt>.
 
== CLI ==
Login to <tt>ipa.nurd.space</tt> using your LDAP credentials. Next, fetch a kerberos token using <tt>kinit</tt>. Once you have a valid ticket, you can use the <tt>ipa</tt> command to perform changes to users, groups and DNS. See [https://linux.die.net/man/1/ipa ipa(1)] for more information.

Revision as of 21:47, 6 September 2024

Summary

We run an instance of FreeIPA that is used to manage all nurdspace users, groups and (internal) dns records. This setup will be made redundant as part of the Redundant Core Services project.

Using FreeIPA

FreeIPA can be used via a webbrowser, or via CLI commands. Depending on the group, you will be able to manage your own details, or all infra details.

Web UI

Navigate to the following url and login with your LDAP credentials. Users and groups can be found under Identity -> Users and Identity -> Groups. DNS records and zones can be edited under Network Services -> DNS.

CLI

Login to ipa.nurd.space using your LDAP credentials. Next, fetch a kerberos token using kinit. Once you have a valid ticket, you can use the ipa command to perform changes to users, groups and DNS. See ipa(1) for more information.