Network/Roadmap/LDAPAuthentication

Summary

We run an instance of FreeIPA that is used to manage all nurdspace users, groups and (internal) dns records. This setup will be made redundant as part of the Redundant Core Services project.

Using FreeIPA

FreeIPA can be used via a webbrowser, or via CLI commands. Depending on the group, you will be able to manage your own details, or all infra details.

Web UI

Navigate to the following url and login with your LDAP credentials. Users and groups can be found under Identity -> Users and Identity -> Groups. DNS records and zones can be edited under Network Services -> DNS.

CLI

Login to ipa.nurd.space using your LDAP credentials. Next, fetch a kerberos token using kinit. Once you have a valid ticket, you can use the ipa command to perform changes to users, groups and DNS. See ipa(1) for more information.

Doortoken

We use LDAP to store the doortokens that members use to open the front door. To add a new token, you need to perform a couple of steps, as described below:

First, open a shell on spacenanny.lan.nurd.space, and run the following command:

journalctl -fu tag-scanner

Ask the member to scan the token(s) they want to use at the front door. This will show the hash of the (as of yet) unknown tokens in the logging of tag-scanner. Make a note of these tokens.

Next, login to ipa.nurd.space using your LDAP credentials and fetch a kerberos token using kinit. Next, find the username of the member, and run the following command:

ipa user-mod USERNAME --dooraccesstoken=<hashoffirsttoken> --dooraccesstoken=<hashofsecondtoken>

Validate that the doortokens have been added using the following command. You should see a comma-separated list of base64 encoded tokens for the Door Access Token attribute:

ipa user-show USERNAME

Once you are satisfied, you need to upload the token using the following command:

TODO: need to write script.