Revision as of 21:37, 6 September 2024

LDAP

Participants	Fwd
Skills	Linux, FreeIPA
Status	Implemented
Niche	Software
Purpose	Infrastructure
Tool	Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

Connected machines and services

Virtual Machines

You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.

services-1.lan.nurd.space
services-2.lan.nurd.space
gitlab.vm.nurd.space
minio.vm.nurd.space
navi.vm.nurd.space
gh-runner-almalinux.vm.nurd.space
gh-runner-debian.vm.nurd.space

All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.

TODO: Make this available for members without BOFH being involved.

Wiki

Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.

Gitlab

Wifi (Spacenet)

TODO: Is broken as of now

DHCP

See the network page.

(Un)locking the front door

See Network/Services/DoorLock.

@@ Line 1: / Line 1: @@
-{{Outdated}}
 {{Project
 |Name=LDAP
-|Skills=Linux, OpenLDAP, FreeRadius,
+|Skills=Linux, FreeIPA
-|Status=Finished
+|Status=Implemented
 |Niche=Software
 |Purpose=Infrastructure
@@ Line 12: / Line 11: @@
 = Connected machines and services =
-== Workstations ==
+== Virtual Machines ==
-* [[Hp_dc5800_sinterklaas|Sinterklaas]]
-* [[Dell_Optiplex_GX270|Vjdeb]]
-* [[PrinterPC]]
-* [[Sun_Ultra_1|plankton]]
-* [[BPM_Studio_Jukebox|BPM_Studio_Jukebox (all-in-one hark)]]
-The workstations listed above are set up as follows:
+You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.
-* Homedirs mounted over NFS from [[dumpster-a]] (except user 'printer' on [[PrinterPC]])
-* Users in the LDAP 'sudo' group can sudo.
-* Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
-== VM's ==
+* services-1.lan.nurd.space
-* [[NURDServices]] (only users in group "admins" can log in)
+* services-2.lan.nurd.space
-* [[Stroopwafel]] (a VM for all members to irssi or other processes)
+* gitlab.vm.nurd.space
+* minio.vm.nurd.space
+* navi.vm.nurd.space
+* gh-runner-almalinux.vm.nurd.space
+* gh-runner-debian.vm.nurd.space
+All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.
+TODO: Make this available for members without BOFH being involved.
 == Wiki ==
-Authentication on this wiki is done via SAML.
+Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.
+== Gitlab ==
-=== Limitations ===
-* The mediawiki login system converts the first character of usernames to uppercase due to [http://en.wikipedia.org/wiki/Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames restrictions on usernames]. To get around this we've enabled [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Changelog#v2.0a $wgLDAPLowercaseUsernameScheme]. This requires usernames to be all lowercase in the LDAP.
-* Users are maintained through the LDAP, so creating a user on the Wiki is no longer possible. It could be enabled, but that would require adding a user with write-access in the LDAP. That seems a little scary for now. It would however offer the possibility of changing your LDAP password through the Wiki.
 == Wifi (Spacenet) ==
-The LDAP serves as a userdb for [[Spacenet]], which is connected via FreeRADIUS. For full details see the [[Spacenet]]-page. Only users in group "spacenet" can log in.
+TODO: Is broken as of now
 == DHCP ==