HowTos

Working with FreeIPA

• Change Directory Manager password

• Creating permissions

• [https://fy.blackhats.net.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_service_accounts..html Giving permissions to service accounts]

• DNS classless IN-ADDR.ARPA delegation - How to delegate reverse zone for e.g. 192.0.2.0/26 and not only /24

• DNS updates and zone transfers with TSIG

• DNS in isolated networks - Adding root zone to IPA

• DNSSEC

• IPA (DNS) Locations

• Updating FreeIPA system DNS records on a remote DNS server

• Firewall (iptables) rules for common FreeIPA server

• FreeIPA with integrated BIND inside chroot

• Delegate DNS zone management to users

• Migrating FreeIPA to new machines

  • Migrating FreeIPA servers with CA installed prior to 3.1

• Setting up S4U2Proxy with FreeIPA

• Host based access control and allow_all

• Inspecting the PAC

• Hardening FreeIPA for servers exposed on the Internet

• Let’s Encrypt certificate installation for FreeIPA web UI

• Using FreeIPA JSON API: example with Perl ; supported API commands

• Lightweight Sub-CAs in FreeIPA 4.4

• Configuring IPA’s OCSP to use with httpd and mod_nss

• Wildcard certificates

• Recover from a deleted admin user

Interoperability with other systems

• Create a Trust between FreeIPA and Active Directory

• Using third party Certificates

• NIS accounts migration preserving Passwords

• Samba 3 Integration – guide involves patching the code!

• Adding a KRA to an IPA Installation (proof of concept) (Partially integrated into FreeIPA 4.2+, see Vault)

• How to use FreeIPA in AWS EC2

• DokuWiki authLDAP and freeIPA / Enterprise IPA

• ISC DHCPd and Dynamic DNS updates

• Integration with Apache Synscope Identity Management system

• Tunelling Kerberos over HTTP on a firewalled network

• PolicyKit integration

• HowTo/FreeIPA_on_banana_pi

Windows

• Implementing FreeIPA in a mixed Environment (Windows/Linux) - Step by step

• Windows authentication against FreeIPA

UNIX

• Generic LDAP configuration

• FreeBSD client configuration

• FreeBSD custom binary package repository

• Configuring IBM AIX Clients

• Configuring Unix Clients (Solaris / HP-UX / AIX)

• Using FreeIPA for User Authentication on Mac OS X 10.7/10.8

• HowTo/Setup FreeIPA Services for MacOS X 10.12/10.13

3rd party Applications Integration

General

• FreeIPA demonstration tools

• SUDO client how-to (using SSSD)

• SUDO Integration for RHEL 5.8

• SUDO Integration for AIX

Mail Services

• Dovecot Integration

• Dovecot IMAPS Integration with FreeIPA using Single Sign On

• Postfix relaying using IPA for Kerberos Authentication

• Zimbra Collaboration Server 7.2 Authentication and GAL lookups against FreeIPA

• Kerberizing PostgreSQL with FreeIPA for Keystone (see related discussion)

Web Services

• Setting up MediaWiki to run against FreeIPA

• Apache and Kerberos for Django Authentication + Authorization

• LDAP authentication for Atlassian JIRA using FreeIPA

• LDAP authentication for JIRA using FreeIPA

• Using IPA server and sssd for web application’s authentication and identity needs

• Setting up Redmine to authenticate users against FreeIPA

• Setting up Rhodecode to authenticate users against FreeIPA

• Setting up The Bug Genie to authenticate users against FreeIPA

Web Infrastructure

• Squid Integration with FreeIPA using Single Sign On

• FreeIPA behind SSL proxy

• FreeIPA behind HTTP proxy with different hostname

• FreeIPA behind load balancer

Instant Messaging

• eJabberd Integration with FreeIPA using LDAP Group memberships

Virtualization

• Authenticating libvirt (with VNC) against IPA

• Setup IPA Server + Client with Vagrant VMs - sample Vagrantfile

• vSphere 5 integration

OpenShift

• OpenShift Broker and IPA DNS Server with Dynamic Updates with GSS-TSIG

• OpenShift Broker Apache + mod_auth_kerb for IdM

• OpenShift Enterprise on top of a trust between IPA/IdM and Windows Active Directory

OpenStack

• Keystone integration with IdM (FreeIPA)

Certificates

• Lets Encrypt With FreeIPA: Scripts to use Let’s Encrypt certs with FreeIPA

• Implementing SNI on Apache with IPA for certificate management and Kerberos Authentication

• Using FreeIPA CA for Puppet

• Puppet: Using the FreeIPA PKI (outdated)

• Recovering from expired CA subsystem certificates in IPA 2.x

• Promoting a self-signed IPA CA

• CA Certificate Renewal

• Promoting a CA to Renewal and CRL Master

• Client certificate authentication with LDAP

Authentication

• Creating a binddn for Foreman

• YubiRadius integration with group-validated FreeIPA Users using LDAPS

• NFS and FreeIPA integration (at linux-nfs.org)

• NFS and FreeIPA integration (at linsec.ca)

• Integration with Okta SSO

• Using FreeIPA and FreeRadius as a RADIUS based software token OTP system with CentOS/RedHat 7

• FreeRadius and FreeIPA: deployment considerations

  • Using mschapv2 with FreeIPA

• Pulse Secure device authentication

• Using Yubikey 4 Nano to authenticate to FreeIPA enrolled host

Storage

• Setup Kerberised NFS server on ONTAP with FreeIPA

• NetApp integration in a mixed environment

• NexentaStor integration in a mixed environment

• Integrating a Samba File Server With IPA

• Synology NAS DSM and FreeIPA Setup for Samba, NFS and Kerberos

• Integrating Dell EMC Unity with IPA

• Integrating Dell EMC Isilon OneFS with IPA

Content Distribution Systems

• Plan: FreeIPA and OpenShift Enterprise integration with Puppet

• Using IPA’s CA for Puppet

Logging

• Howto/Centralised Logging with Logstash/ElasticSearch/Kibana

Fancy things (user Avatars etc.)

• Adding Display Pictures/Avatars to Red Hat IDM/FreeIPA

• Loading Display Pictures/Avatars from Red Hat IDM/FreeIPA into GNOME3

___

How to add an HowTo on this wiki