<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 04/28/2014 11:23 AM, Stephen Benjamin wrote: </div> <blockquote cite="mid:1373660707.7503741.1398676998871.JavaMail.zimbra@redhat.com" type="cite"> <pre wrap=""> ----- Original Message ----- </pre> <blockquote type="cite"> <pre wrap="">From: "Jakub Hrozek" <a class="moz-txt-link-rfc2396E" href="mailto:jhrozek@redhat.com"><jhrozek@redhat.com></a> To: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Sent: Monday, April 28, 2014 10:55:16 AM Subject: Re: [Freeipa-users] FreeIPA + Foreman 1.5 On Fri, Apr 25, 2014 at 04:16:11AM -0400, Stephen Benjamin wrote: </pre> <blockquote type="cite"> <pre wrap="">----- Original Message ----- </pre> <blockquote type="cite"> <pre wrap="">From: "Jan Cholasta" <a class="moz-txt-link-rfc2396E" href="mailto:jcholast@redhat.com"><jcholast@redhat.com></a> To: "Martin Kosek" <a class="moz-txt-link-rfc2396E" href="mailto:mkosek@redhat.com"><mkosek@redhat.com></a>, <a class="moz-txt-link-abbreviated" href="mailto:dpal@redhat.com">dpal@redhat.com</a>, "Stephen Benjamin" <a class="moz-txt-link-rfc2396E" href="mailto:stbenjam@redhat.com"><stbenjam@redhat.com></a> Cc: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Sent: Friday, April 25, 2014 9:44:37 AM Subject: Re: [Freeipa-users] FreeIPA + Foreman 1.5 </pre> </blockquote> <pre wrap=""> </pre> <blockquote type="cite"> <pre wrap="">AFAIK you can use ldap sudo provider with IPA, see e.g. <a class="moz-txt-link-rfc2396E" href="http://fedoraproject.org/wiki/QA:Testcase_freeipav3_sudo_sssd#Configure_SSSD"><http://fedoraproject.org/wiki/QA:Testcase_freeipav3_sudo_sssd#Configure_SSSD></a> </pre> </blockquote> <pre wrap=""> I got this working, and seems to work across recent Fedora releases too. This at least removes the requirement on using the old bind password method. Thanks! </pre> </blockquote> <pre wrap=""> In recent Fedora releases, where the IPA sudo provider is available, the "legacy" LDAP provider should not be used. There might be problems with enumeration for instance when combining two different providers. </pre> </blockquote> <pre wrap=""> Can I have a link then to how this is setup? Do you also need the LDAP URL's, nisdomain, etc? Or is it just one setting and done? </pre> <blockquote type="cite"> <blockquote type="cite"> <pre wrap=""> Is there a way for sssd to use _srv_ for the krb5_server line? </pre> </blockquote> <pre wrap=""> Yes, it should just work. </pre> <blockquote type="cite"> <pre wrap=""> Here's an updated Kickstart snippet: <a class="moz-txt-link-freetext" href="https://github.com/stbenjam/community-templates/blob/freeipa-fixes/snippets/freeipa_register.erb">https://github.com/stbenjam/community-templates/blob/freeipa-fixes/snippets/freeipa_register.erb</a> If we know what the Syntax will be for sudo (or will it be default in 4.0?), then I can include the logic already not to do it manually. </pre> </blockquote> <pre wrap=""> Sorry, I'm not sure I understand the question? With recent enough clients (6.6+, 7.0+, any supported Fedora) you should use sudo_provider=ipa, with older ones you should use sudo_provider=ldap </pre> </blockquote> <pre wrap=""> It's been mentioned elsewhere in the thread that the ipa-client-install in some feature version will do this, if that's the case I shouldn't be doing in a kickstart snippet. Will it be like automount: ipa-client-automount, or will it be an install flag? Does it exist yet? </pre> </blockquote> It will be the default behaviour, that is, a flag will be available to turn it off (--no-sudo). Yes, patches are on review and close to being pushed (waiting for the CI coverage), it will be the part of the next upstream release. <blockquote cite="mid:1373660707.7503741.1398676998871.JavaMail.zimbra@redhat.com" type="cite"> <pre wrap=""> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </pre> </blockquote> <pre class="moz-signature" cols="72">-- Tomas Babej Associate Software Engineer | Red Hat | Identity Management RHCE | Brno Site | IRC: tbabej | freeipa.org </pre> </body> </html>