<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>Hello,</div>
<div><br>
</div>
<div>I would like to get freeipa to work with a proxy solution ( I currently have this working with an active directory/no trust authentication and sudo but no HBAC) including HBAC. I can get sudo to work but not HBAC. I see there is a ticket for this as
a new enhancement #4634 but wanted to confirm that there isn’t another way to accomplish this.</div>
</div>
</div>
<div><br>
</div>
<div>Here is my current configuration for proxy and this works OK:</div>
<div><br>
</div>
<div>
<div>[domain/mikey.com]</div>
<div>sudo_provider = ipa</div>
<div>ipa_domain = va2.b2c.mikey.com</div>
<div>id_provider = ipa</div>
<div>auth_provider = ipa</div>
<div>access_provider = ipa</div>
<div>ipa_hostname = ip-10-12-177-28.va2.b2c.mikey.com</div>
<div>chpass_provider = ipa</div>
<div>ipa_server = _srv_, ip-10-12-177-24.va2.b2c.mikey.com</div>
<div>ldap_tls_cacert = /etc/ipa/ca.crt</div>
<div><br>
</div>
<div>id_provider = proxy</div>
<div>proxy_lib_name = files</div>
<div>auth_provider = ldap</div>
<div>reconnection_retries = 3</div>
<div>ldap_uri = ldap://adldaplb.mikey.com</div>
<div>ldap_search_base = dc=ad,dc=mikey,dc=com?subtree?</div>
<div>ldap_schema = AD</div>
<div>ldap_default_authtok_type = password</div>
<div>ldap_network_timeout = 120</div>
<div>ldap_opt_timeout = 120</div>
<div>ldap_search_timeout = 120</div>
<div>ldap_id_use_start_tls = false</div>
<div>ldap_user_object_class = user</div>
<div>ldap_group_object_class = group</div>
<div>ldap_user_name = sAMAccountName</div>
<div>enumerate = true</div>
<div>ldap_referrals = true</div>
<div>ldap_tls_reqcert = allow</div>
<div>ldap_tls_cacertdir = /etc/openldap/cacerts</div>
<div>ldap_access_filter = *</div>
<div>case_sensitive = false</div>
<div>lookup_family_order = ipv4_only</div>
<div>dns_resolver_timeout = 30</div>
<div>cache_credentials = false</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks for your help,</div>
<div><br>
</div>
<div>Warren Birnbaum</div>
</body>
</html>