[Freeipa-users] Minimal permissions for "joiner" account?

[Michael Lasevich]

I wanted to use the python ipalib directly, but like you mentioned, I found
very little documentation and what I found indicated I was going to just
pass cli arguments to it, it seemed to be not much better than calling the
wrapper directly :-(

I will clean up my salt reactor of things specific to my install (mostly
just validating host against AWS and pulling AWS info to be added to the
host description fields) and try to add it to the salt-forumulas - then we
can link to it from the how-tos, etc. If someone is interested sooner, I
can post it here for time being.

As far as Host-Enrollment vs Host-Administrators privileges - it may be
that I am mixing up 2 ways to enroll hosts. My original attempt was to try
to have an "enroller" account that would add client directly from the
client - but I have relented and switched to a more proper method of adding
a host entrue with a generated OTP for the client followed by joining of
that client from the client itself with the OTP password. This works, but
when I try to add host entry with OTP password using account with only
"Host Enrollment" privilege I get:

ipa: ERROR: Insufficient access: Insufficient 'add' privilege to the
'userPassword' attribute

I really would like to have minimal privileges for my "adder" account, but
at least this account is only available on a much more restricted server
(salt-master) where only limited admins have access to it. For now I am
granting it the "Host Administrators" privilege, as it is what works.

-M



On Fri, Aug 15, 2014 at 9:26 AM, Petr Viktorin <pviktori at redhat.com> wrote:

> On 08/15/2014 06:02 PM, James wrote:
>
>> On Fri, Aug 15, 2014 at 5:25 AM, Michael Lasevich
>> <mlasevich at lasevich.net> wrote:
>>
>>> Sorry, I did not intend to belittle your efforts - just misread the code
>>>
>> Didn't take it that way, no worries :)
>>
>>  (saw you pass in $admin and $password and made wrong assumption that
>>> $admin
>>> was admin username) as well as trying to avoid puppet as I find Salt much
>>> quicker and much simpler (and already established in my setup)
>>>
>>> I sat down tonight and threw together a quick salt reactor that does same
>>> thing as your module - creates the host account in IPA with a generated
>>> OTP
>>> password and joins the host to the domain using that generated OTP (and
>>> while at it, validates the host against AWS and populates the metadata
>>> into
>>> IPA) Ended up having to join the salt master to the domain, which I was
>>> avoiding doing for security reasons, but I can just disable IPA logins in
>>> PAM and call it a day. The nice bit is that it is using the host's keytab
>>> for authentication, so I do not need any extra credentials sitting
>>> around.
>>> Seems to be working just fine. :-). I ended up granting the salt-master
>>> host
>>> the "Host Administrators" privilege. It seems that "Host Enrollment"
>>> privilege is not sufficient to enroll hosts -  go figure.
>>>
>> Great!
>>
>>
>>> The only thing that bugs me is that I am calling IPA python code from my
>>> salt reactor python code via subprocess - there has got to be a better,
>>> more
>>> direct way -  but I found documentation too confusing to follow at 1 am -
>>> will be a project for another day.
>>>
>> There is the python ipa API, not sure how stable or official it is,
>> but if you look in my code I use it occasionally.
>>
>
> The RPC API is not official (i.e. documented), but since IPA needs to keep
> backwards compatibility with its own client, it's very stable.
>
> Just be sure to send the API version with each call. (The server will send
> a warning if you don't.)
>
>
> --
> Petr³
>
>
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go To http://freeipa.org for more info on the project
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20140818/dec42fbc/attachment.htm>