<div dir="ltr">(belated response)<div><br></div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Sep 14, 2014 at 12:10 AM, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div><div class="h5">
<div>On 09/13/2014 04:03 PM, Traiano Welcome
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>Hi List</div>
<div> </div>
<div>Currently I have a stable trust relationship going between
IPA and Windows AD. I create users and manage passwords in AD,
but want to manage the rest in IPA, "the rest" being default
shell, default home directory settings, RBAC, HBAC, Selinux
etc ..</div>
<div> </div>
<div>What I'm expecting it to be able to log into the FreeIPA
web interface, and see a synched list of users created in AD
appear in the interface, after which I can modify the settings
on a per user basis. </div>
<div> </div>
<div>If that level of granularity is not possible, I would then
expect to be able to at least apply an IPA-imposed set of
account defaults on and AD user group:</div>
<div> </div>
<div>- default shell</div>
<div>- HBAC rules</div>
<div>- Sudo rules</div>
<div>- SELinux rules</div>
<div>- RBAC</div>
<div> </div>
<div>Is this possible with FreeIPA? I can't find anything
coherent in the documentation that describes an effective way
of managing the POSIX attributes of AD users in FreeIPA.</div>
<div> </div>
<div>Thanks in advance!</div>
<div>Traiano</div>
<div> </div>
<div> </div>
<div> </div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote></div></div>
You are to some extent describing a feature that we call "views"
that is currently in works.<br>
But there are two parts:<br>
a) Ability to overwrite POSIX attributes for AD users - this is
views<br>
<a href="https://fedorahosted.org/freeipa/ticket/3318" target="_blank">https://fedorahosted.org/freeipa/ticket/3318</a><br>
<a href="https://fedorahosted.org/freeipa/ticket/4509" target="_blank">https://fedorahosted.org/freeipa/ticket/4509</a><br>
</div></blockquote><div><br></div><div><br></div><div>This is exactly the feature I had in mind!</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000">b) Ability to apply policies to AD users. It is already possible.<br>
This is done via group membership.<br>
So you create a group in IPA, make AD group an external member of
that group and then use that IPA group to apply HBAC, SUDO and
SELinux rules.<br>
<br></div></blockquote><div><br></div><div><br></div><div>For the interim, this seems to meet the need. Seems to work reliably in tests as long as one keeps a spreadsheet of AD group mappings to IdM user rights. Requires some coordination with the local AD administrator :-)</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000">
As for RBAC what do you mean?</div></blockquote><div><br></div><div><br></div><div>By RBAC, I mean to define linux server user "roles" with a certain profile of sudo rights, selinux policies and host access rules which one could apply to individual users without grouping them. Although, conceptually it appears that there's little difference in using user groups to represent the same type of "container" as a role would. However, I suppose the user groups mechanism essentially achieves the same objective. </div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000"><span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
<pre cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</font></span></div>
<br>--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br></blockquote></div><br></div></div>