<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/01/2017 10:59,
<a class="moz-txt-link-abbreviated" href="mailto:hirofumi.morikawa@accenture.com">hirofumi.morikawa@accenture.com</a> wrote:<br>
</div>
<blockquote
cite="mid:%3Cb6ee03f3411945eda2ff416da6302eca@BY2PR42MB168.048d.mgd.msft.net%3E"
type="cite">
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:JA">Let me further
clarify the question that is asked by Niraj below.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:JA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:JA">Currently, we
have 1 master FreeIPA server and 1 client server. Evaluating
your product for production deployment<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:JA">Master and
client connectivity is established and when creating the user
in the web console, it is indeed creating the user in the
client machine
<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:JA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="color:#1F497D;mso-fareast-language:JA">However, When we
add public key through the web console below, this key is not
created(or transfered) to the client machine</span></p>
</blockquote>
<p><br>
</p>
<p>That's correct: it doesn't copy them anywhere, nor is it supposed
to.</p>
<p>Instead, the keys sit in the FreeIPA LDAP database. When you
install the ipa-client package on a host, it configures sshd so it
communicates via sssd to query the authorized keys in LDAP. You
will find:<br>
</p>
<p># /etc/ssh/sshd_config<br>
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys</p>
<p># /etc/sssd/sssd.conf<br>
[sssd]<br>
services = nss, pam, ssh, sudo<br>
</p>
<p>That means you have central control of your authorized_keys with
FreeIPA, without copying them onto every hosts' filesystem.</p>
<p>You also have central control of your user accounts, group
memberships, uid and gid mappings, sudo policy, host access policy
(i.e. which users are allowed to login to which hosts), ... All
this is done via sssd and LDAP as well.</p>
<p>HTH,</p>
<p>Brian.<br>
</p>
</body>
</html>