Joining nodes to FreeIPA using a non-admin user

Tue, 09 Aug 2022 00:00:00 +0000

Typically Linux nodes are joined to FreeIPA using admin credentials. While this works, it exposes fully privileged credentials unnecessarily, for example when used within a configuration management system (see for example puppet-ipa).

Fortunately joining nodes to FreeIPA is possible with more limited privileges. The first step is to create a new FreeIPA role, e.g. “Enrollment administrator” with three privileges:

DNS Administrators
Host Administrators
Host Enrollment

Then you create a new user, e.g. “enrollment”, and join it to the “Enrollment administrator” role. After that you should be able to join nodes using that “enrollment” user.

Authenticate and authorize Grafana users from FreeIPA groups via Keycloak

Thu, 28 Jan 2021 00:00:00 +0000

Grafana is a common tool to visualize data from multiple datasources. Perhaps the most common datasource is Prometheus. If an organization has a Single-Sign On solution, it makes sense to authenticate users centrally with that solution That will make authentication easier and friendlier for end users (authenticate once and then access multiple services), and also enable stronger authentication by adding multifactor authentication.

In addition to authenticating user, it is also possible to authorize Grafana users based on their group membership.

Freeipa on Puppeteers Oy

Joining nodes to FreeIPA using a non-admin user

Authenticate and authorize Grafana users from FreeIPA groups via Keycloak