Add "Puppet Enterprise" to the list of things that do not actively support FreeIPA

[White, Daniel E. (GSFC-770.0)[NICS]]

Sad.

https://puppet.com/docs/pe/2019.2/rbac_ldap_intro.html#connect_to_an_exte...

It has

Example Active Directory settings

and

Example OpenLDAP settings

I tried using the OpenLDAP side, but the queries I see in the access logs are looking for
objectClasses like ipaNTTrustedDomain and other names starting with ipaNT*

Anyone out there using FreeIPA for authentication to Puppet Enterprise ?
______________________________________________________________________________________________

Daniel E. White
[e-mail]<mailto:[e-mail]>
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: [phone]
Mobile: [phone]

[Louis Abel]

Based on what I'm reading here:
https://puppet.com/docs/pe/2019.0/rbac_ldap_intro.html

Assuming puppet enterprise lets you change settings, you would need to make these
changes:

* User login attribute from "cn" to "uid"

* User relative distinguished name to: cn=users,cn=accounts

* group object class from "groupOfUniqueNames" to "groupOfNames"

* group membership field from "uniqueMember" to "member"

* group relative distinguished name to "cn=groups,cn=accounts"

And again, that is assuming it lets you change those. You may need to ask puppet's
support for help on those things.

[EXTERNAL] Re: Add "Puppet Enterprise" to the list of things that do not actively support FreeIPA

[White, Daniel E. (GSFC-770.0)[NICS]]

Thanks for responding, Louis.

Sadly, I did all that and got a bunch of queries looking for objectClass
ipaNTTrustedDomain and other ipaNT* objectClasses
I have opened a feature request with Puppet for FreeIPA support.
https://tickets.puppetlabs.com/browse/ENTERPRISE-1323
______________________________________________________________________________________________

Daniel E. White
[e-mail]<mailto:[e-mail]>
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: [phone]
Mobile: [phone]

From: FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
Reply-To: FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
Date: Thursday, March 12, 2020 at 23:13
To: FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Louis Abel <tucklesepk(a)gmail.com&gt;
Subject: [EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the list of
things that do not actively support FreeIPA

Based on what I'm reading here:
https://puppet.com/docs/pe/2019.0/rbac_ldap_intro.html

Assuming puppet enterprise lets you change settings, you would need to make these
changes:

* User login attribute from "cn" to "uid"

* User relative distinguished name to: cn=users,cn=accounts

* group object class from "groupOfUniqueNames" to "groupOfNames"

* group membership field from "uniqueMember" to "member"

* group relative distinguished name to "cn=groups,cn=accounts"

And again, that is assuming it lets you change those. You may need to ask puppet's
support for help on those things.

[EXTERNAL] Re: Add "Puppet Enterprise" to the list of things that do not actively support FreeIPA

[Rob Crittenden]

White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote:
>  Thanks for responding, Louis.
>  
>   
>  
>  Sadly, I did all that and got a bunch of queries looking for objectClass
>  ipaNTTrustedDomain and other ipaNT* objectClasses
>  
>  I have opened a feature request with Puppet for FreeIPA support.
>  
>  https://tickets.puppetlabs.com/browse/ENTERPRISE-1323 
Note that these queries are IPA objectclasses related to trusts.

Are you sure these are originating from puppet?

rob

>  
>
> *______________________________________________________________________________________________*
>  
>  * *
>  
>  *Daniel E. White**
>  **daniel.e.white(a)nasa.gov <mailto:[e-mail]>***
>  
>  *NICS Linux Engineer
>  NASA Goddard Space Flight Center
>  8800 Greenbelt Road
>  Building 14, Room E175
>  Greenbelt, MD 20771***
>  
>  *Office: [phone]***
>  
>  *Mobile: [phone]*
>  
>   
>  
>  *From: *FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
>  *Reply-To: *FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
>  *Date: *Thursday, March 12, 2020 at 23:13
>  *To: *FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
>  *Cc: *Louis Abel <tucklesepk(a)gmail.com&gt;
>  *Subject: *[EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the
>  list of things that do not actively support FreeIPA
>  
>   
>  
>  Based on what I'm reading here:
>  https://puppet.com/docs/pe/2019.0/rbac_ldap_intro.html
>  
>   
>  
>  Assuming puppet enterprise lets you change settings, you would need to
>  make these changes:
>  
>   
>  
>  * User login attribute from "cn" to "uid"
>  
>   
>  
>  * User relative distinguished name to: cn=users,cn=accounts
>  
>   
>  
>  * group object class from "groupOfUniqueNames" to "groupOfNames"
>  
>   
>  
>  * group membership field from "uniqueMember" to "member"
>  
>   
>  
>  * group relative distinguished name to "cn=groups,cn=accounts"
>  
>   
>  
>  And again, that is assuming it lets you change those. You may need to
>  ask puppet's support for help on those things.
>  
>   
>  
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>

[EXTERNAL] Re: Add "Puppet Enterprise" to the list of things that do not actively support FreeIPA

[White, Daniel E. (GSFC-770.0)[NICS]]

They are coming from Puppet

In the IdM access log - I see a block of stuff starting with "connection from
<Puppet's IP> to <IdM's IP>

I used cn, mail, displayName, group, member
I did not set the user/group relative DN as it was marked (optional)

______________________________________________________________________________________________

Daniel E. White
[e-mail]<mailto:[e-mail]>
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: [phone]
Mobile: [phone]

From: Rob Crittenden <rcritten(a)redhat.com&gt;
Date: Friday, March 13, 2020 at 10:43
To: FreeIPA <freeipa-users(a)lists.fedorahosted.org&gt;
Cc: Louis Abel <tucklesepk(a)gmail.com&gt;, Daniel White
<daniel.e.white(a)nasa.gov&gt;
Subject: Re: [Freeipa-users] Re: [EXTERNAL] Re: Add "Puppet Enterprise" to the
list of things that do not actively support FreeIPA

White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote:
Thanks for responding, Louis.

Sadly, I did all that and got a bunch of queries looking for objectClass
ipaNTTrustedDomain and other ipaNT* objectClasses
I have opened a feature request with Puppet for FreeIPA support.
https://urldefense.proofpoint.com/v2/url?u=https-3A__tickets.puppetlabs.c...

Note that these queries are IPA objectclasses related to trusts.

Are you sure these are originating from puppet?

rob

*______________________________________________________________________________________________*
*From: *FreeIPA
<[e-mail]<mailto:[e-mail]>>
*Reply-To: *FreeIPA
<[e-mail]<mailto:[e-mail]>>
*Date: *Thursday, March 12, 2020 at 23:13
*To: *FreeIPA
<[e-mail]<mailto:[e-mail]>>
*Cc: *Louis Abel <[e-mail]<mailto:[e-mail]>>
*Subject: *[EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the
list of things that do not actively support FreeIPA

Based on what I'm reading here:
https://urldefense.proofpoint.com/v2/url?u=https-3A__puppet.com_docs_pe_2...

Assuming puppet enterprise lets you change settings, you would need to
make these changes:

* User login attribute from "cn" to "uid"

* User relative distinguished name to: cn=users,cn=accounts

* group object class from "groupOfUniqueNames" to "groupOfNames"

* group membership field from "uniqueMember" to "member"

* group relative distinguished name to "cn=groups,cn=accounts"

And again, that is assuming it lets you change those. You may need to
ask puppet's support for help on those things.