mysql and freeipa

[Andrew Meyer]

I am trying to research how to setup MySQL/MariaDB to authenticate against FreeIPA/LDAP. 
I am running into some issues/confusion.
Do I need to add a new user account to tie mysql to?
I've been following this website:FreeIPA: Giving permissions to service accounts. —
Firstyear's blog-a-log

  
|  
|   |  
FreeIPA: Giving permissions to service accounts. — Firstyear's blog-a-log
 Firstyear`s blog-a-log  |  |

  |

 

I know that FreeRADIUS is not the same.  But has anyone else gotten this to work?  We have
tons of mysql servers and want our users who need mysql access to have 1 source of
authentication.

[Gordon Messmer]

On 10/31/2017 03:44 PM, Andrew Meyer via FreeIPA-users wrote:
>  I've been following this website:
>  FreeIPA: Giving permissions to service accounts. — Firstyear's 
>  blog-a-log 
>
> <http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_t...

None of that is particularly relevant unless you're specifically 
supporting MSCHAPv2 authentication.

The easiest solution for authenticating MySQL using FreeIPA is probably 
to join the MySQL server to the IPA domain and then use PAM authentication:

https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html

[Alexander Bokovoy]

On ti, 31 loka 2017, Gordon Messmer via FreeIPA-users wrote:
> On 10/31/2017 03:44 PM, Andrew Meyer via FreeIPA-users wrote:
> >
> >I've been following this website:
> >FreeIPA: Giving permissions to service accounts. — Firstyear's 
> >blog-a-log
> <http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_t...
>
>
> None of that is particularly relevant unless you're specifically 
> supporting MSCHAPv2 authentication.
>
> The easiest solution for authenticating MySQL using FreeIPA is 
> probably to join the MySQL server to the IPA domain and then use PAM 
> authentication:
>
> https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html 
If you are
using MariaDB instead of MySQL, it is possible to configure
GSSAPI (Kerberos) to authenticate. You'd still need to create users in
MariaDB database first so that it knows these are valid ones:
https://mariadb.com/kb/en/library/authentication-plugin-gssapi/

-- 
/ Alexander Bokovoy

[Robbie Harwood]

Alexander Bokovoy writes:

>  On ti, 31 loka 2017, Gordon Messmer via FreeIPA-users wrote:
> > On 10/31/2017 03:44 PM, Andrew Meyer via FreeIPA-users wrote:
> >
> >> I've been following this website:
> >> FreeIPA: Giving permissions to service accounts. — Firstyear's 
> >> blog-a-log
> <http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_t...
> >
> > None of that is particularly relevant unless you're specifically
> > supporting MSCHAPv2 authentication. 
... which you shouldn't do because it's broken:
https://www.schneier.com/blog/archives/2012/08/breaking_micros.html

> >The easiest solution for authenticating MySQL using FreeIPA is 
> >probably to join the MySQL server to the IPA domain and then use PAM 
> >authentication:
> >
> >https://dev.mysql.com/doc/refman/5.5/en/pam-pluggable-authentication.html
>
>  If you are using MariaDB instead of MySQL, it is possible to configure
>  GSSAPI (Kerberos) to authenticate. You'd still need to create users in
>  MariaDB database first so that it knows these are valid ones:
>  https://mariadb.com/kb/en/library/authentication-plugin-gssapi/ 
For interest: GSSAPI encryption is forthcoming, but stalled on mariadb
growing a proper plugin API.

Thanks,
--Robbie

[Gordon Messmer]

On 11/01/2017 09:46 AM, Robbie Harwood wrote:
> >> None of that is particularly relevant unless you're
> specifically
> >> supporting MSCHAPv2 authentication.
>  ... which you shouldn't do because it's broken:
>  https://www.schneier.com/blog/archives/2012/08/breaking_micros.html 
...and also not supported by MySQL, as far as I know.  I suppose I could 
have said that, but I thought it was obvious.  :)

[Andrew Meyer]

Thank you for the feedback. 

    On Wednesday, November 1, 2017 3:26 PM, Gordon Messmer via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org&gt; wrote:
 

  On 11/01/2017 09:46 AM, Robbie Harwood wrote:
  
 
 
 None of that is particularly relevant unless you're specifically
supporting MSCHAPv2 authentication.
 
 
 ... which you shouldn't do because it's
broken:https://www.schneier.com/blog/archives/2012/08/breaking_micros.html 
 
 ...and also not supported by MySQL, as far as I know.  I suppose I could have said that,
but I thought it was obvious.  :)
 _______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org