Hi i'm new to this channel and i'm studying the FreeIPA code in order to understand how things works, so i was wondering how FreeIPA works with 389 Directory Server in order to create the LDAP database and how dose it syncs with the OS users, if you can provide me a link to the code or a brief explanation on how it works it would be very appreciated. Also I was thinking if for FreeIPA it would be possible to support other Directory server such as OpenLDAP or it dose already support other servers, in this case does someone knows which other LDAP server does support, thanks a lot to everyone.
On ke, 21 joulu 2022, Federico Ferrari via FreeIPA-users wrote:
Hi i'm new to this channel and i'm studying the FreeIPA code in order to understand how things works, so i was wondering how FreeIPA works with 389 Directory Server in order to create the LDAP database and how dose it syncs with the OS users, if you can provide me a link to the code or a brief explanation on how it works it would be very appreciated. Also I was thinking if for FreeIPA it would be possible to support other Directory server such as OpenLDAP or it dose already support other servers, in this case does someone knows which other LDAP server does support, thanks a lot to everyone.
FreeIPA is a solution which comprised of several components, both on server and client sides. The server side is tightly integrated and none of the server side components can be replaced. Client side is mostly an installer that configures your system to use SSSD to operate. SSSD can talk to multiple directory services, including FreeIPA, Active Directory implementations, or generic LDAP servers, among others.
You cannot replace 389-ds server in FreeIPA with OpenLDAP. FreeIPA implements 15 specialized plugins to 389-ds and relies on specific 389-ds integrated plugins and behaviors to provide functionality you see as 'FreeIPA'. Replacing 389-ds with OpenLDAP would mean a rewrite of majority of those plugins from scratch as LDAP server APIs are not compatible. This certainly would not be a FreeIPA server anymore.
Same with MIT Kerberos KDC integration. FreeIPA provides own database driver to MIT Kerberos KDC which implements a lot of specialized logic which standard ldap KDB driver in MIT Kerberos does not implement at all. FreeIPA KDB driver complexity is on par with Samba AD database driver.
You may want to read through the presentations and pages referenced at https://www.freeipa.org/page/Documentation#Developer_Documentation. It gives a lot of information and helps to understand some decisions made during FreeIPA development. We aren't updating freeipa.org anymore but https://freeipa.readthedocs.io/en/latest/designs/index.html contains recent design documents for all new features which went into FreeIPA during past several years.
Recently I have been working on reconstructing a high level architecture view of FreeIPA from administrators' point of view. It does not include anything detailed but should help at least with authentication and access flows. It does not cover certificate management or IPA objects' management at all too. May be it would be useful to review too: https://talks.vda.li/talks/2022/freeipa-high-level-architecture.pdf
The FreeIPA source code is a must to look into as well. You'll find various references in the design pages to specific areas but you need to read through C and Python code and know about LDAP schema to get through all of that. There is no shortcut. ;)
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Federico Ferrari