Nginx in front of IPA?

Hi,

We have an "interesting" set up here and ultimately it means that some of our users are on a network that can't access the domain that the IPA servers are on so can't reset their passwords. However, they do have access to a domain that we can proxy requests through to get to IPA.

Through googling a bit I saw people mention changing 'xmlrpc_uri' in /etc/ipa/default.conf along with some proxy settings for nginx but couldn't really see anything "official".

Has anyone successfully put nginx in front of a cluster of IPA servers? Is there any documentation to detail the steps involved?

Thanks,

Doug

Wipro Limited (Company Regn No in UK FC 019088) Address: Level 2, West wing, 3 Sheldon Square, London W2 6PS, United Kingdom. Tel [phone] Fax: [phone] VAT Number: 563 1964 27 (Branch of Wipro Limited (Incorporated in India at Bangalore with limited liability vide Reg no L99999KA1945PLC02800 with Registrar of Companies at Bangalore, India. Authorized share capital Rs 5550 mn)) Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________

[Alston, David]

Greetings!

Password changes will use Kerberos port 464.  Is Nginx forwarding port 464 to whatever domain controllers are managing the users who want to change their password?

--David Alston

From: doug.kelly--- via FreeIPA-users [mailto:[e-mail]]
Sent: Monday, September 11, 2017 10:16 AM
To: [e-mail]
Cc: [e-mail]
Subject: [Freeipa-users] Nginx in front of IPA?

Hi,

We have an "interesting" set up here and ultimately it means that some of our users are on a network that can't access the domain that the IPA servers are on so can't reset their passwords. However, they do have access to a domain that we can proxy requests through to get to IPA.

Through googling a bit I saw people mention changing 'xmlrpc_uri' in /etc/ipa/default.conf along with some proxy settings for nginx but couldn't really see anything "official".

Has anyone successfully put nginx in front of a cluster of IPA servers? Is there any documentation to detail the steps involved?

Thanks,

Doug
Wipro Limited (Company Regn No in UK FC 019088) Address: Level 2, West wing, 3 Sheldon Square, London W2 6PS, United Kingdom. Tel [phone] Fax: [phone] VAT Number: 563 1964 27 (Branch of Wipro Limited (Incorporated in India at Bangalore with limited liability vide Reg no L99999KA1945PLC02800 with Registrar of Companies at Bangalore, India. Authorized share capital Rs 5550 mn)) Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.comhttp://www.wipro.com
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________

Hi David,

I am referring only to people changing their passwords on the web interface, so I don't think the clients or Nginx would have to talk to port 464?

Cheers,

Doug

________________________________
From: Alston, David 
Sent: 11 September 2017 17:52:55
To: FreeIPA users list
Cc: Doug Kelly (Digital)
Subject: RE: Nginx in front of IPA?

** This mail has been sent from an external source **
Greetings!

Password changes will use Kerberos port 464.  Is Nginx forwarding port 464 to whatever domain controllers are managing the users who want to change their password?

--David Alston

From: doug.kelly--- via FreeIPA-users [mailto:[e-mail]]
Sent: Monday, September 11, 2017 10:16 AM
To: [e-mail]
Cc: [e-mail]
Subject: [Freeipa-users] Nginx in front of IPA?

Hi,

We have an "interesting" set up here and ultimately it means that some of our users are on a network that can't access the domain that the IPA servers are on so can't reset their passwords. However, they do have access to a domain that we can proxy requests through to get to IPA.

Through googling a bit I saw people mention changing 'xmlrpc_uri' in /etc/ipa/default.conf along with some proxy settings for nginx but couldn't really see anything "official".

Has anyone successfully put nginx in front of a cluster of IPA servers? Is there any documentation to detail the steps involved?

Thanks,

Doug
Wipro Limited (Company Regn No in UK FC 019088) Address: Level 2, West wing, 3 Sheldon Square, London W2 6PS, United Kingdom. Tel [phone] Fax: [phone] VAT Number: 563 1964 27 (Branch of Wipro Limited (Incorporated in India at Bangalore with limited liability vide Reg no L99999KA1945PLC02800 with Registrar of Companies at Bangalore, India. Authorized share capital Rs 5550 mn)) Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.comhttps://clicktime.symantec.com/a/1/H_4TZpBE_a2GVtGyhaMM3ZRKnU3hu9amtligA9KDR08=?d=Q0U8cFtfuGo51qnheOD94XiLjbc5UDs7EX00VZALptN82p6fPI34qT_xOg1y6YKm7VxhNknZ7rsrkQCwjI4H_P_jsNcBAFQUnz2nxmvqHKJ-yZngo6bapMhnp-WJOYvpP1OT1xvuedsVxDiJTct-sz0FY08d4G-fCFghjLF3BDT43Pah8bLwVgDAkRHfqzkUSFeVfY60VkYVfa-YBo3t-SKq8iEZtE4fBoFhgVo9xYd9MMZpI9RJP4mXXWVBqkI8e-Jpf-HIDlsPDeZXZo1InFyqp_bgpZ52iTNKRQtEy3lPbZV1tAhV56FlY-WIDKn45CvlLpWsDBy08O6HiTCSAEJWueWPblAZSmOlexz3p9PXV90HJdmL63N2Rb9lH3CzaDqDLG6w1MFl5pdwlY5CtmiMwl4%3D&u=http%3A%2F%2Fwww.wipro.com
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.comhttps://clicktime.symantec.com/a/1/Ch_iWk2Dveim45tqxVD6MKSkQIrai0yBiZ8kBYI23j0=?d=Q0U8cFtfuGo51qnheOD94XiLjbc5UDs7EX00VZALptN82p6fPI34qT_xOg1y6YKm7VxhNknZ7rsrkQCwjI4H_P_jsNcBAFQUnz2nxmvqHKJ-yZngo6bapMhnp-WJOYvpP1OT1xvuedsVxDiJTct-sz0FY08d4G-fCFghjLF3BDT43Pah8bLwVgDAkRHfqzkUSFeVfY60VkYVfa-YBo3t-SKq8iEZtE4fBoFhgVo9xYd9MMZpI9RJP4mXXWVBqkI8e-Jpf-HIDlsPDeZXZo1InFyqp_bgpZ52iTNKRQtEy3lPbZV1tAhV56FlY-WIDKn45CvlLpWsDBy08O6HiTCSAEJWueWPblAZSmOlexz3p9PXV90HJdmL63N2Rb9lH3CzaDqDLG6w1MFl5pdwlY5CtmiMwl4%3D&u=http%3A%2F%2Fwww.symanteccloud.com
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________
Wipro Limited (Company Regn No in UK FC 019088) Address: Level 2, West wing, 3 Sheldon Square, London W2 6PS, United Kingdom. Tel [phone] Fax: [phone] VAT Number: 563 1964 27 (Branch of Wipro Limited (Incorporated in India at Bangalore with limited liability vide Reg no L99999KA1945PLC02800 with Registrar of Companies at Bangalore, India. Authorized share capital Rs 5550 mn)) Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________