Plans for integrating DHCP

[Ronald Wimmer]

Hi there,

are there any plans to integrate a DHCP server into FreeIPA. We have 
several environments where a lack of DHCP is a showstopper at the moment.

Cheers,
Ronald

[Alexander Bokovoy]

On pe, 24 huhti 2020, Ronald Wimmer via FreeIPA-users wrote:
> Hi there,
>
> are there any plans to integrate a DHCP server into FreeIPA. We have 
> several environments where a lack of DHCP is a showstopper at the 
> moment.

No official plans yet. However, there is a draft version at 
https://github.com/cabeljunky/freeipa-plugin-dhcp which seems to work
for some people.

Couple weeks ago I started to rewrite that plugin to follow FreeIPA code
standards but haven't yet reached a point where I have anything working
yet. It is done at my own time, when it is available.

[lejeczek]

On 24/04/2020 11:44, Alexander Bokovoy via FreeIPA-users wrote:
> On pe, 24 huhti 2020, Ronald Wimmer via FreeIPA-users wrote:
> > Hi there,
> >
> > are there any plans to integrate a DHCP server into
> > FreeIPA. We have several environments where a lack of
> > DHCP is a showstopper at the moment.
>
> No official plans yet. However, there is a draft version
> at https://github.com/cabeljunky/freeipa-plugin-dhcp which
> seems to work
> for some people.
>
> Couple weeks ago I started to rewrite that plugin to
> follow FreeIPA code
> standards but haven't yet reached a point where I have
> anything working
> yet. It is done at my own time, when it is available.

Yes, it would be utterly fantastic and make freeIPA even
more complete solution if DHCP was integrated.

As of now there is not some semi/official guide to set DHCP
to IPA's dirsrv, or is there?

many thanks, L.

[Rob Crittenden]

lejeczek via FreeIPA-users wrote:
> On 24/04/2020 11:44, Alexander Bokovoy via FreeIPA-users wrote:
> > On pe, 24 huhti 2020, Ronald Wimmer via FreeIPA-users wrote:
> > > Hi there,
> > >
> > > are there any plans to integrate a DHCP server into
> > > FreeIPA. We have several environments where a lack of
> > > DHCP is a showstopper at the moment.
> >
> > No official plans yet. However, there is a draft version
> > at https://github.com/cabeljunky/freeipa-plugin-dhcp which
> > seems to work
> > for some people.
> >
> > Couple weeks ago I started to rewrite that plugin to
> > follow FreeIPA code
> > standards but haven't yet reached a point where I have
> > anything working
> > yet. It is done at my own time, when it is available.
>
> Yes, it would be utterly fantastic and make freeIPA even
> more complete solution if DHCP was integrated.
>
> As of now there is not some semi/official guide to set DHCP
> to IPA's dirsrv, or is there?

Look in the mailing list archives. A number of attempts were made. There
is (or was) at least one DHCP integration how-to on the freeipa.org wiki.

rob

[Nicholas DeMarco]

DHCP seems out of scope for IPA.

On Wed, Jun 3, 2020 at 9:17 AM lejeczek via FreeIPA-users <
[e-mail]> wrote:
> On 24/04/2020 11:44, Alexander Bokovoy via FreeIPA-users wrote:
> > On pe, 24 huhti 2020, Ronald Wimmer via FreeIPA-users wrote:
> > > Hi there,
> > >
> > > are there any plans to integrate a DHCP server into
> > > FreeIPA. We have several environments where a lack of
> > > DHCP is a showstopper at the moment.
> >
> > No official plans yet. However, there is a draft version
> > at https://github.com/cabeljunky/freeipa-plugin-dhcp which
> > seems to work
> > for some people.
> >
> > Couple weeks ago I started to rewrite that plugin to
> > follow FreeIPA code
> > standards but haven't yet reached a point where I have
> > anything working
> > yet. It is done at my own time, when it is available.
>
> Yes, it would be utterly fantastic and make freeIPA even
> more complete solution if DHCP was integrated.
>
> As of now there is not some semi/official guide to set DHCP
> to IPA's dirsrv, or is there?
>
> many thanks, L.
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Vinícius Ferrão]

It may seem out of scope, and I agree with this.

But IMHO it should have a better integration with DHCP. Look at MS Active Directory, it’s so deeply integrated with MS DHCP that you just install it as an add-on. The same thing does not happen on IPA. A better integration would be extremely good for FreeIPA; for sure there are guides to better integrate ISC DHCP, but some things are lacking, like better DDNS, RNDC keys, etc.

Storing DHCP leases on LDAP is an extra, it may be out of scope, as you said. But to achieve this I think other issues should be resolved first and in fact they don’t seem to be out of scope.

Again, this is my opinion, just as a FreeIPA “consumer”.

On 7 Jul 2020, at 15:33, Nicholas DeMarco via FreeIPA-users <[e-mail]> wrote:

DHCP seems out of scope for IPA.

On Wed, Jun 3, 2020 at 9:17 AM lejeczek via FreeIPA-users <[e-mail]> wrote:

On 24/04/2020 11:44, Alexander Bokovoy via FreeIPA-users wrote:
> On pe, 24 huhti 2020, Ronald Wimmer via FreeIPA-users wrote:
> > Hi there,
> >
> > are there any plans to integrate a DHCP server into
> > FreeIPA. We have several environments where a lack of
> > DHCP is a showstopper at the moment.
>
> No official plans yet. However, there is a draft version
> at https://github.com/cabeljunky/freeipa-plugin-dhcp which
> seems to work
> for some people.
>
> Couple weeks ago I started to rewrite that plugin to
> follow FreeIPA code
> standards but haven't yet reached a point where I have
> anything working
> yet. It is done at my own time, when it is available.

Yes, it would be utterly fantastic and make freeIPA even
more complete solution if DHCP was integrated.

As of now there is not some semi/official guide to set DHCP
to IPA's dirsrv, or is there?

many thanks, L.
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
_______________________________________________
FreeIPA-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Jochen Kellner]

Hello Ronald,

Ronald Wimmer via FreeIPA-users 
writes:
> are there any plans to integrate a DHCP server into FreeIPA. We have
> several environments where a lack of DHCP is a showstopper at the
> moment.

I have a (simple) script running that creates a configuration snippet
for dnsmasq from the MAC address in the host record and the
corresponding DNS entry. Works ok for my environment. Not bullet-proof
an doesn't for big sites (max records...)

Jochen

[Charles Hedrick]

The main issues are
* adding to the schema
* tools for managing
* dynamic address allocation

We don’t use dynamic allocation. so that’s not an issue for us. That means the normal ISC dhcpd works fine. It supports getting data from LDAP. They supply a schema file, which with some tweaking works fine with freeipa.

I have a .py file that will add commands to the IPA command line to manage most data. That should work anywhere with possible minor changes because the base DN will not be Rutgers. I also have a web GUI which is part of my larger user management system. That might be a bit harder to port, though in principle the whole system is designed to be portable. (It uses Spring Boot.)

The issues I see with integration into freeipa are
* adding it to the freeipa web GUI. I think that can be done with their defined extension method, so it doesn’t need a change in core code
* dynamic address management.

The current ISC daemon uses a master / backup approach for dynamic address allocation. So it stores allocations locally on the server. That means it doesn’t need LDAP or another database. It should work just fine with freeipa. However the newer ISC DHCP code (currently a separate project) really wants a symmetrical database. LDAP might work, depending upon how often you need to allocate addresses, but LDAP really isn’t intended for high write rates.
> On Apr 24, 2020, at 6:23 AM, Ronald Wimmer via FreeIPA-users  wrote:
>
> Hi there,
>
> are there any plans to integrate a DHCP server into FreeIPA. We have several environments where a lack of DHCP is a showstopper at the moment.
>
> Cheers,
> Ronald
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Charles Hedrick]

hmmm. so the problem with our integration is that we use the standard schema. that makes DHCP data a separate tree. To make it a real part of freeipa you’d want to get data for a  host from its normal host entry. Either you’d need to modify the server to read data from the normal freeipa data, or you could keep the official DHCP schema, but make the management tools see the items as attributes of the freeipa host entry. Both are pretty easy to do. But I can see that a real integration like this would be a project that would compete with other priorities for IPA.

From my point of view, it’s kind of the biggest missing piece in IPA at the moment, though our integration works fine and shouldn’t present any maintenance issues.

(You may ask, why use IPA for your DHCP data? In our case it’s because IPA is the only multimaster replicated data we have. I’d rather not have to manage a mulitimasteir SQL database just to do DHCP.)
> On Jul 6, 2020, at 2:24:43 PM, Charles Hedrick via FreeIPA-users  wrote:
>
> The main issues are
> adding to the schema
> tools for managing
> dynamic address allocation
>
> We don’t use dynamic allocation. so that’s not an issue for us. That means the normal ISC dhcpd works fine. It supports getting data from LDAP. They supply a schema file, which with some tweaking works fine with freeipa.
>
> I have a .py file that will add commands to the IPA command line to manage most data. That should work anywhere with possible minor changes because the base DN will not be Rutgers. I also have a web GUI which is part of my larger user management system. That might be a bit harder to port, though in principle the whole system is designed to be portable. (It uses Spring Boot.)
>
> The issues I see with integration into freeipa are
> adding it to the freeipa web GUI. I think that can be done with their defined extension method, so it doesn’t need a change in core code
> dynamic address management.
>
> The current ISC daemon uses a master / backup approach for dynamic address allocation. So it stores allocations locally on the server. That means it doesn’t need LDAP or another database. It should work just fine with freeipa. However the newer ISC DHCP code (currently a separate project) really wants a symmetrical database. LDAP might work, depending upon how often you need to allocate addresses, but LDAP really isn’t intended for high write rates.
> > On Apr 24, 2020, at 6:23 AM, Ronald Wimmer via FreeIPA-users  wrote:
> >
> > Hi there,
> >
> > are there any plans to integrate a DHCP server into FreeIPA. We have several environments where a lack of DHCP is a showstopper at the moment.
> >
> > Cheers,
> > Ronald
> > _______________________________________________
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Uzor Ide]

Take a look at this implementation. I may be old but could give an idea on
how to proceed
https://github.com/Turgon37/freeipa-plugin-dhcp

On Mon, Jul 6, 2020 at 1:39 PM Charles Hedrick via FreeIPA-users <
[e-mail]> wrote:
> hmmm. so the problem with our integration is that we use the standard
> schema. that makes DHCP data a separate tree. To make it a real part of
> freeipa you’d want to get data for a  host from its normal host entry.
> Either you’d need to modify the server to read data from the normal freeipa
> data, or you could keep the official DHCP schema, but make the management
> tools see the items as attributes of the freeipa host entry. Both are
> pretty easy to do. But I can see that a real integration like this would be
> a project that would compete with other priorities for IPA.
>
> From my point of view, it’s kind of the biggest missing piece in IPA at
> the moment, though our integration works fine and shouldn’t present any
> maintenance issues.
>
> (You may ask, why use IPA for your DHCP data? In our case it’s because IPA
> is the only multimaster replicated data we have. I’d rather not have to
> manage a mulitimasteir SQL database just to do DHCP.)
> > On Jul 6, 2020, at 2:24:43 PM, Charles Hedrick via FreeIPA-users <
>
> [e-mail]> wrote:
> > The main issues are
> > adding to the schema
> > tools for managing
> > dynamic address allocation
> >
> > We don’t use dynamic allocation. so that’s not an issue for us. That
>
> means the normal ISC dhcpd works fine. It supports getting data from LDAP.
> They supply a schema file, which with some tweaking works fine with freeipa.
> > I have a .py file that will add commands to the IPA command line to
>
> manage most data. That should work anywhere with possible minor changes
> because the base DN will not be Rutgers. I also have a web GUI which is
> part of my larger user management system. That might be a bit harder to
> port, though in principle the whole system is designed to be portable. (It
> uses Spring Boot.)
> > The issues I see with integration into freeipa are
> > adding it to the freeipa web GUI. I think that can be done with their
>
> defined extension method, so it doesn’t need a change in core code
> > dynamic address management.
> >
> > The current ISC daemon uses a master / backup approach for dynamic
>
> address allocation. So it stores allocations locally on the server. That
> means it doesn’t need LDAP or another database. It should work just fine
> with freeipa. However the newer ISC DHCP code (currently a separate
> project) really wants a symmetrical database. LDAP might work, depending
> upon how often you need to allocate addresses, but LDAP really isn’t
> intended for high write rates.
> > > On Apr 24, 2020, at 6:23 AM, Ronald Wimmer via FreeIPA-users <
>
> [e-mail]> wrote:
> > > Hi there,
> > >
> > > are there any plans to integrate a DHCP server into FreeIPA. We have
>
> several environments where a lack of DHCP is a showstopper at the moment.
> > > Cheers,
> > > Ronald
> > > _______________________________________________
> > > FreeIPA-users mailing list -- [e-mail]
> > > To unsubscribe send an email to
>
> [e-mail]
> > > Fedora Code of Conduct:
>
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > > List Archives:
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> > FreeIPA-users mailing list -- [e-mail]
> > To unsubscribe send an email to
>
> [e-mail]
> > Fedora Code of Conduct:
>
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...