Katello with freeipa?

[Andrew Lau]

Hi guys,

Two quick questions:

1. Are there any full diagram overviews of the katello process? I'm
interested in getting a better understanding of the whole life cycle of a
server process with katello.

2. Is it possible to use the freeipas ca for the whole ca process? Ie. With
foreman/puppet, we grab a unique ca during the kick start process so when
puppetrun comes around we already have a cert.

Thanks.

[Walid A. Shaari]

Andrew,

Good Luck some one answering you, i hope that the rate of answering in here
is not an all an indication of this project adaptation. you have better
luck asking in Foreman mailing list.

regards

Walid


On 3 March 2014 01:04, Andrew Lau <andrew(a)andrewklau.com&gt; wrote:

>  Hi guys,
>
>  Two quick questions:
>
>  1. Are there any full diagram overviews of the katello process? I'm
>  interested in getting a better understanding of the whole life cycle of a
>  server process with katello.
>
>  2. Is it possible to use the freeipas ca for the whole ca process? Ie.
>  With foreman/puppet, we grab a unique ca during the kick start process so
>  when puppetrun comes around we already have a cert.
>
>  Thanks.
>
>  _______________________________________________
>  katello mailing list
>  katello(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/katello
>
>

[Innes, Duncan]

Andrew,
 
This list is pretty quiet at the moment as one the MDP2 program comes to
a conclusion and (I hope) MDP3 is roudn the corner.
 
My take on question 2 - there is work going on in Foreman
(http://projects.theforeman.org/issues/1809) to integrate FreeIPA as an
authentication layer if that's what you use.  This looks more like
pre-creation of system objects and setting OTP's though.  For auto-sign
of puppet clients, I've seen the following page (although I've not got
as far as trying out the FreeIPA certs for Foreman & Puppet myself yet).
 
HTH
 
Duncan


________________________________

	From: katello-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of Andrew Lau
	Sent: 02 March 2014 22:05
	To: katello(a)lists.fedorahosted.org
	Subject: Katello with freeipa?
	
	

	Hi guys,

	Two quick questions:

	1. Are there any full diagram overviews of the katello process?
I'm interested in getting a better understanding of the whole life cycle
of a server process with katello.

	2. Is it possible to use the freeipas ca for the whole ca
process? Ie. With foreman/puppet, we grab a unique ca during the kick
start process so when puppetrun comes around we already have a cert.

	Thanks.


	This message has been checked for viruses and spam by the Virgin
Money email scanning system powered by Messagelabs.
	


This message has been checked for viruses and spam by the Virgin Money email scanning
system powered by Messagelabs.

This e-mail is intended to be confidential to the recipient. If you receive a copy in
error, please inform the sender and then delete this message.

Virgin Money plc - Registered in England and Wales (Company no. 6952311). Registered
office - Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL. Virgin Money plc is
authorised by the Prudential Regulation Authority and regulated by the Financial Conduct
Authority and the Prudential Regulation Authority.

The following companies also trade as Virgin Money. They are both authorised and regulated
by the Financial Conduct Authority, are registered in England and Wales and have their
registered office at Jubilee House, Gosforth, Newcastle upon Tyne NE3 4PL: Virgin Money
Personal Financial Service Limited (Company no. 3072766) and Virgin Money Unit Trust
Managers Limited (Company no. 3000482).

For further details of Virgin Money group companies please visit our website at
virginmoney.com

[Eric Helms]

Andrew, 

Would you mind following up this question by asking it on the Foreman users mailing list?
( https://groups.google.com/forum/#!forum/foreman-users ) We are switching to use that
mailing list and I think you will get more insight into the Foreman aspect. 

----- Original Message -----

>  From: "Andrew Lau" <andrew(a)andrewklau.com&gt;
>  To: katello(a)lists.fedorahosted.org
>  Sent: Sunday, March 2, 2014 5:04:37 PM
>  Subject: Katello with freeipa? 
>  Hi guys, 
>  Two quick questions: 
>  1. Are there any full diagram overviews of the katello process?
> I'm
>  interested in getting a better understanding of the whole life cycle of a
>  server process with katello.
>  2. Is it possible to use the freeipas ca for the whole ca process? Ie. With
>  foreman/puppet, we grab a unique ca during the kick start process so when
>  puppetrun comes around we already have a cert. 
This is not something we support
yet, but could eventually. We've been in the process of updating our installer to
account for the recent architectural changes to turn Katello into a plugin to Foreman
which requires some orchestrating and deployment of multiple certs and a CA to the right
places. Once we have that nailed down with our current tooling we could look into using
other methods of providing the CA and generating certs. 

Eric 

>  Thanks.
>  _______________________________________________
>  katello mailing list
>  katello(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/katello

[Bryan Kearney]

On 03/03/2014 03:40 PM, Eric Helms wrote:
>  Andrew,
>
>  Would you mind following up this question by asking it on the Foreman
>  users mailing list?
>  (https://groups.google.com/forum/#!forum/foreman-users) We are switching
>  to use that mailing list and I think you will get more insight into the
>  Foreman aspect.
>  
I agree with Eric on the lists. There are several items in the code, or 
existing pull requests, which do authz and authn via freeipa. The 
answere and doco can be found there.

-- bk

[Andrew Lau]

Thanks for the suggestion. I've posted to the foreman list already,
just for clarification I'm looking more into the CA provisioning
rather than user authn

On Tue, Mar 4, 2014 at 7:43 AM, Bryan Kearney <bkearney(a)redhat.com&gt; wrote:
>  On 03/03/2014 03:40 PM, Eric Helms wrote:
> >
> > Andrew,
> >
> > Would you mind following up this question by asking it on the Foreman
> > users mailing list?
> > (https://groups.google.com/forum/#!forum/foreman-users) We are switching
> > to use that mailing list and I think you will get more insight into the
> > Foreman aspect.
> >
>  I agree with Eric on the lists. There are several items in the code, or
>  existing pull requests, which do authz and authn via freeipa. The answere
>  and doco can be found there.
>
>  -- bk
>
>
>
>  _______________________________________________
>  katello mailing list
>  katello(a)lists.fedorahosted.org
>  https://lists.fedorahosted.org/mailman/listinfo/katello