freeipa

mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00

History

Rob Crittenden c19911845d Use GSSAPI auth for the ipa-replica-manage list and del commands. This creates a new role, replicaadmin, so a non-DM user can do limited management of replication agreements. Note that with cn=config if an unauthorized user performs a search an error is not returned, no entries are returned. This makes it difficult to determine if there are simply no replication agreements or we aren't allowed to see them. Once the ipaldap.py module gets replaced by ldap2 we can use Get Effective Rights to easily tell the difference.		2010-03-19 17:17:14 -04:00
..
man	Add A and PTR records during ipa-replica-prepare	2010-02-09 16:30:25 -05:00
ipa-compat-manage	Set default log level in the *-manage utilities to ERROR and not NOTSET	2010-02-04 11:36:54 -05:00
ipa-dns-install	Add ipa-dns-install script	2010-02-09 15:45:35 -05:00
ipa-fix-CVE-2008-3274	Rename ipa-python directory to ipapython so it is a real python library	2009-02-09 14:35:15 -05:00
ipa-ldap-updater	Rename ipa-python directory to ipapython so it is a real python library	2009-02-09 14:35:15 -05:00
ipa-nis-manage	Set default log level in the *-manage utilities to ERROR and not NOTSET	2010-02-04 11:36:54 -05:00
ipa-replica-install	Get rid of ipapython.config in ipa-replica-prepare	2010-02-09 16:30:06 -05:00
ipa-replica-manage	Use GSSAPI auth for the ipa-replica-manage list and del commands.	2010-03-19 17:17:14 -04:00
ipa-replica-prepare	Make CA PKCS#12 location arg for ipa-replica-prepare, default /root/cacert.p12	2010-03-19 04:45:41 -06:00
ipa-server-certinstall	Initialize the api so imports work, trust all CAs included in the PKCS#12.	2010-03-19 04:41:05 -06:00
ipa-server-install	Better customize the message regarding the CA based on the install options.	2010-03-19 04:55:33 -06:00
ipa-upgradeconfig	Better upgrade detection so we don't print spurious errors	2009-09-15 17:42:36 -04:00
ipactl	Add status option to ipactl	2010-02-09 04:07:33 -07:00
Makefile.am	Add ipa-dns-install script	2010-02-09 15:45:35 -05:00
README	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00

README

Required packages:

krb5-server
fedora-ds-base
fedora-ds-base-devel
openldap-clients
openldap-devel
krb5-server-ldap
cyrus-sasl-gssapi
httpd
mod_auth_kerb
ntp
openssl-devel
nspr-devel
nss-devel
mozldap-devel
mod_python
gcc
python-ldap
TurboGears
python-kerberos
python-krbV
python-tgexpandingformwidget
python-pyasn1

Installation example:

TEMPORARY: until bug https://bugzilla.redhat.com/show_bug.cgi?id=248169 is
fixed.

Please apply the fedora-ds.init.patch in freeipa/ipa-server/ipa-install/share/
to patch your init scripts before running ipa-server-install. This tells
FDS where to find its kerberos keytab.

Things done as root are denoted by #. Things done as a unix user are denoted
by %.

# cd freeipa
# patch -p0 < ipa-server/ipa-install/share/fedora-ds.init.patch

Now to do the installation.

# cd freeipa
# make install

To start an interactive installation use:
# /usr/sbin/ipa-server-install

For more verbose output add the -d flag run the command with -h to see all options

You have a basic working system with one super administrator (named admin).

To create another administrative user:

% kinit admin@FREEIPA.ORG
% /usr/sbin/ipa-adduser -f Test -l User test
% ldappasswd -Y GSSAPI -h localhost -s password uid=test,cn=users,cn=accounts,dc=freeipa,dc=org
% /usr/sbin/ipa-groupmod -a test admins

An admin user is just a regular user in the group admin.

Now you can destroy the old ticket and log in as test:

% kdestroy
% kinit test@FREEIPA.ORG
% /usr/sbin/ipa-finduser test