salt-formulas / salt-formula-freeipa

FreeIPA

This forumla installs and configured the FreeIPA Identity Management service and client.

Sample pillars

Client

freeipa:
  client:
    enabled: true
    server: ipa.example.com
    domain: {{ salt['grains.get']('domain', '') }}
    realm: {{ salt['grains.get']('domain', '').upper() }}
    hostname: {{ salt['grains.get']('fqdn', '') }}

To automatically register the client with FreeIPA, you will first need to create a Kerberos principal. Start by creating a service account in FreeIPA. You may wish to restrict that users permissions to only host creation (see https://www.freeipa.org/page/HowTos#Working_with_FreeIPA). Next, you will need to obtain a kerberos ticket as admin on the IPA server, then generate a service account principal.

kinit admin

ipa-getkeytab -p [email protected] -k ./principal.keytab -s freeipahost.example.com

scp ./principal.keytab [email protected]:/srv/salt/freeipa/files/principal.keytab

Then add to your pillar:

freeipa:
  client:
    enabled: true
    server: ipa.example.com
    domain: {{ salt['grains.get']('domain', '') }}
    realm: {{ salt['grains.get']('domain', '').upper() }}
    hostname: {{ salt['grains.get']('fqdn', '') }}
    install_principal:
      source: salt://freeipa/files/principal.keytab
      mode: "0600"
      principal_user: "service-account"
      file_user: "root"
      file_group: "root"

This will allow your client to use FreeIPA's JSON interface to create a host entry with a One Time Password and then register to the FreeIPA server. For security purposes, the kerberos principal will only be pushed down to the client if the installer reports it is not registered to the FreeIPA server and will be removed from the client as soon as the endpoint has registered with the FreeIPA server.

Additionally, the openssh formula (see https://github.com/salt-formulas/salt-formula-openssh) is needed and is a dependency for this formula. Configure it thusly:

openssh:
  server:
    public_key_auth: true
    gssapi_auth: true
    kerberos_auth: false
    authorized_keys_command:
      command: /usr/bin/sss_ssh_authorizedkeys
      user: nobody

If you wish to update DNS records using nsupdate, add:

freeipa:
  client:
    nsupdate:
      - name: test.example.com
        ipv4:
          - 8.8.8.8
        ipv6:
          - 2a00:1450:4001:80a::1009
        ttl: 1800
        keytab: /etc/krb5.keytab

For requesting certificates using certmonger:

freeipa:
  client:
    cert:
      "HTTP/www.example.com":
        user: root
        group: www-data
        mode: 640
        cert: /etc/ssl/certs/http-www.example.com.crt
        key: /etc/ssl/private/http-www.example.com.key

Server

freeipa:
  server:
    realm: IPA.EXAMPLE.COM
    domain: ipa.example.com
    ldap:
      password: secretpassword

Server definition for new verion of freeipa (4.3+). Replicas dont require generation of gpg file on master. But principal user has to be defined with

freeipa:
  server:
    realm: IPA.EXAMPLE.COM
    domain: ipa.example.com
    principal_user: admin
    admin:
      password: secretpassword
    servers:
    - idm01.ipa.example.com
    - idm02.ipa.example.com
    - idm03.ipa.example.com

Disable CA. Default is True.

freeipa:
  server:
    ca: false

Disable LDAP access logs but enable audit

freeipa:
  server:
    ldap:
      logging:
        access: false
        audit: true

Read more

• http://www.freeipa.org/page/Quick_Start_Guide

Documentation and Bugs

To learn how to install and update salt-formulas, consult the documentation available online at:

http://salt-formulas.readthedocs.io/

In the unfortunate event that bugs are discovered, they should be reported to the appropriate issue tracker. Use Github issue tracker for specific salt formula:

https://github.com/salt-formulas/salt-formula-freeipa/issues

For feature requests, bug reports or blueprints affecting entire ecosystem, use Launchpad salt-formulas project:

https://launchpad.net/salt-formulas

You can also join salt-formulas-users team and subscribe to mailing list:

https://launchpad.net/~salt-formulas-users

Developers wishing to work on the salt-formulas projects should always base their work on master branch and submit pull request against specific formula.

https://github.com/salt-formulas/salt-formula-freeipa

Any questions or feedback is always welcome so feel free to join our IRC channel:

#salt-formulas @ irc.freenode.net

salt-formula-freeipa's Issues

Formula crashes FreeIPA 4.6.8 on Salt 3004

Salt 3004.0 introduces a number of new options to random.get_str, most set by default. This includes punctuation characters, which seem to crash ipa-client-install. I recommend changing the OTP generation to not use punctuation characters, at least on Salt 3004.0. You can do this by changing (in freeipa/client/init.sls):

{%- set otp = salt['random.get_str'](20) %}

to:

{%- if salt['salt_version.greater_than']('Aluminium') %}
{%- set otp = salt['random.get_str'](length=20, punctuation=False) %}
{%- else %}
{%- set otp = salt['random.get_str'](20) %}
{%- endif %}

Also, the {{ otp }} tags are unescaped, and causes issues with some characters on the command line. I recommend surrounding them with single quotes. To do so, change:

-w {{ otp }}

and

-w {{ client.otp }}

to:

-w '{{ otp }}'

and

-w '{{ client.otp }}'

Documentation on the new options for random.get_str are available here.

Rendering SLS 'base:freeipa.client' failed: Jinja syntax error: expected token ',', got 'integer'; line 20 on Salt 3005 (OneDir)

While running a state.apply to join a Salt 3005 OneDir minion to FreeIPA, I receive the following error:

minion:
    Data failed to compile:
----------
    Rendering SLS 'base:freeipa.client' failed: Jinja syntax error: expected token ',', got 'integer'; line 20

---
[...]

freeipa_push_principal:
  file.managed:
    - name: /tmp/principal.keytab
    - source: {{ client.get("install_principal", {}).get("source", "salt://freeipa/files/principal.keytab") }}
    - mode: {{ client.get("install_principal", {}).get("mode", 0600) }}    <======================
    - user: {{ client.get("install_principal", {}).get("file_user", "root") }}
    - group: {{ client.get("install_principal", {}).get("file_group", "root") }}
    - unless:
      - ipa-client-install --unattended 2>&1 | grep "IPA client is already configured on this system"
freeipa_get_ticket:
[...]
---

Per the note on this page:

https://docs.saltproject.io/en/latest/ref/states/all/salt.states.file.html

Warning

When using a mode that includes a leading zero you must wrap the value in single quotes. If the value is not wrapped in quotes it will be read by YAML as an integer and evaluated as an octal.

Formula misconfigures named by using wrong LDAP base

This formula misconfigures named, by using dashes/hyphers in the LDAP base instead of commas:

salt-formula-freeipa/freeipa/files/named.conf

Line 59 in 2e62986

base "cn=dns, dc={{ server.realm|replace('.', '-') }}";

Enrolling client fails due to missing records

As per output from the freeipa_host_add I get the following in stdout (prettified):

{
	"result": null,
	"error": {
		"code": 4019,
		"message": "Host 'test.example.com' does not have corresponding DNS A/AAAA record",
		"data": {
			"hostname": "test.example.com"
		},
		"name": "DNSNotARecordError"
	},
	"id": 0,
	"principal": "[email protected]",
	"version": "4.9.2"
}

Issue 1: The record doesn't exist, this could be solved by adding a freeipa_dnsrecord_add just before freipa_host_add that creates the A/AAAA record for the host.

Issue 2: The states continue to run, since curl doesn't return non-null it never fails. Could probably be solved by using the http module instead of cmd.run and curl.

I wanted your input on this before I create more PRs.

Attempting to use formula is leading to error

Hi there,

I've followed the saltstack formula documentation to the T but have had no success in using this formula. Each time I try to apply the state to minions I am receiving this error:

    Data failed to compile:
----------
    Pillar failed to render with the following messages:
----------
    Rendering Primary Top file failed, render error:
while parsing a block mapping
  in "<unicode string>", line 1, column 1
did not find expected key
  in "<unicode string>", line 3, column 5

The error itself seems misleading as the top.sls file is fine. Currently the pillar top.sls file looks like this:

base:
  '*':
    - freeipa.client

The state top.sls file looks like this:

base:
  '*':
    - freeipa

The current file structure is the basic saltstack defaults, this was done to rule out any gitfs issues:

Pillars are stored in /srv/pillar, with the client pillar in /srv/pillar/freeipa/client.sls

The formula is stored in /srv/salt under /srv/salt/freeipa/ . This is essentially a copy of the freeipa folder within the master repo.

Please let me know if more information required and I'd be more than happy to provide it.
Thank you for looking into my issue.