Chapter 35. Using an ID view to override a user attribute value on an IdM client

Procedure

1. On the IdM server, create a new ID view. For example, to create an ID view named example_for_client1:

   $ ipa idview-add example_for_client1
   ---------------------------
   Added ID View "example_for_client1"
   ---------------------------
     ID View Name: example_for_client1

2. Add a user override to the example_for_client1 ID view. To override the user login:

   • Enter the ipa idoverrideuser-add command
   • Add the name of the ID view
   • Add the user name, also called the anchor

   • Add the --login option:

     $ ipa idoverrideuser-add example_for_client1 idm_user --login=user_1234
     -----------------------------
     Added User ID override "idm_user"
     -----------------------------
       Anchor to override: idm_user
       User login: user_1234

     For a list of the available options, run ipa idoverrideuser-add --help.

     Note

     The ipa idoverrideuser-add --certificate command replaces all existing certificates for the account in the specified ID view. To append an additional certificate, use the ipa idoverrideuser-add-cert command instead:

     $ ipa idoverrideuser-add-cert example_for_client1 user --certificate="MIIEATCC..."

3. Optional: Using the ipa idoverrideuser-mod command, you can specify new attribute values for an existing user override.

4. Apply example_for_client1 to the client1.idm.example.com host:

   $ ipa idview-apply example_for_client1 --hosts=client1.idm.example.com
   -----------------------------
   Applied ID View "example_for_client1"
   -----------------------------
   hosts: client1.idm.example.com
   ---------------------------------------------
   Number of hosts the ID View was applied to: 1
   ---------------------------------------------

   Note

   The ipa idview-apply command also accepts the --hostgroups option. The option applies the ID view to hosts that belong to the specified host group, but does not associate the ID view with the host group itself. Instead, the --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them.

   This means that if a host is added to the host group in the future, the ID view does not apply to the new host.

5. To apply the new configuration to the IdM client system immediately:

   1. SSH to the client system as root:

      $ ssh root@client1
      Password:

   2. On the IdM client, clear the SSSD cache:

      # sss_cache -E

   3. On the IdM client, restart the SSSD daemon:

   # systemctl restart sssd

Procedure

1. On the IdM client, create the directory that you want idm_user to use on client1.idm.example.com as the user home directory:

   # mkdir /home/user_1234/

2. On the IdM client, change the ownership of the directory:

   # chown idm_user:idm_user /home/user_1234/

3. On the IdM server, display the ID view, including the hosts to which the ID view is currently applied. To display the ID view named example_for_client1:

   $ ipa idview-show example_for_client1 --all
     dn: cn=example_for_client1,cn=views,cn=accounts,dc=idm,dc=example,dc=com
     ID View Name: example_for_client1
     User object override: idm_user
     Hosts the view applies to: client1.idm.example.com
     objectclass: ipaIDView, top, nsContainer

   The output shows that the ID view currently applies to client1.idm.example.com.

4. On the IdM server, modify the user override of the example_for_client1 ID view. To override the user home directory:

   • Enter the ipa idoverrideuser-add command
   • Add the name of the ID view
   • Add the user name, also called the anchor

   • Add the --homedir option:

     $ ipa idoverrideuser-mod example_for_client1 idm_user --homedir=/home/user_1234
     -----------------------------
     Modified a User ID override "idm_user"
     -----------------------------
       Anchor to override: idm_user
       User login: user_1234
       Home directory: /home/user_1234/

   For a list of the available options, run ipa idoverrideuser-mod --help.

5. To apply the new configuration to the client1.idm.example.com system immediately:

   1. SSH to the IdM client system as root:

      $ ssh root@client1
      Password:

   2. On the IdM client, clear the SSSD cache:

      # sss_cache -E

   3. On the IdM client, restart the SSSD daemon:

   # systemctl restart sssd

Verification

1. SSH to the client system as idm_user:

   # ssh idm_user@client1.idm.example.com
   Password:
   
   Last login: Sun Jun 21 22:34:25 2020 from 192.168.122.229
   [user_1234@client1 ~]$

2. On the client system, print the working directory:

   $ pwd
   /home/user_1234/

Procedure

1. On the IdM client, create the directory that you want idm_user to use as the user home directory:

   # mkdir /home/user_1234/

2. On the IdM client, change the ownership of the directory:

   # chown idm_user:idm_user /home/user_1234/

3. On the IdM server, create an ID view. For example, to create an ID view named example_for_client1:

   $ ipa idview-add example_for_client1
   ---------------------------
   Added ID View "example_for_client1"
   ---------------------------
     ID View Name: example_for_client1

4. On the IdM server, add a user override to the example_for_client1 ID view. To override the user home directory:

   • Enter the ipa idoverrideuser-add command
   • Add the name of the ID view
   • Add the user name, also called the anchor
   • Add the --homedir option:

   $ ipa idoverrideuser-add example_for_client1 idm_user --homedir=/home/user_1234
   -----------------------------
   Added User ID override "idm_user"
   -----------------------------
     Anchor to override: idm_user
     Home directory: /home/user_1234/

5. On the IdM server, apply example_for_client1 to the client1.idm.example.com host:

   $ ipa idview-apply example_for_client1 --hosts=client1.idm.example.com
   -----------------------------
   Applied ID View "example_for_client1"
   -----------------------------
   hosts: client1.idm.example.com
   ---------------------------------------------
   Number of hosts the ID View was applied to: 1
   ---------------------------------------------

   Note

   The ipa idview-apply command also accepts the --hostgroups option. The option applies the ID view to hosts that belong to the specified host group, but does not associate the ID view with the host group itself. Instead, the --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them.

   This means that if a host is added to the host group in the future, the ID view does not apply to the new host.

6. To apply the new configuration to the IdM client system immediately:

   1. SSH to the IdM client system as root:

      $ ssh root@client1
      Password:

   2. On the IdM client, clear the SSSD cache:

      # sss_cache -E

   3. On the IdM client, restart the SSSD daemon:

   # systemctl restart sssd

Verification

1. SSH to the IdM client system as idm_user:

   # ssh idm_user@client1.idm.example.com
   Password:
   Activate the web console with: systemctl enable --now cockpit.socket
   
   Last login: Sun Jun 21 22:34:25 2020 from 192.168.122.229
   [idm_user@client1 /]$

2. Print the working directory:

   $ pwd
   /home/user_1234/

Procedure

1. Create a host group and add hosts to it:

   1. Create a host group. For example, to create a host group named baltimore:

      [root@server ~]# ipa hostgroup-add --desc="Baltimore hosts" baltimore
      ---------------------------
      Added hostgroup "baltimore"
      ---------------------------
      Host-group: baltimore
      Description: Baltimore hosts

   2. Add hosts to the host group. For example, to add the host102 and host103 to the baltimore host group:

      [root@server ~]# ipa hostgroup-add-member --hosts={host102,host103} baltimore
      Host-group: baltimore
      Description: Baltimore hosts
      Member hosts: host102.idm.example.com, host103.idm.example.com
      -------------------------
      Number of members added 2
      -------------------------

2. Apply an ID view to the hosts in the host group. For example, to apply the example_for_host1 ID view to the baltimore host group:

   [root@server ~]# ipa idview-apply --hostgroups=baltimore
   ID View Name: example_for_host1
   -----------------------------------------
   Applied ID View "example_for_host1"
   -----------------------------------------
     hosts: host102.idm.example.com, host103.idm.example.com
   ---------------------------------------------
   Number of hosts the ID View was applied to: 2
   ---------------------------------------------

3. Add a new host to the host group and apply the ID view to the new host:

   1. Add a new host to the host group. For example, to add the somehost.idm.example.com host to the baltimore host group:

      [root@server ~]# ipa hostgroup-add-member --hosts=somehost.idm.example.com baltimore
        Host-group: baltimore
        Description: Baltimore hosts
        Member hosts:  host102.idm.example.com, host103.idm.example.com,somehost.idm.example.com
      -------------------------
      Number of members added 1
      -------------------------

   2. Optional: Display the ID view information. For example, to display the details about the example_for_host1 ID view:

      [root@server ~]# ipa idview-show example_for_host1 --all
        dn: cn=example_for_host1,cn=views,cn=accounts,dc=idm,dc=example,dc=com
        ID View Name: example_for_host1
      [...]
        Hosts the view applies to: host102.idm.example.com, host103.idm.example.com
        objectclass: ipaIDView, top, nsContainer

      The output shows that the ID view is not applied to somehost.idm.example.com, the newly-added host in the baltimore host group.

   3. Apply the ID view to the new host. For example, to apply the example_for_host1 ID view to somehost.idm.example.com:

      [root@server ~]# ipa idview-apply --host=somehost.idm.example.com
      ID View Name: example_for_host1
      -----------------------------------------
      Applied ID View "example_for_host1"
      -----------------------------------------
        hosts: somehost.idm.example.com
      ---------------------------------------------
      Number of hosts the ID View was applied to: 1
      ---------------------------------------------

Procedure

1. Add users and groups in the IdM domain.

   1. Create users using the ipa user-add command. For more information, see Adding users to IdM.
   2. Create groups using the ipa group-add command. For more information see: Adding groups to IdM.

2. Override IDs IdM generated during the user creation:

   1. Create a new ID view using ipa idview-add command. For more information see: Getting help for ID view commands.
   2. Add ID overrides for the users and groups to the ID view using ipa idoverrideuser-add and idoverridegroup-add respectively.
3. Assign the ID view to the specific hosts using ipa idview-apply command.
4. Decommission the NIS domains.

Verification

1. To check if all users and groups were added to the ID view correctly, use the ipa idview-show command.

   $ ipa idview-show example-view
     ID View Name: example-view
     User object overrides: example-user1
     Group object overrides: example-group

Procedure

1. Create your Ansible playbook file add-idoverrideuser-with-name-and-homedir.yml with the following content:

   ---
   - name: Playbook to manage idoverrideuser
     hosts: ipaserver
     become: false
     gather_facts: false
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
   
     tasks:
     - name: Ensure idview_for_client1 is present
       idview:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: idview_for_client1
     - name: Ensure idview_for_client1 is applied to client1.idm.example.com
       idview:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: idview_for_client1
         host: client1.idm.example.com
         action: member
     - name: Ensure idm_user is present in idview_for_client1 with homedir /home/user_1234 and name user_1234
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: idview_for_client1
         anchor: idm_user
         name: user_1234
         homedir: /home/user_1234

2. Run the playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file::

   $ ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/inventory <path_to_playbooks_directory>/add-idoverrideuser-with-name-and-homedir.yml

3. Optional: If you have root credentials, you can apply the new configuration to the IdM client system immediately:

   1. SSH to the client system as root:

      $ ssh root@client1
      Password:

   2. On the IdM client, clear the SSSD cache:

      # sss_cache -E

   3. On the IdM client, restart the SSSD daemon:

      # systemctl restart sssd

Verification

1. SSH to IdM client as idm_user:

   # ssh idm_user@client1.idm.example.com
   Password:
   
   Last login: Sun Jun 21 22:34:25 2020 from 192.168.122.229
   [user_1234@client1 ~]$

2. Print the working directory:

   $ pwd
   /home/user_1234/

Procedure

1. Create your Ansible playbook file ensure-idoverrideuser-can-login-with-sshkey.yml with the following content:

   ---
   - name: Playbook to manage idoverrideuser
     hosts: ipaserver
     become: false
     gather_facts: false
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
   
     tasks:
     - name: Ensure test user idm_user is present in idview idview_for_client1 with sshpubkey
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: idview_for_client1
         anchor: idm_user
         sshpubkey:
         - ssh-rsa AAAAB3NzaC1yc2EAAADAQABAAABgQCqmVDpEX5gnSjKuv97Ay ...
     - name: Ensure idview_for_client1 is applied to client1.idm.example.com
       ipaidview:
         ipaadmin_password:  "{{ ipaadmin_password }}"
         name: idview_for_client1
         host: client1.idm.example.com
         action: member

2. Run the playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/inventory <path_to_playbooks_directory>/ensure-idoverrideuser-can-login-with-sshkey.yml

3. Optional: If you have root credentials, you can apply the new configuration to the IdM client system immediately:

   1. SSH to the client system as root:

      $ ssh root@client1
      Password:

   2. On the IdM client, clear the SSSD cache:

      # sss_cache -E

   3. On the IdM client, restart the SSSD daemon:

      # systemctl restart sssd

Procedure

1. On client.idm.example.com, add [SUCCESS=merge] to the /etc/nsswitch.conf file:

   [...]
   # Allow initgroups to default to the setting for group.
   initgroups: sss [SUCCESS=merge] files

2. Identify the GID of the local audio group:

   $ getent group audio
   ---------------------
   audio:x:63

3. On your Ansible control node, create an add-aduser-to-audio-group.yml playbook with a task to add the aduser@addomain.com user override to the Default Trust View:

   ---
   - name: Playbook to manage idoverrideuser
     hosts: ipaserver
     become: false
   
     tasks:
     - name: Add aduser@addomain.com user to the Default Trust View
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: "Default Trust View"
         anchor: aduser@addomain.com

4. Use another playbook task in the same playbook to add the group audio to IdM with the GID of 63. Add the aduser idoverrideuser to the group:

     - name: Add the audio group with the aduser member and GID of 63
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: audio
         idoverrideuser:
         - aduser@addomain.com
         gidnumber: 63

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-aduser-to-audio-group.yml

Verification

1. Log in to the IdM client as the AD user:

   $ ssh aduser@addomain.com@client.idm.example.com

2. Verify the group membership of the AD user:

   $ id aduser@addomain.com
   uid=702801456(aduser@addomain.com) gid=63(audio) groups=63(audio)

Procedure

1. Create an Ansible playbook file named ensure-idmuser-and-local-user-have-access-to-same-files.yml with the following content:

   ---
   - name: Ensure both local user and IdM user have access to same files
     hosts: ipaserver
     become: false
     gather_facts: false
   
     tasks:
     - name: Ensure idview_for_host1 is applied to host1.idm.example.com
       ipaidview:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: idview_for_host01
         host: host1.idm.example.com
     - name: Ensure idmuser is present in idview_for_host01 with the UID of 20001
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: idview_for_host01
         anchor: idm_user
         UID: 20001

2. Save the file.

3. Run the playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-idmuser-and-local-user-have-access-to-same-files.yml

Procedure

1. Create your Ansible playbook file ensure-idmuser-present-in-idview-with-certificates.yml with the following content:

   ---
   - name: Ensure both local user and IdM user have access to same files
     hosts: ipaserver
     become: false
     gather_facts: false
   
     tasks:
     - name: Ensure idview_for_host1 is applied to host01.idm.example.com
       ipaidview:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: idview_for_host01
         host: host01.idm.example.com
   
     - name: Ensure an IdM user is present in ID view with two certificates
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: idview_for_host01
         anchor: idm_user
         certificate:
         - "{{ lookup('file', 'cert1.b64', rstrip=False) }}"
         - "{{ lookup('file', 'cert2.b64', rstrip=False) }}"

   The rstrip=False directive causes the white space not to be removed from the end of the looked-up file.

2. Save the file.

3. Run the playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-idmuser-present-in-idview-with-certificates.yml

Procedure

1. Create an Ansible playbook file named give-idm-group-access-to-sound-card-on-idm-client.yml with the following content:

   $ getent group audio
   ---------------------
   audio:x:63

2. On your Ansible control node, create an give-idm-group-access-to-sound-card-on-idm-client.yml playbook with the following tasks:

   ---
   - name: Playbook to give IdM group access to sound card on IdM client
     hosts: ipaserver
     become: false
   
     tasks:
     - name: Ensure the audio group exists in IdM
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: audio
   
     - name: Ensure idview_for_host01 exists and is applied to host01.idm.example.com
       ipaidview:
         ipaadmin_password:  "{{ ipaadmin_password }}"
         name: idview_for_host01
         host: host01.idm.example.com
   
     - name: Add an override for the IdM audio group with GID 63 to idview_for_host01
       ipaidoverridegroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: idview_for_host01
         anchor: audio
         GID: 63

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory give-idm-group-access-to-sound-card-on-idm-client.yml

Verification

1. On an IdM client, obtain IdM administrator’s credentials:

   $ kinit admin
   Password:

2. Create a test IdM user:

   $ ipa user-add testuser --first test --last user --password
   User login [tuser]:
   Password:
   Enter Password again to verify:
   ------------------
   Added user "tuser"
   ------------------

3. Add the user to the IdM audio group:

   $ ipa group-add-member --tuser audio

4. Log in to host01.idm.example.com as tuser:

   $ ssh tuser@host01.idm.example.com

5. Verify the group membership of the user:

   $ id tuser
   uid=702801456(tuser) gid=63(audio) groups=63(audio)