Chapter 5. Setting up Systems as IdM Clients
A client is any system which is a member of the Identity Management domain. While this is frequently a Red Hat Enterprise Linux system (and IdM has special tools to make configuring Red Hat Enterprise Linux clients very simple), machines with other operating systems can also be added to the IdM domain.
One important aspect of an IdM client is that only the system configuration determines whether the system is part of the domain. (The configuration includes things like belonging to the Kerberos domain, DNS domain, and having the proper authentication and certificate setup.)
Note
IdM does not require any sort of agent or daemon running on a client for the client to join the domain. However, for the best management options, security, and performance, clients should run the System Security Services Daemon (SSSD).
For more information on SSSD, see the SSSD chapter in the Deployment Guidethe SSSD project page.
This chapter explains how to configure a system to join an IdM domain.
Note
Clients can only be configured after at least one IdM server has been installed.
5.1. What Happens in Client Setup
Whether the client configuration is performed automatically on Red Hat Enterprise Linux systems using the client setup script or manually on other systems, the general process of configuring a machine to serve as an IdM client is mostly the same, with slight variation depending on the platform:
- Retrieve the CA certificate for the IdM CA.
- Create a separate Kerberos configuration to test the provided credentials.This enables a Kerberos connection to the IdM XML-RPC server, necessary to join the IdM client to the IdM domain. This Kerberos configuration is ultimately discarded.Setting up the Kerberos configuration includes specifying the realm and domain details, and default ticket attributes. Forwardable tickets are configured by default, which facilitates connection to the administration interface from any operating system, and also provides for auditing of administration operations. For example, this is the Kerberos configuration for Red Hat Enterprise Linux systems:
[libdefaults] default_realm = EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = false rdns = false forwardable = yes ticket_lifetime = 24h [realms] EXAMPLE.COM = { kdc = server.example.com:88 admin_server = server.example.com:749 } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM - Run the
ipa-joincommand to perform the actual join. - Obtain a service principal for the host service and installs it into
/etc/krb5.keytab. For example,host/ipa.example.com@EXAMPLE.COM. - Enable certmonger, retrieve an SSL server certificate, and install the certificate in
/etc/pki/nssdb. - Disable the nscd daemon.
- Configure SSSD or LDAP/KRB5, including NSS and PAM configuration files.
- Configure an OpenSSH server and client, as well as enabling the host to create DNS SSHFP records.
- Configure NTP.
