Chapter 52. Enabling AD users to administer IdM

Procedure

1. As an IdM administrator, create an ID override for an AD user in the Default Trust View. For example, to create an ID override for the user ad_user@ad.example.com:

   # kinit admin
   # ipa idoverrideuser-add 'default trust view' ad_user@ad.example.com

   Copy to Clipboard Toggle word wrap

2. Add the ID override from the Default Trust View as a member of an IdM group. This must be a non-POSIX group, as it interacts with Active Directory.

   If the group in question is a member of an IdM role, the AD user represented by the ID override gains all permissions granted by the role when using the IdM API, including both the command-line interface and the IdM web UI.

   For example, to add the ID override for the ad_user@ad.example.com user to the IdM admins group:

   # ipa group-add-member admins --idoverrideusers=ad_user@ad.example.com

   Copy to Clipboard Toggle word wrap

3. Alternatively, you can add the ID override to a role, such as the User Administrator role:

   # ipa role-add-member 'User Administrator' --idoverrideusers=ad_user@ad.example.com

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Create an enable-ad-admin-to-administer-idm.yml playbook with a task to add the ad_user@ad.example.com user override to the Default Trust View:

   ---
   - name: Enable AD administrator to act as a FreeIPA admin
     hosts: ipaserver
     become: false
     gather_facts: false
   
     tasks:
     - name: Ensure idoverride for ad_user@ad.example.com in 'Default Trust View'
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: "Default Trust View"
         anchor: ad_user@ad.example.com

   Copy to Clipboard Toggle word wrap

   In the example:

   • ad_user@ad.example.com is the user ID override of an AD user that is stored in the AD domain with which a trust has been established.

3. Use another playbook task in the same playbook to add the AD administrator user ID override to the admins group:

     - name: Add the AD administrator to `admins` group
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: admins
         idoverrideuser:
         - ad_user@ad.example.com

   Copy to Clipboard Toggle word wrap

   In the example:

   • admins is the name of the IdM POSIX group to which you are adding the ad_user@ad.example.com ID override. Members of this group have full administrator privileges.
4. Save the file.

5. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory enable-ad-admin-to-administer-idm.yml

   Copy to Clipboard Toggle word wrap

1. Destroy the current Kerberos ticket of the IdM administrator:

   # kdestroy -A

   Copy to Clipboard Toggle word wrap
   Note

   The destruction of the Kerberos ticket is required because the GSSAPI implementation in MIT Kerberos chooses credentials from the realm of the target service by preference, which in this case is the IdM realm. This means that if a credentials cache collection, namely the KCM:, KEYRING:, or DIR: type of credentials cache is in use, a previously obtained admin or any other IdM principal’s credentials will be used to access the IdM API instead of the AD user’s credentials.

2. Obtain the Kerberos credentials of the AD user for whom an ID override has been created:

   # kinit ad_user@AD.EXAMPLE.COM
   Password for ad_user@AD.EXAMPLE.COM:

   Copy to Clipboard Toggle word wrap

3. Test that the ID override of the AD user enjoys the same privileges stemming from membership in the IdM group as any IdM user in that group. If the ID override of the AD user has been added to the admins group, the AD user can, for example, create groups in IdM:

   # ipa group-add some-new-group
   ----------------------------
   Added group "some-new-group"
   ----------------------------
     Group name: some-new-group
     GID: 1997000011

   Copy to Clipboard Toggle word wrap