Chapter 49. Enabling AD users to administer IdM

Procedure

1. As an IdM administrator, create an ID override for an AD user in the Default Trust View. For example, to create an ID override for the user ad_user@ad.example.com:

   # kinit admin
   # ipa idoverrideuser-add 'default trust view' ad_user@ad.example.com

2. Add the ID override from the Default Trust View as a member of an IdM group. This must be a non-POSIX group, as it interacts with Active Directory.

   If the group in question is a member of an IdM role, the AD user represented by the ID override gains all permissions granted by the role when using the IdM API, including both the command-line interface and the IdM web UI.

   For example, to add the ID override for the ad_user@ad.example.com user to the IdM admins group:

   # ipa group-add-member admins --idoverrideusers=ad_user@ad.example.com

3. Alternatively, you can add the ID override to a role, such as the User Administrator role:

   # ipa role-add-member 'User Administrator' --idoverrideusers=ad_user@ad.example.com

Procedure

1. Destroy the current Kerberos ticket of the IdM administrator:

   # kdestroy -A

   Note

   The destruction of the Kerberos ticket is required because the GSSAPI implementation in MIT Kerberos chooses credentials from the realm of the target service by preference, which in this case is the IdM realm. This means that if a credentials cache collection, namely the KCM:, KEYRING:, or DIR: type of credentials cache is in use, a previously obtained admin or any other IdM principal’s credentials will be used to access the IdM API instead of the AD user’s credentials.

2. Obtain the Kerberos credentials of the AD user for whom an ID override has been created:

   # kinit ad_user@AD.EXAMPLE.COM
   Password for ad_user@AD.EXAMPLE.COM:

3. Test that the ID override of the AD user enjoys the same privileges stemming from membership in the IdM group as any IdM user in that group. If the ID override of the AD user has been added to the admins group, the AD user can, for example, create groups in IdM:

   # ipa group-add some-new-group
   ----------------------------
   Added group "some-new-group"
   ----------------------------
     Group name: some-new-group
     GID: 1997000011

Procedure

1. On your Ansible control node, create an enable-ad-admin-to-administer-idm.yml playbook with a task to add the ad_user@ad.example.com user override to the Default Trust View:

   ---
   - name: Enable AD administrator to act as a FreeIPA admin
     hosts: ipaserver
     become: false
     gather_facts: false
   
     tasks:
     - name: Ensure idoverride for ad_user@ad.example.com in 'Default Trust View'
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: "Default Trust View"
         anchor: ad_user@ad.example.com

   In the example:

   • ad_user@ad.example.com is the user ID override of an AD user that is stored in the AD domain with which a trust has been established.

2. Use another playbook task in the same playbook to add the AD administrator user ID override to the admins group:

     - name: Add the AD administrator as a member of admins
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: admins
         idoverrideuser:
         - ad_user@ad.example.com

   In the example:

   • admins is the name of the default IdM POSIX group to which you are adding the ad_user@ad.example.com ID override. Members of this group have full administrator privileges.
3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory enable-ad-admin-to-administer-idm.yml

Verification

1. Log in to the IdM client as the AD Administrator:

   $ ssh ad_user@ad.example.com@client.idm.example.com

2. Verify that you have obtained a valid ticket-granting ticket (TGT):

   $ klist
   Ticket cache: KCM:325600500:99540
   Default principal: ad_user@AD.EXAMPLE.COM
   Valid starting Expires Service principal
   02/04/2024 11:54:16 02/04/2024 21:54:16 krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM
   renew until 02/05/2024 11:54:16

3. Verify your admin privileges in IdM:

   $ ipa user-add testuser --first=test --last=user
   ------------------------
   Added user "tuser"
   ------------------------
     User login: tuser
     First name: test
     Last name: user
     Full name: test user
   [...]