Using external Red Hat utilities with Identity Management

1. An IdM client user initiates OAuth 2.0 Device Authorization Grant flow, for example, by attempting to retrieve a Kerberos TGT with the kinit utility at the command line.
2. A special code and website link are sent from the Authorization Server to the IdM KDC backend.
3. The IdM client displays the link and the code to the user. In this example, the IdM client outputs the link and code on the command line.

4. The user opens the website link in a browser, which can be on another host, a mobile phone, and so on:

   1. The user enters the special code.
   2. If necessary, the user logs in to the OAuth 2.0-based IdP.
   3. The user is prompted to authorize the client to access information.
5. The user confirms access at the original device prompt. In this example, the user hits the Enter key at the command line.
6. The IdM KDC backend polls the OAuth 2.0 Authorization Server for access to user information.

Procedure

1. Authenticate as the IdM admin on an IdM server.

   [root@server ~]# kinit admin

2. Create a reference called my-keycloak-idp to an IdP based on the Keycloak template, where the --base-url option specifies the URL to the Keycloak server in the format server-name.$DOMAIN:$PORT/prefix.

   [root@server ~]# ipa idp-add my-keycloak-idp \
                    --provider keycloak --organization main \
                    --base-url keycloak.idm.example.com:8443/auth \
                    --client-id id13778
   ------------------------------------------------
   Added Identity Provider reference "my-keycloak-idp"
   ------------------------------------------------
     Identity Provider reference name: my-keycloak-idp
     Authorization URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/auth
     Device authorization URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/auth/device
     Token URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/token
     User info URI: https://keycloak.idm.example.com:8443/auth/realms/main/protocol/openid-connect/userinfo
     Client identifier: ipa_oidc_client
     Scope: openid email
     External IdP user identifier attribute: email

Procedure

1. Authenticate as the IdM admin on an IdM server.

   [root@server ~]# kinit admin

2. Manage the IdP reference.

   • To find an IdP reference whose entry includes the string keycloak:

     [root@server ~]# ipa idp-find keycloak

   • To display an IdP reference named my-keycloak-idp:

     [root@server ~]# ipa idp-show my-keycloak-idp

   • To modify an IdP reference, use the ipa idp-mod command. For example, to change the secret for an IdP reference named my-keycloak-idp, specify the --secret option to be prompted for the secret:

     [root@server ~]# ipa idp-mod my-keycloak-idp --secret

   • To delete an IdP reference named my-keycloak-idp:

     [root@server ~]# ipa idp-del my-keycloak-idp

1. Retrieve and store an anonymous Kerberos ticket locally.
2. Request the TGT for the idm-user-with-external-idp user by using kinit with the -T option to enable Flexible Authentication via Secure Tunneling (FAST) channel to provide a secure connection between the Kerberos client and Kerberos Distribution Center (KDC).

Procedure

1. Use Anonymous PKINIT to obtain a Kerberos ticket and store it in a file named ./fast.ccache.

   $ kinit -n -c ./fast.ccache

2. Optional: View the retrieved ticket:

   $ klist -c fast.ccache
   Ticket cache: FILE:fast.ccache
   Default principal: WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS
   
   Valid starting       Expires              Service principal
   03/03/2024 13:36:37  03/04/2024 13:14:28  krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM

3. Begin authenticating as the IdM user, using the -T option to enable the FAST communication channel.

   [root@client ~]# kinit -T ./fast.ccache idm-user-with-external-idp
   Authenticate at https://oauth2.idp.com:8443/auth/realms/master/device?user_code=YHMQ-XKTL and press ENTER.:

4. In a browser, authenticate as the user at the website provided in the command output.
5. At the command line, press the Enter key to finish the authentication process.

Procedure

1. Attempt to log in to the IdM client via SSH.

   [user@client ~]$ ssh idm-user-with-external-idp@client.idm.example.com
   (idm-user-with-external-idp@client.idm.example.com) Authenticate at https://oauth2.idp.com:8443/auth/realms/main/device?user_code=XYFL-ROYR and press ENTER.

2. In a browser, authenticate as the user at the website provided in the command output.
3. At the command line, press the Enter key to finish the authentication process.

Procedure

1. Install the required packages:

   [root@ipaserver ~]# dnf install ipa-server-trust-ad samba-client

2. Authenticate as the IdM administrative user:

   [root@ipaserver ~]# kinit admin

3. Run the ipa-adtrust-install utility:

   [root@ipaserver ~]# ipa-adtrust-install

   The DNS service records are created automatically if IdM was installed with an integrated DNS server.

   If you installed IdM without an integrated DNS server, ipa-adtrust-install prints a list of service records that you must manually add to DNS before you can continue.

4. The script prompts you that the /etc/samba/smb.conf already exists and will be rewritten:

   WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing Samba configuration.
   
   Do you wish to continue? [no]: yes

5. The script prompts you to configure the slapi-nis plug-in, a compatibility plug-in that allows older Linux clients to work with trusted users:

   Do you want to enable support for trusted domains in Schema Compatibility plugin?
   This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.
   
   Enable trusted domains support in slapi-nis? [no]: yes

6. You are prompted to run the SID generation task to create a SID for any existing users:

   Do you want to run the ipa-sidgen task? [no]: yes

   This is a resource-intensive task, so if you have a high number of users, you can run this at another time.

7. Optional: By default, the Dynamic RPC port range is defined as 49152-65535 for Windows Server 2008 and later. If you need to define a different Dynamic RPC port range for your environment, configure Samba to use different ports and open those ports in your firewall settings. The following example sets the port range to 55000-65000.

   [root@ipaserver ~]# net conf setparm global 'rpc server dynamic port range' 55000-65000
   [root@ipaserver ~]# firewall-cmd --add-port=55000-65000/tcp
   [root@ipaserver ~]# firewall-cmd --runtime-to-permanent

8. Restart the ipa service:

   [root@ipaserver ~]# ipactl restart

9. Use the smbclient utility to verify that Samba responds to Kerberos authentication from the IdM side:

   [root@ipaserver ~]# smbclient -L ipaserver.idm.example.com -U user_name --use-kerberos=required
   lp_load_ex: changing to config backend registry
       Sharename       Type      Comment
       ---------       ----      -------
       IPC$            IPC       IPC Service (Samba 4.15.2)
   ...

Procedure

1. Install the ipa-client-samba package:

   [root@idm_client]# dnf install ipa-client-samba

2. Use the ipa-client-samba utility to prepare the client and create an initial Samba configuration:

   [root@idm_client]# ipa-client-samba
   Searching for IPA server...
   IPA server: DNS discovery
   Chosen IPA master: idm_server.idm.example.com
   SMB principal to be created: cifs/idm_client.idm.example.com@IDM.EXAMPLE.COM
   NetBIOS name to be used: IDM_CLIENT
   Discovered domains to use:
   
    Domain name: idm.example.com
   NetBIOS name: IDM
            SID: S-1-5-21-525930803-952335037-206501584
       ID range: 212000000 - 212199999
   
    Domain name: ad.example.com
   NetBIOS name: AD
            SID: None
       ID range: 1918400000 - 1918599999
   
   Continue to configure the system with these values? [no]: yes
   Samba domain member is configured. Please check configuration at /etc/samba/smb.conf and start smb and winbind services

3. By default, ipa-client-samba automatically adds the [homes] section to the /etc/samba/smb.conf file that dynamically shares a user’s home directory when the user connects. If users do not have home directories on this server, or if you do not want to share them, remove the following lines from /etc/samba/smb.conf:

   [homes]
       read only = no

4. Share directories and printers. For details, see the following sections:

   • Setting up a Samba file share that uses POSIX ACLs
   • Setting up a share that uses Windows ACLs
   • Setting up Samba as a print server

5. Open the ports required for a Samba client in the local firewall:

   [root@idm_client]# firewall-cmd --permanent --add-service=samba-client
   [root@idm_client]# firewall-cmd --reload

6. Enable and start the smb and winbind services:

   [root@idm_client]# systemctl enable --now smb winbind

Procedure

1. Authenticate using the host’s keytab:

   [root@idm_client]# kinit -k

2. Use the ipa idrange-find command to display both the base ID and the ID range size of the new domain. For example, the following command displays the values for the ad.example.com domain:

   [root@idm_client]# ipa idrange-find --name="AD.EXAMPLE.COM_id_range" --raw
   ---------------
   1 range matched
   ---------------
     cn: AD.EXAMPLE.COM_id_range
     ipabaseid: 1918400000
     ipaidrangesize: 200000
     ipabaserid: 0
     ipanttrusteddomainsid: S-1-5-21-968346183-862388825-1738313271
     iparangetype: ipa-ad-trust
   ----------------------------
   Number of entries returned 1
   ----------------------------

   You need the values from the ipabaseid and ipaidrangesize attributes in the next steps.

3. To calculate the highest usable ID, use the following formula:

   maximum_range = ipabaseid + ipaidrangesize - 1

   With the values from the previous step, the highest usable ID for the ad.example.com domain is 1918599999 (1918400000 + 200000 - 1).

4. Edit the /etc/samba/smb.conf file, and add the ID mapping configuration for the domain to the [global] section:

   idmap config AD : range = 1918400000 - 1918599999
   idmap config AD : backend = sss

   Specify the value from ipabaseid attribute as the lowest and the computed value from the previous step as the highest value of the range.

5. Restart the smb and winbind services:

   [root@idm_client]# systemctl restart smb winbind

Procedure

1. Enable the NIS listener and compatibility plug-ins on IdM server:

   [root@ipaserver ~]# ipa-nis-manage enable
   [root@ipaserver ~]# ipa-compat-manage enable

2. Optional: For a more strict firewall configuration, set a fixed port.

   For example, to set the port to unused port 514:

   [root@ipaserver ~]# ldapmodify -x -D 'cn=directory manager' -W
   dn: cn=NIS Server,cn=plugins,cn=config
   changetype: modify
   add: nsslapd-pluginarg0
   nsslapd-pluginarg0: 514

   Warning

   To avoid conflict with other services do not use any port number above 1024.

3. Enable and start the port mapper service:

   [root@ipaserver ~]# systemctl enable rpcbind.service
   [root@ipaserver ~]# systemctl start rpcbind.service

4. Restart Directory Server:

   [root@ipaserver ~]# systemctl restart dirsrv.target

Procedure

1. Install the yp-tools package:

   [root@nis-server ~]# dnf install yp-tools -y

2. On the NIS server create the /root/nis-users.sh script with the following content:

   #!/bin/sh
   # $1 is the NIS domain, $2 is the primary NIS server
   ypcat -d $1 -h $2 passwd > /dev/shm/nis-map.passwd 2>&1
   
   IFS=$'\n'
   for line in $(cat /dev/shm/nis-map.passwd) ; do
   	IFS=' '
   	username=$(echo $line | cut -f1 -d:)
   	# Not collecting encrypted password because we need cleartext password
   	# to create kerberos key
   	uid=$(echo $line | cut -f3 -d:)
   	gid=$(echo $line | cut -f4 -d:)
   	gecos=$(echo $line | cut -f5 -d:)
   	homedir=$(echo $line | cut -f6 -d:)
   	shell=$(echo $line | cut -f7 -d:)
   
   	# Now create this entry
   	echo passw0rd1 | ipa user-add $username --first=NIS --last=USER \
   	     --password --gidnumber=$gid --uid=$uid --gecos="$gecos" --homedir=$homedir \
   	     --shell=$shell
   	ipa user-show $username
   done

3. Authenticate as the IdM admin user:

   [root@nis-server ~]# kinit admin

4. Run the script. For example:

   [root@nis-server ~]# sh /root/nis-users.sh nisdomain nis-server.example.com

   Important

   This script uses hard-coded values for first name, last name, and sets the password to passw0rd1. The user must change the temporary password at the next login.

Procedure

1. Install the yp-tools package:

   [root@nis-server ~]# dnf install yp-tools -y

2. Create the /root/nis-groups.sh script with the following content on the NIS server:

   #!/bin/sh
   # $1 is the NIS domain, $2 is the primary NIS server
   ypcat -d $1 -h $2 group > /dev/shm/nis-map.group 2>&1
   
   IFS=$'\n'
   for line in $(cat /dev/shm/nis-map.group); do
   	IFS=' '
   	groupname=$(echo $line | cut -f1 -d:)
   	# Not collecting encrypted password because we need cleartext password
   	# to create kerberos key
   	gid=$(echo $line | cut -f3 -d:)
   	members=$(echo $line | cut -f4 -d:)
   
   	# Now create this entry
   	ipa group-add $groupname --desc=NIS_GROUP_$groupname --gid=$gid
   	if [ -n "$members" ]; then
   		useropts=$(eval echo --users={$members})
   		ipa group-add-member $groupname $useropts
   	fi
   	ipa group-show $groupname
   done

   Note

   Make sure your usernames do not contain any special characters to ensure successful migration of the user group.

3. Authenticate as the IdM admin user:

   [root@nis-server ~]# kinit admin

4. Run the script. For example:

   [root@nis-server ~]# sh /root/nis-groups.sh nisdomain nis-server.example.com

Procedure

1. Install the yp-tools package:

   [root@nis-server ~]# dnf install yp-tools -y

2. Create the /root/nis-hosts.sh script with the following content on the NIS server:

   #!/bin/sh
   # $1 is the NIS domain, $2 is the primary NIS server
   ypcat -d $1 -h $2 hosts | egrep -v "localhost|127.0.0.1" > /dev/shm/nis-map.hosts 2>&1
   
   IFS=$'\n'
   for line in $(cat /dev/shm/nis-map.hosts); do
   	IFS=' '
   	ipaddress=$(echo $line | awk '{print $1}')
   	hostname=$(echo $line | awk '{print $2}')
   	primary=$(ipa env xmlrpc_uri | tr -d '[:space:]' | cut -f3 -d: | cut -f3 -d/)
   	domain=$(ipa env domain | tr -d '[:space:]' | cut -f2 -d:)
   	if [ $(echo $hostname | grep "\." |wc -l) -eq 0 ] ; then
   		hostname=$(echo $hostname.$domain)
   	fi
   	zone=$(echo $hostname | cut -f2- -d.)
   	if [ $(ipa dnszone-show $zone 2>/dev/null | wc -l) -eq 0 ] ; then
   		ipa dnszone-add --name-server=$primary --admin-email=root.$primary
   	fi
   	ptrzone=$(echo $ipaddress | awk -F. '{print $3 "." $2 "." $1 ".in-addr.arpa."}')
   	if [ $(ipa dnszone-show $ptrzone 2>/dev/null | wc -l) -eq 0 ] ; then
   		ipa dnszone-add  $ptrzone --name-server=$primary --admin-email=root.$primary
   	fi
   	# Now create this entry
   	ipa host-add $hostname --ip-address=$ipaddress
   	ipa host-show $hostname
   done

3. Authenticate as the IdM admin user:

   [root@nis-server ~]# kinit admin

4. Run the script. For example:

   [root@nis-server ~]# sh /root/nis-hosts.sh nisdomain nis-server.example.com

   Note

   This script does not migrate special host configurations, such as aliases.

Procedure

1. Install the yp-tools package:

   [root@nis-server ~]# dnf install yp-tools -y

2. Create the /root/nis-netgroups.sh script with the following content on the NIS server:

   #!/bin/sh
   # $1 is the NIS domain, $2 is the primary NIS server
   ypcat -k -d $1 -h $2 netgroup > /dev/shm/nis-map.netgroup 2>&1
   
   IFS=$'\n'
   for line in $(cat /dev/shm/nis-map.netgroup); do
   	IFS=' '
   	netgroupname=$(echo $line | awk '{print $1}')
   	triples=$(echo $line | sed "s/^$netgroupname //")
   	echo "ipa netgroup-add $netgroupname --desc=NIS_NG_$netgroupname"
   	if [ $(echo $line | grep "(," | wc -l) -gt 0 ]; then
   		echo "ipa netgroup-mod $netgroupname --hostcat=all"
   	fi
   	if [ $(echo $line | grep ",," | wc -l) -gt 0 ]; then
   		echo "ipa netgroup-mod $netgroupname --usercat=all"
   	fi
   
   	for triple in $triples; do
   		triple=$(echo $triple | sed -e 's/-//g' -e 's/(//' -e 's/)//')
   		if [ $(echo $triple | grep ",.*," | wc -l) -gt 0 ]; then
   			hostname=$(echo $triple | cut -f1 -d,)
   			username=$(echo $triple | cut -f2 -d,)
   			domain=$(echo $triple | cut -f3 -d,)
   			hosts=""; users=""; doms="";
   			[ -n "$hostname" ] && hosts="--hosts=$hostname"
   			[ -n "$username" ] && users="--users=$username"
   			[ -n "$domain"   ] && doms="--nisdomain=$domain"
   			echo "ipa netgroup-add-member $netgroup $hosts $users $doms"
   		else
   			netgroup=$triple
   			echo "ipa netgroup-add $netgroup --desc=<NIS_NG>_$netgroup"
   		fi
   	done
   done

3. Authenticate as the IdM admin user:

   [root@nis-server ~]# kinit admin

4. Run the script. For example:

   [root@nis-server ~]# sh /root/nis-netgroups.sh nisdomain nis-server.example.com

Procedure

1. Install the yp-tools package:

   [root@nis-server ~]# dnf install yp-tools -y

2. Create the /root/nis-automounts.sh script with the following content on the NIS server:

   #!/bin/sh
   # $1 is for the automount entry in ipa
   
   ipa automountlocation-add $1
   
   # $2 is the NIS domain, $3 is the primary NIS server, $4 is the map name
   
   ypcat -k -d $2 -h $3 $4 > /dev/shm/nis-map.$4 2>&1
   
   ipa automountmap-add $1 $4
   
   basedn=$(ipa env basedn | tr -d '[:space:]' | cut -f2 -d:)
   cat > /tmp/amap.ldif <<EOF
   dn: nis-domain=$2+nis-map=$4,cn=NIS Server,cn=plugins,cn=config
   objectClass: extensibleObject
   nis-domain: $2
   nis-map: $4
   nis-base: automountmapname=$4,cn=$1,cn=automount,$basedn
   nis-filter: (objectclass=\*)
   nis-key-format: %{automountKey}
   nis-value-format: %{automountInformation}
   EOF
   
   # $5 is the LDAP server
   
   ldapadd -x -h $5 -D "cn=Directory Manager" -W -f /tmp/amap.ldif
   
   IFS=$'\n'
   for line in $(cat /dev/shm/nis-map.$4); do
   	IFS=" "
   	key=$(echo "$line" | awk '{print $1}')
   	info=$(echo "$line" | sed -e "s^$key[ \t]*")
   	ipa automountkey-add nis $4 --key="$key" --info="$info"
   done

   Note

   The script exports the NIS automount information, generates an LDAP Data Interchange Format (LDIF) for the automount location and associated map, and imports the LDIF file into the IdM Directory Server.

3. Authenticate as the IdM admin user:

   [root@nis-server ~]# kinit admin

4. Run the script. For example:

   [root@nis-server ~]# sh /root/nis-automounts.sh location nisdomain
        nis-server.example.com map_name

Procedure

1. Obtain a kerberos ticket as an IdM administrator:

   # kinit admin

2. Create a nfs/<FQDN> service principal:

   # ipa service-add nfs/nfs_server.idm.example.com

3. Retrieve the nfs service principal from IdM, and store it in the /etc/krb5.keytab file:

   # ipa-getkeytab -s idm_server.idm.example.com -p nfs/nfs_server.idm.example.com -k /etc/krb5.keytab

4. Optional: Display the principals in the /etc/krb5.keytab file:

   # klist -k /etc/krb5.keytab
   Keytab name: FILE:/etc/krb5.keytab
   KVNO Principal
   ---- --------------------------------------------------------------------------
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM

   By default, the IdM client adds the host principal to the /etc/krb5.keytab file when you join the host to the IdM domain. If the host principal is missing, use the ipa-getkeytab -s idm_server.idm.example.com -p host/nfs_server.idm.example.com -k /etc/krb5.keytab command to add it.

5. Use the ipa-client-automount utility to configure mapping of IdM IDs:

   #  ipa-client-automount
   Searching for IPA server...
   IPA server: DNS discovery
   Location: default
   Continue to configure the system with these values? [no]: yes
   Configured /etc/idmapd.conf
   Restarting sssd, waiting for it to become available.
   Started autofs

6. Update your /etc/exports file, and add the Kerberos security method to the client options. For example:

   /nfs/projects/      	192.0.2.0/24(rw,sec=krb5i)

   If you want that your clients can select from multiple security methods, specify them separated by colons:

   /nfs/projects/      	192.0.2.0/24(rw,sec=krb5:krb5i:krb5p)

7. Reload the exported file systems:

   # exportfs -r

Procedure

1. Create the raleigh automount location:

   $ ipa automountlocation-add raleigh
   ----------------------------------
   Added automount location "raleigh"
   ----------------------------------
     Location: raleigh

2. Create an auto.devel automount map in the raleigh location:

   $ ipa automountmap-add raleigh auto.devel
   --------------------------------
   Added automount map "auto.devel"
   --------------------------------
     Map: auto.devel

3. Add the keys and mount information for the exports/ share:

   1. Add the key and mount information for the auto.devel map:

      $ ipa automountkey-add raleigh auto.devel --key='*' --info='-sec=krb5p,vers=4 nfs-server.idm.example.com:/exports/&'
      -----------------------
      Added automount key "*"
      -----------------------
        Key: *
        Mount information: -sec=krb5p,vers=4 nfs-server.idm.example.com:/exports/&

   2. Add the key and mount information for the auto.master map:

      $ ipa automountkey-add raleigh auto.master --key=/devel --info=auto.devel
      ----------------------------
      Added automount key "/devel"
      ----------------------------
        Key: /devel
        Mount information: auto.devel

Procedure

1. On the IdM client, enter the ipa-client-automount command and specify the location. Use the -U option to run the script unattended:

   # ipa-client-automount --location raleigh -U

2. Stop the autofs service, clear the SSSD cache, and start the autofs service to load the new configuration settings:

   # systemctl stop autofs ; sss_cache -E ; systemctl start autofs

Procedure

1. Verify that the IdM user can access the read-write directory:

   1. Connect to the IdM client as the IdM user:

      $ ssh idm_user@idm-client.idm.example.com
      Password:

   2. Obtain the ticket-granting ticket (TGT) for the IdM user:

      $ kinit idm_user

   3. Optional: View the group membership of the IdM user:

      $ ipa user-show idm_user
        User login: idm_user
        [...]
        Member of groups: developers, ipausers

   4. Navigate to the /devel/project directory:

      $ cd /devel/project

   5. List the directory contents:

      $ ls
      rw_file

   6. Add a line to the file in the directory to test the write permission:

      $ echo "idm_user can write into the file" > rw_file

   7. Optional: View the updated contents of the file:

      $ cat rw_file
      this is a read-write file
      idm_user can write into the file

   The output confirms that idm_user can write into the file.

Procedure

1. Obtain a kerberos ticket as an IdM administrator:

   # kinit admin

2. Create a nfs/<FQDN> service principal:

   # ipa service-add nfs/nfs_server.idm.example.com

3. Retrieve the nfs service principal from IdM, and store it in the /etc/krb5.keytab file:

   # ipa-getkeytab -s idm_server.idm.example.com -p nfs/nfs_server.idm.example.com -k /etc/krb5.keytab

4. Optional: Display the principals in the /etc/krb5.keytab file:

   # klist -k /etc/krb5.keytab
   Keytab name: FILE:/etc/krb5.keytab
   KVNO Principal
   ---- --------------------------------------------------------------------------
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM
      7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM

   By default, the IdM client adds the host principal to the /etc/krb5.keytab file when you join the host to the IdM domain. If the host principal is missing, use the ipa-getkeytab -s idm_server.idm.example.com -p host/nfs_server.idm.example.com -k /etc/krb5.keytab command to add it.

5. Use the ipa-client-automount utility to configure mapping of IdM IDs:

   #  ipa-client-automount
   Searching for IPA server...
   IPA server: DNS discovery
   Location: default
   Continue to configure the system with these values? [no]: yes
   Configured /etc/idmapd.conf
   Restarting sssd, waiting for it to become available.
   Started autofs

6. Update your /etc/exports file, and add the Kerberos security method to the client options. For example:

   /nfs/projects/      	192.0.2.0/24(rw,sec=krb5i)

   If you want that your clients can select from multiple security methods, specify them separated by colons:

   /nfs/projects/      	192.0.2.0/24(rw,sec=krb5:krb5i:krb5p)

7. Reload the exported file systems:

   # exportfs -r

Procedure

1. On your Ansible control node, navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the automount-location-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automount/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/automount/automount-location-present.yml automount-location-map-and-key-present.yml

3. Open the automount-location-map-and-key-present.yml file for editing.

4. Adapt the file by setting the following variables in the ipaautomountlocation task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to raleigh.

   • Ensure that the state variable is set to present.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Automount location present example
     hosts: ipaserver
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure automount location is present
       ipaautomountlocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: raleigh
         state: present

5. Continue editing the automount-location-map-and-key-present.yml file:

   1. In the tasks section, add a task to ensure the presence of an automount map:

      [...]
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
      [...]
        - name: ensure map named auto.devel in location raleigh is created
          ipaautomountmap:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: auto.devel
            location: raleigh
            state: present

   2. Add another task to add the mount point and NFS server information to the map:

      [...]
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
      [...]
        - name: ensure automount key /devel/project is present
          ipaautomountkey:
            ipaadmin_password: "{{ ipaadmin_password }}"
            location: raleigh
            mapname: auto.devel
            key: /devel/project
            info: nfs-server.idm.example.com:/exports/project
            state: present

   3. Add another task to ensure auto.devel is connected to auto.master:

      [...]
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
      [...]
      - name: Ensure auto.devel is connected in auto.master:
        ipaautomountkey:
          ipaadmin_password: "{{ ipaadmin_password }}"
          location: raleigh
          mapname: auto.map
          key: /devel
          info: auto.devel
          state: present

6. Save the file.

7. Run the Ansible playbook and specify the playbook and inventory files:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory automount-location-map-and-key-present.yml

Procedure

1. On your Ansible control node, navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Open the automount-location-map-and-key-present.yml file for editing.

3. In the tasks section, add a task to ensure that the IdM developers group exists and idm_user is added to this group:

   [...]
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   [...]
     - ipagroup:
        ipaadmin_password: "{{ ipaadmin_password }}"
         name: developers
         user:
         - idm_user
         state: present

4. Save the file.

5. Run the Ansible playbook and specify the playbook and inventory files:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory automount-location-map-and-key-present.yml

6. On the NFS server, change the group ownership of the /exports/project directory to developers so that every IdM user in the group can access the directory:

   # chgrp developers /exports/project

Procedure

1. On the IdM client, enter the ipa-client-automount command and specify the location. Use the -U option to run the script unattended:

   # ipa-client-automount --location raleigh -U

2. Stop the autofs service, clear the SSSD cache, and start the autofs service to load the new configuration settings:

   # systemctl stop autofs ; sss_cache -E ; systemctl start autofs

Procedure

1. Verify that the IdM user can access the read-write directory:

   1. Connect to the IdM client as the IdM user:

      $ ssh idm_user@idm-client.idm.example.com
      Password:

   2. Obtain the ticket-granting ticket (TGT) for the IdM user:

      $ kinit idm_user

   3. Optional: View the group membership of the IdM user:

      $ ipa user-show idm_user
        User login: idm_user
        [...]
        Member of groups: developers, ipausers

   4. Navigate to the /devel/project directory:

      $ cd /devel/project

   5. List the directory contents:

      $ ls
      rw_file

   6. Add a line to the file in the directory to test the write permission:

      $ echo "idm_user can write into the file" > rw_file

   7. Optional: View the updated contents of the file:

      $ cat rw_file
      this is a read-write file
      idm_user can write into the file

   The output confirms that idm_user can write into the file.