Créer un Bind DN pour Foreman

FIXME À traduire et mettre en forme

For setting up freeIPA authentication for Foreman I liked to have a seperate system account binddn.

In order to do this you first need to create a file like this:

 cat <<EOF >foreman-binddn.update
 dn: uid=foreman,cn=sysaccounts,cn=etc,dc=example,dc=com
 add:objectclass:account
 add:objectclass:simplesecurityobject
 add:uid:foreman
 add:userPassword:averysecurepassword
 add:passwordExpirationTime:20380119031407Z
 add:nsIdleTimeout:0
 EOF

and then you import it into the freeIPA (as root) like this:

ipa-ldap-updater foreman-binddn.update

You can check if the new user is present running:

ldapsearch -D "cn=Directory Manager" -x uid=foreman -W

Optional you can also add a group in freeIPA where you put all Foreman admins inside:

 ipa group-add --desc="Foreman Admins" foreman_admins

This one is used below as the optional LDAP filter.

On the Foreman you supply the following information: LDAP Server

 Server: <ipa-server>
 port: 389
 Server type: FreeIPA

Account

 Account Username: uid=foreman,cn=sysaccounts,cn=etc,dc=example,dc=com
 Account Password: averysecurepassword
 Base DN: cn=users,cn=accounts,dc=example,dc=com
 Groups Base DN: cn=groups,cn=accounts,dc=example,dc=com
 LDAP filter: (memberOf=cn=foreman_admins,cn=groups,cn=accounts,dc=example,dc=com)
 Check both boxes of: 
 Automatically create accounts in Foreman
 Usergroup sync

Atrribute mappings

 Login name attribue: uid
 First name attribute: givenName
 Surname attribute: sn
 Email address attribute: mail
  • infrastructure/annuaires/freeipa/binddn.txt
  • Dernière modification : 10/10/2020 11:47
  • de Stéphane Paillet