ipa
ipa is a command-line tool used to interact with the FreeIPA server, an integrated identity and authentication solution. FreeIPA includes multiple components like Kerberos, DNS, LDAP, and Certificate Authority, designed for managing users, groups, hosts, services, and other resources in an enterprise environment.
The ipa command comes with several subcommands to manage trusts, ID ranges, and groups, among others. These commands are particularly useful for administrators who need to manage cross-realm trusts (e.g., Active Directory), configure ID ranges for user mappings, and handle group management in a centralized fashion.
General ipa Command Syntax
ipa Command SyntaxThe general structure of the ipa command is:
For example:
Key Concepts
Trusts: Enable users from trusted domains (e.g., Active Directory) to access services and resources in the FreeIPA domain.
ID Range: A set of UIDs and GIDs used to map users and groups from external identity sources (like AD) to the local IPA environment.
Groups: Used to manage users collectively in terms of permissions and access to resources.
Trust Subcommands
Trusts allow FreeIPA to establish trust relationships with external identity providers like Active Directory. The relevant subcommands are:
Add Trust Adds a new trust relationship between FreeIPA and another domain, such as an Active Directory domain.
Common options:
--type: Type of the trust (e.g.,adfor Active Directory).--range: Specify the ID range for the trusted domain.--admin: Username of the administrator on the remote domain.--password: Password of the administrator (interactive).
Example:
Show Trust Displays details of a trust relationship.
Find Trust Searches for trust relationships.
Delete Trust Removes a trust relationship.
Example:
ID Range Subcommands
ID ranges are important when integrating with external domains (like Active Directory) where users are mapped to FreeIPA’s UID and GID ranges.
Add ID Range Adds a new ID range.
Key options:
--base-id: Starting UID/GID for the range.--range-size: Size of the range.--rid-base: Starting RID for the range.--dom-name: Domain name associated with the range.
Example:
Show ID Range Displays details of an ID range.
Find ID Range Searches for ID ranges.
Delete ID Range Removes an ID range.
Example:
Group Subcommands
Groups in FreeIPA help organize users for access control and permission assignment.
Add Group Creates a new group.
Example:
Add Members to Group Adds users or other groups to an existing group.
Example:
You can also add multiple users or groups at once:
Remove Members from Group Removes users or groups from a group.
Example:
Show Group Displays detailed information about a group.
Find Group Searches for groups by criteria.
Delete Group Deletes a group.
Example:
Other Useful Subcommands
User Subcommands Manage users in the FreeIPA environment.
Add User:
ipa user-addShow User:
ipa user-showDelete User:
ipa user-del
Host Subcommands Manage hosts in the FreeIPA environment.
Add Host:
ipa host-addShow Host:
ipa host-showDelete Host:
ipa host-del
Role Subcommands Manage roles for RBAC (Role-Based Access Control).
Add Role:
ipa role-addAdd Members to Role:
ipa role-add-memberRemove Members from Role:
ipa role-remove-member
Example Scenario: Integrating FreeIPA with Active Directory
Let’s say you want to establish a trust relationship between FreeIPA and an Active Directory domain ad.example.com, and then assign specific users in Active Directory to a group within FreeIPA.
Add Trust
Create a Group in FreeIPA
Map Active Directory Users to FreeIPA Group
In this example, we add a trust to Active Directory, create a group in FreeIPA, and map external users from AD to the newly created group.
Conclusion
The ipa command with its various subcommands for managing trusts, ID ranges, and groups is essential for administrators working with FreeIPA in multi-domain or multi-realm environments, particularly when integrating with systems like Active Directory. These commands enable centralized and efficient management of users, groups, and identity mappings in enterprise setups.
Last updated