Project

General

Profile

RealmJoinIntegration » History » Version 4

Dominic Cleal, 10/03/2013 09:47 AM
basic model/controller layout

1 1 Dominic Cleal
h1. Realm Join Integration
2
3
*This is just sketching out some ideas, it doesn't exist, yet.*
4
5
This page covers ideas for joining hosts to FreeIPA realms or Active Directory domains when they're built, using a hypothetical foreman_realm plugin.
6
7
h2. DNS management
8
9 2 Dominic Cleal
Related, but not actually realm joining.  Updates to DNS can be made via the normal smart proxy route, however for both FreeIPA and AD we require GSS-TSIG support for nsupdate.  This was completed for Foreman 1.2 via #1685.
10 1 Dominic Cleal
11
h2. Realm configuration
12
13
foreman_realm should add a realm model and associate them with domains, plus everything needed to manage them.
14
15 4 Dominic Cleal
* model: ForemanRealm::Realm
16
** associated with domain (one realm to many domains?)
17
** attribute: realm name
18
** attribute: proxy id
19
* controller and views: ForemanRealm::Realms
20
** index, update, edit, delete realms
21
* API controller: ForemanRealm::Api::V2::Realms
22
** index, update, delete realms
23
24
A new orchestration hook needs adding to call the proxy (via Foreman's proxy API) if the associated domain has a realm:
25
26
* app/models/foreman_realm/orchestration/realm.rb
27
** include this into Host::Managed
28
** calls proxy API to add/remove host from realm
29
** saves OTP into host.params for now, perhaps to a separate model later
30
31
The "kickstart templates":https://github.com/theforeman/community-templates would need updating to check for @@host.params["realm-otp"]@ or similar, then run the appropriate join command.
32
33 3 Dominic Cleal
To support classes and hostgroups in IPA (see below), additional attributes could be added to Foreman's host groups (or whatever they get replaced with) to define the IPA classes that the host would have when created.
34 1 Dominic Cleal
35
h2. Host/computer creation
36
37
h3. Proxy support
38
39 4 Dominic Cleal
The proxy should provide an API for creating hosts in realms (or computer objects in AD domains).  As an example:
40 1 Dominic Cleal
41 4 Dominic Cleal
* POST @/realm/:domain/:hostname@
42
** param: classes, array of clases to apply to host
43
* DELETE @/realm/:domain/:hostname@
44
45
(http://projects.theforeman.org/projects/smart-proxy/wiki/API)
46
47
It should advertise the "Realm" API feature.  Foreman core's proxy API and smart proxy model will need updating to understand this new feature.
48
49
Guy Matz has implemented much of this already, complete with vendor/provider support so IPA and other implementations can be swapped: https://github.com/guymatz/smart-proxy/compare/develop...1809-add_IPA_support
50
51 3 Dominic Cleal
h4. FreeIPA
52 1 Dominic Cleal
53 3 Dominic Cleal
For FreeIPA, this can either call the @ipa host-add@ command or the XMLRPC API that backs it.  Here's an example of creating a user with minimal privileges that can create new hosts:
54
55
<pre>
56
# kinit admin
57
# ipa user-add --first=Host --last=Adder hadder
58
59
# ipa privilege-add "Add computers" --desc"Add computers"
60
# ipa privilege-add-permission "Add computers" --permissions="add hosts"
61
62
# ipa role-add "Host Adder" --desc="Can add new hosts"
63
# ipa role-add-privilege "Computer creator" --privilege="Add computers"
64
# ipa role-add-member "Computer creator" --user=hadder
65
66
# ipa-getkeytab -s `hostname` -p hadder@IDM.LAB.BOS.REDHAT.COM -k /root/hadder.keytab
67
# kinit -kt /root/hadder.keytab hadder@IDM.LAB.BOS.REDHAT.COM
68
# klist
69
Ticket cache: DIR::/run/user/0/krb5cc/tkt3GbmCZ
70
Default principal: hadder@IDM.LAB.BOS.REDHAT.COM    <<<<<
71
72
Valid starting       Expires              Service principal
73
06/14/2013 21:54:06  06/15/2013 21:54:06
74
krbtgt/IDM.LAB.BOS.REDHAT.COM@IDM.LAB.BOS.REDHAT.COM
75
</pre>
76
77
System user is now privileged to add hosts to IPA:
78
79
<pre>
80
# ipa host-add random.host.test --random --force
81
-----------------------------
82
Added host "random.host.test"
83
-----------------------------
84
  Host name: random.host.test
85
  Random password: K8-5rr0U8vL,
86
  Password: True
87
  Keytab: False
88
  Managed by: random.host.test
89
</pre>
90
91
He is unable to perform other administrative tasks as expected:
92
93
<pre>
94
# ipa host-mod random.host.test --desc=foo
95
ipa: ERROR: Insufficient access: Insufficient 'write' privilege to the
96
'description' attribute of entry
97
'fqdn=random.host.test,cn=computers,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com'.
98
</pre>
99
100
As a later step, classes can be assigned to hosts in IPA that associate it with hostgroups (not to be confused with Foreman host groups).
101
102
The attribute is called "userClass" in IPA LDAP, it is available by default with host entries under "--class" option. This is how it works:
103
104
1. We create a hostgroups to demonstrate how the automatic assignment of hosts to host groups works
105
106
<pre>
107
# ipa hostgroup-add webservers
108
Description: web servers
109
----------------------------
110
Added hostgroup "webservers"
111
----------------------------
112
  Host-group: webservers
113
  Description: web servers
114
</pre>
115
116
2. Create an automember rule for this hostgroup
117
118
<pre>
119
# ipa automember-add --type=hostgroup webservers
120
----------------------------------
121
Added automember rule "webservers"
122
----------------------------------
123
  Automember Rule: webservers
124
</pre>
125
126
3. The automember condition is hooked to the host's userclass attribute
127
128
<pre>
129
# ipa automember-add-condition --key=userclass --type=hostgroup
130
--inclusive-regex=^webserver webservers
131
----------------------------------
132
Added condition(s) to "webservers"
133
----------------------------------
134
  Automember Rule: webservers
135
  Inclusive Regex: userclass=^webserver
136
----------------------------
137
Number of conditions added 1
138
----------------------------
139
</pre>
140
141
Steps 1, 2 and 3 need to be done just once when the IPA is being configured.
142
143
4. Now this is the best part. When Foreman proxy adds a host, it can specify
144
the host class which will automatically triggers
145
146
<pre>
147
# ipa host-add web.example.com --force --class=webserver --class=mailserver
148
----------------------------
149
Added host "web.example.com"
150
----------------------------
151
  Host name: web.example.com
152
  Principal name: host/web.example.com@EXAMPLE.COM
153
  Class: webserver, mailserver                    <<<<<<<<<<
154
  Password: False
155
  Member of host-groups: webservers               <<<<<<<<<<
156
  Indirect Member of netgroup: webservers
157
  Keytab: False
158
  Managed by: web.example.com
159
</pre>
160
161
You can have more these rules in parallel.
162
163
h4. Active Directory
164 1 Dominic Cleal
165
For AD, adcli can be used (available in F18+):
166
* http://fedoraproject.org/wiki/Features/ActiveDirectory
167
* https://fedoraproject.org/wiki/Features/AnacondaRealmIntegration (has an adcli example)
168
169
h3. Foreman support
170
171
foreman_realm should add an orchestration step to create and destroy the host object via the proxy.  The OTP used when creating should be stored.
172
173
h2. Joining hosts
174
175 4 Dominic Cleal
foreman_realm could add a new %post snippet which uses the "realm" command (part of realmd) to join the host to the specified realm.
176 1 Dominic Cleal
* http://www.freedesktop.org/software/realmd/docs/index.html (see joining sections)
177
178
For new anacondas, we could use this instead (maybe a second snippet):
179
* https://fedoraproject.org/wiki/Features/AnacondaRealmIntegration
180
181
For older (EL5/6/F18), it should also support the ipa* client tools as realm is only just getting FreeIPA support:
182
* http://fedoraproject.org/wiki/Features/RealmdFreeIpaSupport
183 3 Dominic Cleal
184
Example: @ipa-client-install --password K8-5rr0U8vL,@