On Thu, 4 Feb 2021 at 11:37, Vít Ondruch <vondruch@redhat.com> wrote:

Dne 04. 02. 21 v 15:52 Aurelien Bompard napsal(a):
> Hey folks!
>
> As you've probably heard before, we're upgrading our authentication system to something that is based on FreeIPA.
> Here's a quick status report on that initiative.


Thx for the update!


>   We're currently in an integration phase, figuring out the smaller details of configuration and infrastructure setup before we switch production.
> - The infra team wants to do a couple things that FreeIPA does not support out of the box, like enforcing 2FA for specific services such as sudo, so we need to think about how we want to do it.
> - Also, using kinit with 2FA tokens proved to be more complex than we'd like it to be.
> - We're trying out a more continuous approach to importing accounts, because a full run takes 3 days and during the migration we'll want to run the import script without having a 3 days downtime.
> - We also have to do some FreeIPA performance tuning, because we have something like 120k accounts and the default configuration is not appropriate for that amount of data, especially when we want to list all groups or worse, all users.


Isn't there a plan to reduce the number of imported accounts? As far as
I remember, there is not more then 1000 active Fedora contributors ...


The issue is that every method that we have come up runs into the same issue we have had with the last forced password change. It was a nightmare from the administrator side with a lot of personal attacks, complaints to management, and verbal abuse about 'made-work' for the people outside that 1000 very active Fedora contributors who found that their account was locked. There are people who log in once a year, there are people who log into the wiki and discourse that fas doesn't see because the openid system masks that, etc etc.

The list of corner cases and the amount of work that N thousand people would have to replicate was large and so it was seen as better to just import them all versus come up with a filter, get told that our filter was wrong, repeat until another 12 months go by
 
--
Stephen J Smoogen.