URL: https://github.com/freeipa/freeipa/pull/1866 Author: abbra Title: #1866: Allow more flexible services Action: opened

PR body: """ This patchset makes service objects more usable in dynamic environments like Kubernetes. Kubernetes hosts could create service objects that have no corresponding host object in IPA and need to be able to retrieve keytabs for them.

Such keytabs would be used for client authentication against other resources in the same IPA realm. As such, applications running in containers on a Kubernetes host would not need to accept any Kerberos authentication from their users but instead they would use own keytabs to talk to database or file servers (or anything else). Since in Kerberos for client authentication there is no real requirement that a service name has a corresponding host (it just a string with one or more / in it), we can allow to skip a host object check when creating the service.

As result, Web UI needs to be changed to also allow editing a host part of the service name when adding a service. We considered making a more dynamic handling of the UI but that would require a complete re-factor of the entity_select widget to allow dynamic change of the contained input widgets.

A second patch adds services as members of groups. This would allow to add services to groups and, in turn, use groups to grant ability for services to retrieve keytabs of other services. This approach reduces substantially amount of changes needed to support services as first class objects. """

To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1866/head:pr1866 git checkout pr1866