Title: #1866: Allow more flexible services
This patchset makes service objects more usable in dynamic environments like Kubernetes.
Kubernetes hosts could create service objects that have no corresponding host object in
IPA and need to be able to retrieve keytabs for them.
Such keytabs would be used for client authentication against other resources in the same
IPA realm. As such, applications running in containers on a Kubernetes host would not need
to accept any Kerberos authentication from their users but instead they would use own
keytabs to talk to database or file servers (or anything else). Since in Kerberos for
client authentication there is no real requirement that a service name has a corresponding
host (it just a string with one or more / in it), we can allow to skip a host object check
when creating the service.
As result, Web UI needs to be changed to also allow editing a host part of the service
name when adding a service. We considered making a more dynamic handling of the UI but
that would require a complete re-factor of the entity_select widget to allow dynamic
change of the contained input widgets.
A second patch adds services as members of groups. This would allow to add services to
groups and, in turn, use groups to grant ability for services to retrieve keytabs of
other services. This approach reduces substantially amount of changes needed to support
services as first class objects.
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1866/head:pr1866
git checkout pr1866