Thanks for responding, Louis.
Sadly, I did all that and got a bunch of queries looking for objectClass
ipaNTTrustedDomain and other ipaNT* objectClasses
I have opened a feature request with Puppet for FreeIPA support.
https://tickets.puppetlabs.com/browse/ENTERPRISE-1323
______________________________________________________________________________________________
Daniel E. White
daniel.e.white@nasa.gov<mailto:daniel.e.white@nasa.gov>
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: (301) 286-6919
Mobile: (240) 513-5290
From: FreeIPA <freeipa-users(a)lists.fedorahosted.org>
Reply-To: FreeIPA <freeipa-users(a)lists.fedorahosted.org>
Date: Thursday, March 12, 2020 at 23:13
To: FreeIPA <freeipa-users(a)lists.fedorahosted.org>
Cc: Louis Abel <tucklesepk(a)gmail.com>
Subject: [EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the list of
things that do not actively support FreeIPA
Based on what I'm reading here:
https://puppet.com/docs/pe/2019.0/rbac_ldap_intro.html
Assuming puppet enterprise lets you change settings, you would need to make these
changes:
* User login attribute from "cn" to "uid"
* User relative distinguished name to: cn=users,cn=accounts
* group object class from "groupOfUniqueNames" to "groupOfNames"
* group membership field from "uniqueMember" to "member"
* group relative distinguished name to "cn=groups,cn=accounts"
And again, that is assuming it lets you change those. You may need to ask puppet's
support for help on those things.