Thanks for responding, Louis.

 

Sadly, I did all that and got a bunch of queries looking for objectClass ipaNTTrustedDomain and other ipaNT* objectClasses

I have opened a feature request with Puppet for FreeIPA support.

https://tickets.puppetlabs.com/browse/ENTERPRISE-1323

______________________________________________________________________________________________

 

Daniel E. White
daniel.e.white@nasa.gov

NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771

Office: (301) 286-6919

Mobile: (240) 513-5290

 

From: FreeIPA <freeipa-users@lists.fedorahosted.org>
Reply-To: FreeIPA <freeipa-users@lists.fedorahosted.org>
Date: Thursday, March 12, 2020 at 23:13
To: FreeIPA <freeipa-users@lists.fedorahosted.org>
Cc: Louis Abel <tucklesepk@gmail.com>
Subject: [EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the list of things that do not actively support FreeIPA

 

Based on what I'm reading here: https://puppet.com/docs/pe/2019.0/rbac_ldap_intro.html

 

Assuming puppet enterprise lets you change settings, you would need to make these changes:

 

* User login attribute from "cn" to "uid"

 

* User relative distinguished name to: cn=users,cn=accounts

 

* group object class from "groupOfUniqueNames" to "groupOfNames"

 

* group membership field from "uniqueMember" to "member"

 

* group relative distinguished name to "cn=groups,cn=accounts"

 

And again, that is assuming it lets you change those. You may need to ask puppet's support for help on those things.