They are coming from Puppet

 

In the IdM access log - I see a block of stuff starting with "connection from <Puppet's IP> to <IdM's IP>

 

I used cn, mail, displayName, group, member

I did not set the user/group relative DN as it was marked (optional)

 

______________________________________________________________________________________________

 

Daniel E. White
daniel.e.white@nasa.gov

NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771

Office: (301) 286-6919

Mobile: (240) 513-5290

 

From: Rob Crittenden <rcritten@redhat.com>
Date: Friday, March 13, 2020 at 10:43
To: FreeIPA <freeipa-users@lists.fedorahosted.org>
Cc: Louis Abel <tucklesepk@gmail.com>, Daniel White <daniel.e.white@nasa.gov>
Subject: Re: [Freeipa-users] Re: [EXTERNAL] Re: Add "Puppet Enterprise" to the list of things that do not actively support FreeIPA

 

White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote:

Thanks for responding, Louis.

 

Sadly, I did all that and got a bunch of queries looking for objectClass

ipaNTTrustedDomain and other ipaNT* objectClasses

I have opened a feature request with Puppet for FreeIPA support.

https://urldefense.proofpoint.com/v2/url?u=https-3A__tickets.puppetlabs.com_browse_ENTERPRISE-2D1323&d=DwIFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=ef_FKlWa7jWGmQqTrjkcoDY1VuVtcI_10ClISjA3_V8&m=6aA6RTr2nDntrPquJttGyGHNsiIdSYLUvV7DY2GoEqE&s=6NN1_StAf6O0b97W40W-dJ_DeSwcFNek0RPYFi0ij8Y&e=

 

Note that these queries are IPA objectclasses related to trusts.

 

Are you sure these are originating from puppet?

 

rob

 

*______________________________________________________________________________________________*

*From: *FreeIPA <freeipa-users@lists.fedorahosted.org>

*Reply-To: *FreeIPA <freeipa-users@lists.fedorahosted.org>

*Date: *Thursday, March 12, 2020 at 23:13

*To: *FreeIPA <freeipa-users@lists.fedorahosted.org>

*Cc: *Louis Abel <tucklesepk@gmail.com>

*Subject: *[EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the

list of things that do not actively support FreeIPA

 

Based on what I'm reading here:

https://urldefense.proofpoint.com/v2/url?u=https-3A__puppet.com_docs_pe_2019.0_rbac-5Fldap-5Fintro.html&d=DwIFaQ&c=ApwzowJNAKKw3xye91w7BE1XMRKi2LN9kiMk5Csz9Zk&r=ef_FKlWa7jWGmQqTrjkcoDY1VuVtcI_10ClISjA3_V8&m=6aA6RTr2nDntrPquJttGyGHNsiIdSYLUvV7DY2GoEqE&s=V-xPhXW2K6LDh7TYUhlaA_3m_GNBIKifAF4cSgMqqFQ&e=

 

Assuming puppet enterprise lets you change settings, you would need to

make these changes:

 

* User login attribute from "cn" to "uid"

 

* User relative distinguished name to: cn=users,cn=accounts

 

* group object class from "groupOfUniqueNames" to "groupOfNames"

 

* group membership field from "uniqueMember" to "member"

 

* group relative distinguished name to "cn=groups,cn=accounts"

 

And again, that is assuming it lets you change those. You may need to

ask puppet's support for help on those things.