Okay, Thank you Alex,

I will give it a shot.

Best
Maciej

On Thu, Feb 22, 2018 at 5:07 PM, Alexander Bokovoy <abokovoy@redhat.com> wrote:
On to, 22 helmi 2018, Maciej Drobniuch via FreeIPA-users wrote:
So, It looks like tokens are working on LDAP too.

Is there any way to disable 2FA on LDAP?
2FA policy applies to both Kerberos and LDAP authentication. If you
enable password-only logon in addition to 2FA, users will be able to use
both password-only and 2FA-enhanced logons.

There is no way to differ in that policy between Kerberos and LDAP auth.

I suggest you to connect gitlab via OpenID Connect -- using either
Ipsilon or Keycloak Identity Providers. Both have integration with
FreeIPA and will supply required details to OmniAuth connector (use
https://github.com/m0n9oose/omniauth_openid_connect). In both cases SSSD
would be used to perform actual authentication and data retrieval behind
the scenes, so HBAC rules can be used to control who can login and both
Kerberos and direct password/2FA would be accepted.


On Thu, Feb 22, 2018 at 3:52 PM, Maciej Drobniuch <md@collective-sense.com>
wrote:

Hey All,

I want to authenticate with an external app to ldap ipa.

So I've created a user for the bind:
dn: uid=sysaccount,cn=sysaccounts,cn=etc,dc=example,dc=com
changetype: add
objectclass: account
objectclass: simplesecurityobject
uid: system
userPassword: somepass123
passwordExpirationTime: 20380119031407Z
nsIdleTimeout: 0

The external app runs the LDAP check successfully and can see the users
that belong to the group that's allowed to login.

Problem:
I can not login with the default "admin" account but I can not login with
any other account that's in the dn into the app.
Response is: "Invalid credentials"

base: 'cn=users,cn=accounts,dc=example,dc=com'
user_filter: '(memberOf=cn=gitlab-users,cn=groups,cn=accounts,dc=example,
dc=com)'

Any ideas?

Thank You!

--
Best regards

Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC




--
Best regards

Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC

_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org


--
/ Alexander Bokovoy



--
Best regards

Maciej Drobniuch
Network Security Engineer
Collective-Sense,LLC