Ryan,
Thank you for the response.
I've tried "ipa host-add-principal" and, as far as I can tell, it
doesn't have any effect. It sounds like it's exactly what I need, but perhaps I am
not using it properly. In any case, I have found that the following seems to work:
### From my initial post
### These allow user authentication to succeed, without prompting the user for their
password, when SSHing to the secondary hostnames.
### However, host authentication fails in that the user is prompted to accept the host
key. The SSH host keys are not yet associated with the secondary hostnames.
On client-1:
ipa-join -h
client-1-eth1.example.com
On client-2:
ipa-join -h
client-2-eth1.example.com
### Not included in my initial post as I had not yet figured this out
### These allow host authentication to succeed, without prompting the user to accept an
SSH host key, when SSHing to the secondary hostnames.
ipa
client-1-eth1.example.com --sshpubkey="ssh-rsa ..."
--sshpubkey="ecdsa-sha2-nistp256 ..." --sshpubkey="ssh-ed25519 ..."
--updatedns
ipa
client-2-eth1.example.com --sshpubkey="ssh-rsa ..."
--sshpubkey="ecdsa-sha2-nistp256 ..." --sshpubkey="ssh-ed25519 ..."
--updatedns
### Where this leaves me
This is scriptable, and therefore automatable. I can get a given host's SSH host keys
with ssh-keyscan and then use the above CLIs to get them into FreeIPA.
I may very well be wrong, but at this point, I've concluded that FreeIPA does not
provide full support for SSO with multi-homed hosts in the normal enrollment process. It
appears that some level of extra work, as described above, has to be done to get SSO for
multi-homed hosts working.
Thanks again!
Dave
-----Original Message-----
From: Ryan Slominski via FreeIPA-users [mailto:freeipa-users@lists.fedorahosted.org]
Sent: Tuesday, August 07, 2018 11:06 AM
To: freeipa-users(a)lists.fedorahosted.org
Cc: Ryan Slominski
Subject: [Freeipa-users] Re: SSH SSO on Multi-Homed Hosts
Hi Dave,
I might be totally off - but I noticed there is a principal alias option. If you want
each IP to have a separate SSH key this probably won't work, but if all IPs on a box
can share a single set of keys then this might work.
Good luck,
Ryan
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...