On ma, 09 maalis 2020, joost albers via FreeIPA-users wrote:
I am not sure if what I am expecting is supposed to work the way i
envision it.
We have freeipa 4.6.5 and MS ad 2016.
All works well for system logins ,
ad users can ssh to hosts enrolled to freeipa/
we also have a few web ui;s zabbix, custom app, that currently
authenticate Freeipa users using ldap only. I was under the impression
that Freeipa could determine the user is not an ipa user but an ad user
based on the supplied domain and them perform the authentication
against the AD.
For this i would then need to change the bind and base dn on the
respective applications. the question is.
in an ipa-ad trust relationship, can we still use the basic ldap
authentication for both internal (ipa) and external (ad) users? What
base, bind DN do we need to set to enable this?
No. In trust to Active Directory you need to use SSSD as a backend for
your authentication. For most applications this means consuming it via
PAM interface.
In general, I'd suggest you to move those apps to use an IdP (OpenID
Connect, SAML, OAuth, etc) and consolidate authentication to IdP <->
SSSD communication. This is definitely works for Keycloak and Ipsilon,
for example.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland