They are coming from Puppet
In the IdM access log - I see a block of stuff starting with "connection from
<Puppet's IP> to <IdM's IP>
I used cn, mail, displayName, group, member
I did not set the user/group relative DN as it was marked (optional)
______________________________________________________________________________________________
Daniel E. White
daniel.e.white@nasa.gov<mailto:daniel.e.white@nasa.gov>
NICS Linux Engineer
NASA Goddard Space Flight Center
8800 Greenbelt Road
Building 14, Room E175
Greenbelt, MD 20771
Office: (301) 286-6919
Mobile: (240) 513-5290
From: Rob Crittenden <rcritten(a)redhat.com>
Date: Friday, March 13, 2020 at 10:43
To: FreeIPA <freeipa-users(a)lists.fedorahosted.org>
Cc: Louis Abel <tucklesepk(a)gmail.com>, Daniel White
<daniel.e.white(a)nasa.gov>
Subject: Re: [Freeipa-users] Re: [EXTERNAL] Re: Add "Puppet Enterprise" to the
list of things that do not actively support FreeIPA
White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote:
Thanks for responding, Louis.
Sadly, I did all that and got a bunch of queries looking for objectClass
ipaNTTrustedDomain and other ipaNT* objectClasses
I have opened a feature request with Puppet for FreeIPA support.
https://urldefense.proofpoint.com/v2/url?u=https-3A__tickets.puppetlabs.c...
Note that these queries are IPA objectclasses related to trusts.
Are you sure these are originating from puppet?
rob
*______________________________________________________________________________________________*
*From: *FreeIPA
<freeipa-users@lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>>
*Reply-To: *FreeIPA
<freeipa-users@lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>>
*Date: *Thursday, March 12, 2020 at 23:13
*To: *FreeIPA
<freeipa-users@lists.fedorahosted.org<mailto:freeipa-users@lists.fedorahosted.org>>
*Cc: *Louis Abel <tucklesepk@gmail.com<mailto:tucklesepk@gmail.com>>
*Subject: *[EXTERNAL] [Freeipa-users] Re: Add "Puppet Enterprise" to the
list of things that do not actively support FreeIPA
Based on what I'm reading here:
https://urldefense.proofpoint.com/v2/url?u=https-3A__puppet.com_docs_pe_2...
Assuming puppet enterprise lets you change settings, you would need to
make these changes:
* User login attribute from "cn" to "uid"
* User relative distinguished name to: cn=users,cn=accounts
* group object class from "groupOfUniqueNames" to "groupOfNames"
* group membership field from "uniqueMember" to "member"
* group relative distinguished name to "cn=groups,cn=accounts"
And again, that is assuming it lets you change those. You may need to
ask puppet's support for help on those things.