Yes, I did assign to a host and restart sssd on that host.
Will try some deeper troubleshooting next week, thanks.
On Fri, Feb 16, 2018 at 1:53 PM, Alexander Bokovoy <abokovoy(a)redhat.com>
wrote:
On pe, 16 helmi 2018, Rob Brown wrote:
> Thanks, that looks like potentially a great solution. (It pays to RTFM!)
> I couldn't get it to work on my first try in my test env, but will keep at
> it.
> The pubkey works fine when attached to the "real" user, so I know the
> keypair is good.
> But if I remove the key from the user, and try moving it to the idview
> override, it doesn't work.
>
You need to assign the view to a host and then you should restart SSSD
on the host. ID View assignments are only taken by hosts on restart.
On Fri, Feb 16, 2018 at 11:01 AM, Alexander Bokovoy <abokovoy(a)redhat.com>
> wrote:
>
> On pe, 16 helmi 2018, Rob Brown via FreeIPA-users wrote:
>>
>> Hi,
>>> We recently moved from an "old school" setup where we would push
>>> different
>>> pubkeys for the same user out to specific hosts in different
>>> environments
>>> using configuration management. Likewise, the matching private keys
>>> would
>>> only exist in their requisite environment.
>>> This presents a new problem with freeIPA (which serves both
>>> environments),
>>> in that pubkeys are now attached to the user, and if we put both the
>>> "prod"
>>> and "preprod" pubkeys in the user object, either key will work for
that
>>> user on any server.
>>> I know the "right answer" probably lies in HBAC rules, but trying
to
>>> look
>>> for a simple solution that would restrict which key can be used on which
>>> server. I read about the "fromhost" option, but that is the
opposite of
>>> what I am looking for. I would like to be able to say "this key can
only
>>> be
>>> used to authenticate user foo to xyz host".
>>> Can someone help steer me in the right direction? I'm not seeing it.
>>>
>>> FreeIPA supports ID views which can be assigned to specific hosts or
>> host groups. You can have ID overrides for users in those views that
>> contain
>> specific public SSH keys. These public SSH keys will only be noticed by
>> SSSD running on the hosts that have this ID view assigned.
>>
>> ID Overrides, as their name suggests, override existing attribute
>> values. Thus, a public SSH key K1 assigned to a userA globally and
>> overridden in an ID Override in an ID view viewB by a public SSH key K2
>> would not be visible on the hosts where viewB is applied. Instead, these
>> hosts will only see K2.
>>
>> This may be your solution.
>>
>>
https://access.redhat.com/documentation/en-us/red_hat_enterp
>> rise_linux/7/html/linux_domain_identity_authentication_and_
>> policy_guide/id-views
>>
>> --
>> / Alexander Bokovoy
>>
>>
--
/ Alexander Bokovoy