Yes, I did assign to a host and restart sssd on that host.
Will try some deeper troubleshooting next week, thanks.
On Fri, Feb 16, 2018 at 1:53 PM, Alexander Bokovoy <abokovoy(a)redhat.com>
On pe, 16 helmi 2018, Rob Brown wrote:
> Thanks, that looks like potentially a great solution. (It pays to RTFM!)
> I couldn't get it to work on my first try in my test env, but will keep at
> The pubkey works fine when attached to the "real" user, so I know the
> keypair is good.
> But if I remove the key from the user, and try moving it to the idview
> override, it doesn't work.
You need to assign the view to a host and then you should restart SSSD
on the host. ID View assignments are only taken by hosts on restart.
On Fri, Feb 16, 2018 at 11:01 AM, Alexander Bokovoy <abokovoy(a)redhat.com>
> On pe, 16 helmi 2018, Rob Brown via FreeIPA-users wrote:
>>> We recently moved from an "old school" setup where we would push
>>> pubkeys for the same user out to specific hosts in different
>>> using configuration management. Likewise, the matching private keys
>>> only exist in their requisite environment.
>>> This presents a new problem with freeIPA (which serves both
>>> in that pubkeys are now attached to the user, and if we put both the
>>> and "preprod" pubkeys in the user object, either key will work for
>>> user on any server.
>>> I know the "right answer" probably lies in HBAC rules, but trying
>>> for a simple solution that would restrict which key can be used on which
>>> server. I read about the "fromhost" option, but that is the
>>> what I am looking for. I would like to be able to say "this key can
>>> used to authenticate user foo to xyz host".
>>> Can someone help steer me in the right direction? I'm not seeing it.
>>> FreeIPA supports ID views which can be assigned to specific hosts or
>> host groups. You can have ID overrides for users in those views that
>> specific public SSH keys. These public SSH keys will only be noticed by
>> SSSD running on the hosts that have this ID view assigned.
>> ID Overrides, as their name suggests, override existing attribute
>> values. Thus, a public SSH key K1 assigned to a userA globally and
>> overridden in an ID Override in an ID view viewB by a public SSH key K2
>> would not be visible on the hosts where viewB is applied. Instead, these
>> hosts will only see K2.
>> This may be your solution.
>> / Alexander Bokovoy
/ Alexander Bokovoy