Skip to content

Commit

Permalink
Merge pull request #1344 from wdpypere/ncm-freeipa
Browse files Browse the repository at this point in the history
ncm-freeipa: docs - fix code blocks and correct method title
  • Loading branch information
stdweird committed Nov 5, 2018
2 parents 3901280 + 04f96eb commit ac3020a
Showing 1 changed file with 12 additions and 10 deletions.
22 changes: 12 additions & 10 deletions ncm-freeipa/src/main/perl/freeipa.pm
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ ncm-freeipa provides support for FreeIPA configuration for
=head2 Server
On the server, create a keytab for the quattor-server user
On the server, create a keytab for the quattor-server user:
kinit admin
uidadmin=`ipa user-show admin |grep UID: |sed "s/UID://;s/ //g;"`
Expand All @@ -38,26 +39,25 @@ On the server, create a keytab for the quattor-server user
done
ipa role-add-member --users=quattor-server "Quattor server"
# use -r option to retrieve existing keytab (e.g. from another ipa server)
ipa-getkeytab -p quattor-server -k /etc/quattor-server.keytab -s ipaserver.example.com
Use these with ncm-freeipa on the server.
Use these with ncm-freeipa on the server:
prefix "/software/components/freeipa/principals/server";
"principal" = "quattor-server";
"keytab" = "/etc/quattor-server.keytab";
(Do not retrieve a keytab for the admin user;
it resets the admin password).
(Do not retrieve a keytab for the admin user, it resets the admin password).
=head2 AII
The AII hooks act on behalf of the host it is going to setup, so
any of those principals cannot be used. Instead we use a fixed
AII principal and keytab.
First we need to add a user with appropriate privileges
First we need to add a user with appropriate privileges:
kinit admin
uidadmin=`ipa user-show admin |grep UID: |sed "s/UID://;s/ //g;"`
Expand All @@ -74,15 +74,17 @@ First we need to add a user with appropriate privileges
ipa role-add-privilege "Quattor AII" --privileges="Host Administrators"
ipa role-add-member --users=quattor-aii "Quattor AII"
On the AII host (assuming the host is already added to IPA)
On the AII host (assuming the host is already added to IPA):
kinit admin
# use -r option to retrieve existing keytab (e.g. from another AII server)
ipa-getkeytab -p quattor-aii -k /etc/quattor-aii.keytab -s ipaserver.example.com
kdestroy
(If you have granted the host principal the rights to retrieve the quattor-aii keytab,
you can add in the template of the AII host
you can add in the template of the AII host:
prefix "/software/components/freeipa/principals/aii";
"principal" = "quattor-aii";
"keytab" = "/etc/quattor-aii.keytab";
Expand Down Expand Up @@ -432,9 +434,9 @@ sub certificates
return;
}

=head2 server
=head2 client
Configure server settings
Configure client settings
=cut

Expand Down

0 comments on commit ac3020a

Please sign in to comment.