78 lines
4.0 KiB
Markdown
78 lines
4.0 KiB
Markdown
# Centralized Identity Management with FreeIPA
|
|
|
|
[← Back to Main README](../README.md)
|
|
|
|
This section details the deployment of a centralized identity, authentication, and DNS authority server using FreeIPA (LDAP, Kerberos, BIND, and PKI CA) on a dedicated VM, along with the automated enrollment of all existing system VMs as domain clients.
|
|
|
|
---
|
|
|
|
## 1. Architectural Overview & Domain Flow
|
|
|
|
FreeIPA acts as the central domain controller for the shooey.local network realm. It coordinates user accounts, SSH keys, host trust databases, and internal DNS resolution.
|
|
|
|
```mermaid
|
|
graph TD
|
|
subgraph ClientNodes ["Client Node Cluster"]
|
|
Control[ansible-control<br>172.30.1.200]
|
|
Web[web-potfolio<br>172.30.1.201]
|
|
Media[media-stream<br>172.30.1.202]
|
|
end
|
|
|
|
subgraph IdentityServer ["Identity Management"]
|
|
IPA[FreeIPA VM<br>172.30.1.100]
|
|
LDAP[(389 Directory Server<br>LDAP User Database)]
|
|
KDC[Kerberos KDC<br>Ticket Authority]
|
|
DNS[BIND DNS Server<br>Domain Nameservers]
|
|
|
|
IPA --- LDAP
|
|
IPA --- KDC
|
|
IPA --- DNS
|
|
end
|
|
|
|
%% Network relationships
|
|
Control -- DNS Query & Auth --o IPA
|
|
Web -- DNS Query & Auth --o IPA
|
|
Media -- DNS Query & Autho --o IPA
|
|
```
|
|
|
|
---
|
|
|
|
## 2. Infrastructure VM Provisioning (Terraform)
|
|
|
|
To avoid plugin crashes in the legacy dmacvicar/libvirt provider (which fails when attempting to import existing running domains containing NVRAM templates), the new VM was provisioned using the Clean Isolation Workaround:
|
|
|
|
1. Existing running VMs were untracked from the Terraform state using `terraform state rm`.
|
|
2. The terraform/main.tf configuration was modified to target only the new freeipa VM.
|
|
3. The VM was successfully deployed with RHEL 9/10 base image, 4GB of RAM, and 2 vCPUs (necessary to support the LDAP cache and Java-based certificate system of FreeIPA).
|
|
|
|
---
|
|
|
|
## 3. Server Installation & Orchestration
|
|
|
|
The FreeIPA server was deployed using the deploy_ipa.yml playbook, resolving hte minimal RHEL python package dependencies:
|
|
|
|
* **Host FQDN Alignment:** Set the hostname to ipa.shooey.local and appended it to /etc/hosts to satisfy the FreeIPA installer's DNS sanity checks.
|
|
* **Dependency Order:** Installed packages (firewalld, python3-firewall, freeipa-server, and freeipa-server-dns) prior to running firewall tasks to provide the necessary Python API bindings.
|
|
* **Unattended Setup:** Ran ipa-server-install with DNS setup, pointing to forwarders 1.1.1.1 and 8.8.8.8, and using encrypted directory/admin credentials loaded from vault.yml.
|
|
|
|
---
|
|
|
|
## 4. Dynamic Client DNS Redirection (configure_dns.yml)
|
|
|
|
To allow client VMs to locate the identity server, the DNS configurations on running nodes were updated to use 172.30.1.100 as their primary nameserver:
|
|
|
|
* **NetworkManager Automation:** Used `nmcli con mod` to set the DNS for the cloud-init connection profile (cloud-init ens3) and triggered a connection reload (`nmcli con up`).
|
|
* **Idempotency & Linting Enhancements:**
|
|
* *Trailing Newline Bug:* Wrapped the check condition in Jinja 2 | trim to remove hidden trailing newlines output by nmcli, preventing changes from executing repeatedly on every run.
|
|
* *Ansible-Lint Compliance:* Appended `changed_when: true` to the modification commands to satisfy the linter's no-changed-when rule.
|
|
* *Fault Tolerace:* Appended `failed_when: false` to the DNS verification task to prevent playbook execution failures when the ipv4.dns property is initially unset/empty.
|
|
|
|
---
|
|
|
|
# 5. Automated Client Enrollment (enroll_clients.yml)
|
|
|
|
Client nodes were joined to the directory realm using the enroll_clients.yml playbook:
|
|
|
|
* **Package Deployment:** Installs freeipa-client packages.
|
|
* **Host Enrollment:** Invokes `ipa-client-install --unattended` using secure credentials, binding the client UUIDs to the FreeIPA directory.
|
|
* **Automatic Homedir Provisioning:** Passes the --mkhomedir flag to configure PAM (Pluggable Authentication Modules) to automatically create a local home directory (/home/username) on the VM the first time a centralized user logs in. |