- So now that we have set up the IPA server,
which really is an LDAP server,
we can talk about LDAP authentication.
Little bit of background,
authentication requests are handled
by Pluggable Authentication Modules, or PAM.
We've talked about PAM earlier in this course.
For authentication, PAM uses PAM underscore triple s dot so,
which is the library that forwards authentication requests
to the triple s d service.
And the triple s d service finds its configuration
in etc triple s d dot conf
and the related drop-in configuration files
that's specified by which service authentication
should be further handled.
Now, apart from the triple s d configuration,
which is purely about authentication,
there's also some open LDAP tools.
These tools are generic and these are tools
like LDAP search and LDAP add.
And that is the direct straight communication
to the LDAP server.
Now a command like LDAP search
works even without authentication.
That is because users need to be able to request resources
from the LDAP server.
So if you want to test that,
use LDAP search minus x minus H,
followed by the LDAP URL.
That will be the name or IP address
of your IPA server,
followed by minus b for the base context,
dc is example, dc is local.
That is the domain where the resources
are going to be searched for.
And minus s sub object class star
is going to print all objects that are not protected
with role-based access control.
And normally that should print all the users on your system.
Now as mentioned, FreeIPA, apart from the LDAP utilities,
comes with the IPA tool
and that provides an easy-to-use interface.
Now in the LDAP client's configuration, there's a couple
of things that play a role.
So after installing the FreeIPA server,
an LDAP client has been configured as well on that server
and that is ready to use.
And this LDAP client allows you to fetch information
from the IPA server.
And by default, the LDAP client is good for testing.
For more secure usage, certificates should be configured.
To get an idea of what's going on,
check the client configuration
in etc triple s d triple s d dot conf
and notice that there is also
the etc open LDAP dot conf, which file is not used
by triple s d, but by plain LDAP utilities
like LDAP search to set default values.
Let me demonstrate these.
Okay, so from any server where you
have the LDAP utilities, you can use LDAP search.
With the appropriate parameters.
And there we go.
So what is this?
Well, this is printing the LDAP information
for the resources that were found.
And as you can see, search result.
Search two.
Why search two?
Well probably because we have two users, right?
Here is LDAP user one,
who is a member of a group, and here is LDAP user two.
Now, this is not so very exciting,
what is more exciting is the actual login procedure.
Now, in order to do that, you need to set up an IPA client.
Setting up an IPA client,
it's a little bit beyond the scope
of what we are doing here,
because in order to do it right,
you need to take care of secure LDAP,
of TLS certificates,
of Kerberos, and much more.
And that is why I'm going to show you
the IPA client configuration on the IPA server.
Fortunately, the IPA server is also a client of itself.
Here we can see what it's all about.
So, we have domain set to example dot local,
where the ID provider is set to IPA,
telling the client that it should use IPA.
Where we can find the name of the IPA server
and where we can also find the CA certificate.
That's a certificate that's required to connect
to this server.
Now if you want to test if this is working,
just use su minus LDAP user 1.
And what do we see?
We see "warning cannot change directly
to home LDAP user 1."
That's okay.
The fact that I see LDAP user 1 or my prompt right now,
means that I successfully authenticated through IPA.
I do want to give you a little bit of insight
about what is going on in the background.
That's an etc PAM dot d,
where we have this system dash auth.
And in this system dash auth,
the lines that matter is this line:
auth sufficient PAM unix dot so.
That means that it's first going to check
if you have a local user account.
If you can log in with the local user account, that's okay.
If you can't,
it will move forward
and it'll check PAM underscore triple s dot so.
And that is a connection that is made to triple s d,
and this is what makes sure that LDAP
authentication through triple s d is working.