freeipa

#8357 Allow managing IPA resources as a user from a trusted Active Directory forest
Closed: fixed by rcritten. Opened by abbra.

Closed: fixed
Reopen Issue

Allow users from trusted Active Directory forests to manage FreeIPA resources if they are part of appropriate roles in FreeIPA. For example, adding an Active Directory user as a member of ‘admins’ group would make it equivalent to built-in FreeIPA ‘admin’ user.

  • As an Administrator in AD I want to also be able to fully administer FreeIPA as if I am an FreeIPA admin so that I do not have to have two different accounts and passwords.

  • As an AD user I want to be able to use self service features of FreeIPA Web UI for example to upload my SSH keys or change other related to me data that is managed in FreeIPA on my behalf.

  • As an AD user or Admin I want to be able to access FreeIPA Web UI with SSO if I have a valid kerberos ticket

  • As an AD user or Admin I want to be able to access FreeIPA Web UI and be prompted for user name and password

  • As an AD user who is assigned appropriate privileges in FreeIPA, I’d like to be able enroll FreeIPA hosts.

  • As an AD user who is assigned appropriate privileges in FreeIPA, I’d like to be able to promote FreeIPA hosts to replicas.

Metadata Update from @abbra:
- Issue assigned to abbra

PR: https://github.com/freeipa/freeipa/pull/4728

Design document: https://github.com/abbra/freeipa/blob/merge-adusers-webui/doc/designs/adtrust/admin-ipa-as-trusted-user.md

master:

  • 676774d3fb8a0921afd678d5b0bbe30bcb082420 kdb: handle enterprise principal lookup in AS_REQ
  • 28389fe8af3fb2f36e18864668fb167aa8daca99 Add design page for managing IPA resources as a user from a trusted Active Directory forest
  • ecc0a96d161717960058e22eecad43754de06f11 support using trust-related operations in the server console
  • 973e0c04e460c99f601b0292ff9c64dd0882432e idviews: handle unqualified ID override lookups from Web UI
  • bee4204039dac9cd858e823b839183ba2cdbd216 Support adding user ID overrides as group and role members
  • 306304bb7fb35c88d987e8460aacad6cad0ae888 tests: account for ID overrides as members of groups and roles
  • 0ba64b1ac3fa1709c09b30754138946ddc9c2839 Web UI: allow users from trusted Active Directory forest manage IPA
  • 9248d23ae8e8573b6877851c1d1b31878a7bd1d4 ipatests: test that adding Active Directory user to a role makes it an administrator

ipa-4-8:

  • 6abade3f8daed8dfa024936114209d19319c4f12 kdb: handle enterprise principal lookup in AS_REQ
  • afe9191f99e034bcf52475b57996d81609de6837 support using trust-related operations in the server console
  • 2ffb4fd18fceb509773951ce4f02aa0c5e2f851a idviews: handle unqualified ID override lookups from Web UI
  • 8cce2bb31ab96f6ce6edba95f54575576f2b1a40 Support adding user ID overrides as group and role members
  • 5e8df37e4cca155bf58aa4e61b9fa3f28eddd526 tests: account for ID overrides as members of groups and roles
  • 99e613e478f7925d0f470a04d4de5a2f93385b7a Web UI: allow users from trusted Active Directory forest manage IPA
  • 6b0f8f3617378da41ead8640e194e5b9415a38b1 ipatests: test that adding Active Directory user to a role makes it an administrator

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to A 3rd-party plugin to provide management of IPA resources as users from trusted Active Directory domains was merged into FreeIPA core. ID user overrides can now be added to IPA management groups and roles and thus allow AD users to manage IPA.
Metadata
None
None
None
None
A 3rd-party plugin to provide management of IPA resources as users from trusted Active Directory domains was merged into FreeIPA core. ID user overrides can now be added to IPA management groups and roles and thus allow AD users to manage IPA.
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.