freeipa

#8805 Extend `ipa-otpd` daemon to recognize IdP references
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

ipa-otpd supports two methods at the moment:
- native IPA OTP authentication
- RADIUS proxy authentication

Add new method to perform OAuth 2.0 Device Authorization Grant flow. ipa-otpd would retrieve IdP references associated with the user being authenticated and perform OAuth2 flow to verify that user identity and credentials against a linked IdP.

OAuth2 client side implementation in ipa-otpd would need to reuse existing open source OAuth 2.0 client implementations rather than writing OAuth 2.0 flow implementation.

Possible candidate C libraries to use for OAuth2 communication need to be investigated. One possible candidate is liboauth2 project, another one is iddawc. A sub-task would be to package OAuth2 library and its dependencies in the distributions (COPR for PoC).

Integration between ipa-otpd and OAuth 2.0 provider can be tested independently of the rest of MIT Kerberos-related work. A Python library to implement a test RADIUS client/server is pyrad.

master:

  • 79a4073730a8fe5ba2424f3896a2fd440c17ac9e docs: tune RTD to display lists with disc and left margin
  • 0484949b80d477ad858274b799ea1f48f2eec20a doc/designs: add External IdP support design documents
  • fd19bdfd54e674361b9dadd3792780406c8d82d6 external-idp: add LDAP schema, indices and other LDAP objects
  • 10e18c3dc732a52d173e803970f6eb53dd9b6087 external-idp: add support to manage external IdP objects
  • 03a905eed92083b1edea634ce50fcc9dbeb34b5b external-idp: add XMLRPC tests for External IdP objects and idp indicator
  • 3f6656e09a528b3f54281d77a6226231ac1c0f51 ipa-otpd: add support for SSSD OIDC helper
  • a1be4fc86390559e6464fb31b76a4595da9f5465 KDB: support external IdP configuration
  • 94f7d31d2dc725ebcb5a6859d32d602935c1b3b3 External IdP: add Web UI to manage IdP references
  • 429e523de675f86accd8667287cc468c8f9d1872 External IdP: initial SELinux policy
  • 82175da4b1c91516495a4f38a46a08ccfca4cd75 doc/workshop: document use of pam_sss_gss PAM module
  • 543040a71d09710f817b29076cb7aa86d3014a02 freeipa.spec.in: use SSSD 2.7.0 to add IdP pre-auth mechanism
  • b5be7f2948f72b93fc418eb2697fe96efe14a11f workshop: add chapter 12: External IdP support

ipa-4-9:

  • 42afcc95be0292dd0dbdf955dbe0e8e3a683782e workshop: Update docs and support default cloud image
  • 8d81338cb94a2d850f53629ebba98a1f1ec90d1e doc/designs: add External IdP support design documents
  • 1df7b82ac188650775703dc95530017c969d0bff external-idp: add LDAP schema, indices and other LDAP objects
  • 2136bd5d00f7aed5ae722ff8253c2b74ba444972 external-idp: add support to manage external IdP objects
  • b77015b7a3b627282560253cf2cd579c89f02923 external-idp: add XMLRPC tests for External IdP objects and idp indicator
  • bf8e2bb99f1c09ced820bd4bf6e9d7832db2caea ipa-otpd: add support for SSSD OIDC helper
  • 673478b1cf9950aed755a6a9ae8f81cb323932b3 KDB: support external IdP configuration
  • 51a4e42dd777661addd4f2fed1654ee978e8a4d7 External IdP: add Web UI to manage IdP references
  • 660c3dc2491fc2ee01031c1c59db6e0bb025bf93 External IdP: initial SELinux policy
  • d0eab8fe7609fea0b46ea863db1822eca1daac63 doc/workshop: document use of pam_sss_gss PAM module
  • d49aa7103bacba60bae28f32bd76d9d35853626b freeipa.spec.in: use SSSD 2.7.0 to add IdP pre-auth mechanism
  • 5f9e0d3ff3bd80b75bc9f5de97e7e086ba0a31e3 workshop: add chapter 12: External IdP support

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 5ca4e8ee33cb2de7f0e05b91dfe9cc41829609cd pr-ci definitions: add external idp related jobs.
  • 9cc703fd0ed1afc24dc865ed967264c7f7340ac7 ipatests: Add integration tests for External IdP support

ipa-4-9:

  • b979dd91f149fd1f4fc1f48466a26f575eae0ae4 ipatests: Add integration tests for External IdP support
  • b39f9336fa12e7f28ce0a5c51677983bc9b72621 pr-ci definitions: add external idp related jobs.

master:

  • a80a98194837f99c494dbee7e3326acde1ccb8cd ipatests: update prci definitions for test_idp.py
  • bd57ff35660cd1e911db43805fbbea5d26058fbc Add end to end integration tests for external IdP

ipa-4-9:

  • 857713c5a9c8e0b62c06dd92e69c09eeb34b2e99 Add end to end integration tests for external IdP
  • 50b4d9ab3fcb2e63edc8d20346e4a8a79f15692d ipatests: update prci definitions for test_idp.py

master:

  • c6a16a7e537c30a348ea00d657256c0a94171572 docs: add security section to idp

ipa-4-9:

  • 170155b648084846111bf0c65459aba94a8e980d docs: add security section to idp

ipa-4-10:

  • 56d287248039f56c7b6bba3860061cb2b4460337 docs: add security section to idp
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.