Red Hat Security: Identity Management and Authentication

Instructions

1. On the idm machine, stop and start the IdM service.

   1. Log in to the idm machine as the student user, and then switch to the root user.

      [student@workstation ~]$ ssh idm
      [student@idm ~]$ sudo -i
      [sudo] password for student: student

   2. Review the /usr/lib/systemd/system/ipa.service systemd unit.

      [Unit]
      Description=Identity, Policy, Audit
      Wants=network.target
      Wants=gssproxy.service
      After=network.target
      
      [Service]
      Type=oneshot
      Environment=LC_ALL=C.UTF-8
      ExecStart=/usr/sbin/ipactl start
      ExecStop=/usr/sbin/ipactl stop
      RemainAfterExit=yes
      TimeoutSec=0
      
      [Install]
      WantedBy=multi-user.target

   3. Stop the ipa service.

      [root@idm ~]# systemctl stop ipa.service

   4. Verify the status of the IdM services.

      [root@idm ~]# ipactl status
      Directory Service: STOPPED
      Directory Service must be running in order to obtain status of other services

   5. Start the ipa service.

      [root@idm ~]# systemctl start ipa.service

   6. Verify the status of the IdM services.

      [root@idm ~]# ipactl status
      Directory Service: RUNNING
      krb5kdc Service: RUNNING
      kadmin Service: RUNNING
      httpd Service: RUNNING
      ipa-custodia Service: RUNNING
      pki-tomcatd Service: RUNNING
      ipa-otpd Service: RUNNING
      ipa: INFO: The ipactl command was successful

2. List available topics on the ipa command. Determine and then use the appropriate commands to list all current IdM users. View variables related to the configuration of the IdM server.

   Note

   The lab command has already negotiated a Kerberos ticket as the admin user on the idm machine. Kerberos authentication is discussed in a later chapter.

   1. List the available topics, and then get help for managing users.

      [root@idm ~]# ipa help topics
      automember         Auto Membership Rule.
      automount          Automount
      ca                 Manage Certificate Authorities
      caacl              Manage CA ACL rules.
      cert               IPA certificate operations
      certmap            Certificate Identity Mapping
      certprofile        Manage Certificate Profiles
      config             Server configuration
      delegation         Group to Group Delegation
      dns                Domain Name System (DNS)
      domainlevel        Raise the IPA Domain Level.
      ...output omitted...
      [root@idm ~]# ipa help user
      ...output omitted...
      EXAMPLES:
      
       Add a new user:
         ipa user-add --first=Tim --last=User --password tuser1
      
       Find all users whose entries include the string "Tim":
         ipa user-find Tim
      
       Find all users with "Tim" as the first name:
         ipa user-find --first=Tim
      
       Disable a user account:
         ipa user-disable tuser1
      ...output omitted...

   2. List all IdM users.

      [root@idm ~]# ipa user-find
      --------------
      1 user matched
      --------------
        User login: admin
        Last name: Administrator
        Home directory: /home/admin
        Login shell: /bin/bash
        Principal alias: admin@LAB.EXAMPLE.COM, root@LAB.EXAMPLE.COM
        UID: 1138600000
        GID: 1138600000
        Account disabled: False
      ----------------------------
      Number of entries returned 1
      ----------------------------

   3. View variables related to the configuration of the IdM server.

      [root@idm ~]# ipa env
        api_version: 2.249
        basedn: dc=internal,dc=lab,dc=example,dc=com
        bin: /usr/bin
        ca_agent_port: 443
        ca_host: idm.lab.example.com
        ca_install_port: None
        ca_port: 80
        certmonger_wait_timeout: 300
        conf: /etc/ipa/cli.conf
        conf_default: /etc/ipa/default.conf
        confdir: /etc/ipa
        config_loaded: True
      ...output omitted...
        tls_ca_cert: /etc/ipa/ca.crt
        tls_version_max: None
        tls_version_min: None
        validate_api: False
        verbose: 0
        version: 4.10.0
        wait_for_dns: 0
        webui_prod: True
        xmlrpc_uri: https://idm.lab.example.com/ipa/xml
      -------------
      120 variables
      -------------

      Reviewing these variables can be useful during troubleshooting.

3. Use a web browser to explore the IdM API.

   1. On the workstation machine, open a web browser and navigate to https://idm.lab.example.com/.

   2. The browser displays a certificate warning because IdM uses a self-signed certificate. Click Advanced, and then click Add Exception. Click Confirm Security Exception to accept the self-signed certificate. Click Advanced on the warning page, and then click Accept the Risk and Continue.

   3. Log in as the admin user with RedHat123^ as the password.

   4. Navigate to IPA Server → API Browser. In the Browse field, type ^group_ and then select group_show. Note the headings for options and arguments, and that the cn argument is required.

4. Switch back to the SSH session, and review the API interactions of the ipa command.

   1. Use the ipa command to show the details of the admins group. Use the -vv option to show the JSON payload and response.

      [root@idm ~]# ipa -vv group-show admins
      ipa: INFO: Request: {
          "id": 0,
          "method": "ping",
          "params": [
              [],
              {}
          ]
      }
      ipa: INFO: Response: {
          "error": null,
          "id": 0,
          "principal": "admin@LAB.EXAMPLE.COM",
          "result": {
              "messages": [
                  {
                      "code": 13001,
                      "data": {
                          "server_version": "2.249"
                      },
                      "message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.249",
                      "name": "VersionMissing",
                      "type": "warning"
                  }
              ],
              "summary": "IPA server version 4.10.0. API version 2.249"
          },
          "version": "4.10.0"
      }
      ipa: INFO: Request: {
          "id": 0,
          "method": "group_show/1",
          "params": [
              [
                  "admins"
              ],
              {
                  "version": "2.249"
              }
          ]
      }
      ipa: INFO: Response: {
          "error": null,
          "id": 0,
          "principal": "admin@LAB.EXAMPLE.COM",
          "result": {
              "result": {
                  "cn": [
                      "admins"
                  ],
                  "description": [
                      "Account administrators group"
                  ],
                  "dn": "cn=admins,cn=groups,cn=accounts,dc=lab,dc=example,dc=com",
                  "gidnumber": [
                      "1138600000"
                  ],
                  "member_user": [
                      "admin"
                  ]
              },
              "summary": null,
              "value": "admins"
          },
          "version": "4.10.0"
      }
        Group name: admins
        Description: Account administrators group
        GID: 1138600000
        Member users: admin

   2. Return to the workstation machine as the student user.

      [root@idm ~]# exit
      logout
      [student@idm ~]$ exit
      logout
      Connection to idm closed.