FreeIPA & OpenLDAP Cheatsheet

Cheatsheet#ldap-freeipa

FreeIPA & OpenLDAP Cheatsheet

LDAP (Lightweight Directory Access Protocol) is the standard protocol for centralized identity management and authentication. FreeIPA combines OpenLDAP/389 Directory Server, MIT Kerberos, SSSD, and DNS into an integrated enterprise identity solution for Linux/UNIX networks.

FreeIPA Authentication (Kerberos)

Before executing any ipa administrative commands, obtain a valid Kerberos ticket.

# Obtain admin Kerberos ticket
kinit admin
 
# View current active Kerberos tickets
klist
 
# Destroy current tickets (Logout)
kdestroy

FreeIPA User Management

# List all registered users
ipa user-find
 
# Find user by substring search
ipa user-find --first="John"
 
# Display detailed user information
ipa user-show jdoe
 
# Add a new user with interactive password prompt
ipa user-add jdoe --first="John" --last="Doe" --password
 
# Modify user attributes (e.g. set login shell, email, title)
ipa user-mod jdoe --shell=/bin/zsh [email protected] --title="DevOps Engineer"
 
# Reset user password
ipa passwd jdoe
 
# Disable (lock) a user account
ipa user-disable jdoe
 
# Enable (unlock) a user account
ipa user-enable jdoe
 
# Delete a user
ipa user-del jdoe

FreeIPA Group Management

# List all user groups
ipa group-find
 
# Create a new user group
ipa group-add developers --desc="Development Team"
 
# Add member user to a group
ipa group-add-member developers --users=jdoe
 
# Add multiple users to a group
ipa group-add-member developers --users=jdoe,asmith,bwayne
 
# Remove member user from a group
ipa group-remove-member developers --users=jdoe
 
# Show group details and members
ipa group-show developers

FreeIPA Host & Hostgroup Management

# List enrolled hosts
ipa host-find
 
# Register a new host entry
ipa host-add server01.example.com --ip-address=192.168.1.100
 
# Remove a host from FreeIPA
ipa host-del server01.example.com
 
# Create a hostgroup
ipa hostgroup-add webservers --desc="Production Web Servers"
 
# Add host to a hostgroup
ipa hostgroup-add-member webservers --hosts=server01.example.com

FreeIPA Host-Based Access Control (HBAC)

HBAC rules define which users or groups can access specific host machines or services (e.g. sshd, sudo).

# List all HBAC rules
ipa hbacrule-find
 
# Add a new HBAC rule
ipa hbacrule-add allow_dev_ssh --desc="Allow developers SSH access to dev servers"
 
# Attach user group to rule
ipa hbacrule-add-user allow_dev_ssh --groups=developers
 
# Attach hostgroup to rule
ipa hbacrule-add-host allow_dev_ssh --hostgroups=dev_servers
 
# Attach service (e.g. sshd) to rule
ipa hbacrule-add-service allow_dev_ssh --hbacsvcs=sshd
 
# Test HBAC rule access for a user on a host
ipa hbac-test --user=jdoe --host=server01.example.com --service=sshd

OpenLDAP CLI Utilities (`ldapsearch`, `ldapmodify`, `ldapadd`)

Standard OpenLDAP commands used for querying and modifying any LDAP compliant directory (OpenLDAP, 389 DS, Active Directory).

`ldapsearch` (Querying Directory Data)

# Search base DN anonymously
ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com"
 
# Authenticated (bound) search
ldapsearch -x -H ldaps://ldap.example.com:636 \
  -D "cn=admin,dc=example,dc=com" -W \
  -b "ou=users,dc=example,dc=com" "(objectClass=person)"
 
# Search specific user by UID and display uid, mail, and cn attributes
ldapsearch -x -H ldap://127.0.0.1 -b "dc=example,dc=com" \
  "(uid=jdoe)" uid mail cn
 
# Filter using boolean AND / OR / NOT
ldapsearch -x -b "dc=example,dc=com" "(&(objectClass=user)(mail=*@example.com))"

`ldapadd` & `ldapmodify` (Using LDIF Files)

Create an LDIF file new_user.ldif:

dn: uid=jdoe,ou=users,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: jdoe
cn: John Doe
sn: Doe
mail: [email protected]
userPassword: {SSHA}secretpasswordhash

Add the entry:

ldapadd -x -H ldaps://ldap.example.com -D "cn=admin,dc=example,dc=com" -W -f new_user.ldif

Modify an existing entry modify_user.ldif:

dn: uid=jdoe,ou=users,dc=example,dc=com
changetype: modify
replace: mail
mail: [email protected]

Apply modification:

ldapmodify -x -H ldaps://ldap.example.com -D "cn=admin,dc=example,dc=com" -W -f modify_user.ldif

LDAP / SSSD Client Status & Debugging

# Test SSSD service status on client machine
sudo systemctl status sssd
 
# Clear SSSD cache (force re-fetch of LDAP/FreeIPA users and groups)
sudo sss_cache -E
 
# Check user identity resolution via SSSD
id jdoe
getent passwd jdoe
getent group developers

Cheatsheets