freeipa

#8804 Extend supported user authentication methods in IPA to allow IdP auth
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

In order to recognize new authentication method to perform OAuth 2.0 Device Authorization Grant flow, IPA needs to be extended to support the new method:

  • in IPA API, to allow managing the method in ipa user-mod --user-auth-type and similar commands;
  • in IPA KDB driver, to recognize that the user has IdP authentication method and trigger OTP pre-authentication response;
  • in IPA KDB driver, to associate a new authentication indicator with the IdP authentication method.

Provisionally, both the authentication method and the authentication indicator can be called idp. This would allow to distinguish it from the regular RADIUS or OTP authentication indicators.

master:

  • 79a4073730a8fe5ba2424f3896a2fd440c17ac9e docs: tune RTD to display lists with disc and left margin
  • 0484949b80d477ad858274b799ea1f48f2eec20a doc/designs: add External IdP support design documents
  • fd19bdfd54e674361b9dadd3792780406c8d82d6 external-idp: add LDAP schema, indices and other LDAP objects
  • 10e18c3dc732a52d173e803970f6eb53dd9b6087 external-idp: add support to manage external IdP objects
  • 03a905eed92083b1edea634ce50fcc9dbeb34b5b external-idp: add XMLRPC tests for External IdP objects and idp indicator
  • 3f6656e09a528b3f54281d77a6226231ac1c0f51 ipa-otpd: add support for SSSD OIDC helper
  • a1be4fc86390559e6464fb31b76a4595da9f5465 KDB: support external IdP configuration
  • 94f7d31d2dc725ebcb5a6859d32d602935c1b3b3 External IdP: add Web UI to manage IdP references
  • 429e523de675f86accd8667287cc468c8f9d1872 External IdP: initial SELinux policy
  • 82175da4b1c91516495a4f38a46a08ccfca4cd75 doc/workshop: document use of pam_sss_gss PAM module
  • 543040a71d09710f817b29076cb7aa86d3014a02 freeipa.spec.in: use SSSD 2.7.0 to add IdP pre-auth mechanism
  • b5be7f2948f72b93fc418eb2697fe96efe14a11f workshop: add chapter 12: External IdP support

ipa-4-9:

  • 42afcc95be0292dd0dbdf955dbe0e8e3a683782e workshop: Update docs and support default cloud image
  • 8d81338cb94a2d850f53629ebba98a1f1ec90d1e doc/designs: add External IdP support design documents
  • 1df7b82ac188650775703dc95530017c969d0bff external-idp: add LDAP schema, indices and other LDAP objects
  • 2136bd5d00f7aed5ae722ff8253c2b74ba444972 external-idp: add support to manage external IdP objects
  • b77015b7a3b627282560253cf2cd579c89f02923 external-idp: add XMLRPC tests for External IdP objects and idp indicator
  • bf8e2bb99f1c09ced820bd4bf6e9d7832db2caea ipa-otpd: add support for SSSD OIDC helper
  • 673478b1cf9950aed755a6a9ae8f81cb323932b3 KDB: support external IdP configuration
  • 51a4e42dd777661addd4f2fed1654ee978e8a4d7 External IdP: add Web UI to manage IdP references
  • 660c3dc2491fc2ee01031c1c59db6e0bb025bf93 External IdP: initial SELinux policy
  • d0eab8fe7609fea0b46ea863db1822eca1daac63 doc/workshop: document use of pam_sss_gss PAM module
  • d49aa7103bacba60bae28f32bd76d9d35853626b freeipa.spec.in: use SSSD 2.7.0 to add IdP pre-auth mechanism
  • 5f9e0d3ff3bd80b75bc9f5de97e7e086ba0a31e3 workshop: add chapter 12: External IdP support

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 5ca4e8ee33cb2de7f0e05b91dfe9cc41829609cd pr-ci definitions: add external idp related jobs.
  • 9cc703fd0ed1afc24dc865ed967264c7f7340ac7 ipatests: Add integration tests for External IdP support

ipa-4-9:

  • b979dd91f149fd1f4fc1f48466a26f575eae0ae4 ipatests: Add integration tests for External IdP support
  • b39f9336fa12e7f28ce0a5c51677983bc9b72621 pr-ci definitions: add external idp related jobs.

master:

  • a80a98194837f99c494dbee7e3326acde1ccb8cd ipatests: update prci definitions for test_idp.py
  • bd57ff35660cd1e911db43805fbbea5d26058fbc Add end to end integration tests for external IdP

ipa-4-9:

  • 857713c5a9c8e0b62c06dd92e69c09eeb34b2e99 Add end to end integration tests for external IdP
  • 50b4d9ab3fcb2e63edc8d20346e4a8a79f15692d ipatests: update prci definitions for test_idp.py

master:

  • c6a16a7e537c30a348ea00d657256c0a94171572 docs: add security section to idp

ipa-4-9:

  • 170155b648084846111bf0c65459aba94a8e980d docs: add security section to idp

ipa-4-10:

  • 56d287248039f56c7b6bba3860061cb2b4460337 docs: add security section to idp
Metadata
None
None
None
None
Normal
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.