freeipa

#9842 Add ability to configure external password reset agents with ipa_pwd_extop
Closed: fixed by frenaud. Opened by ftrivino.

Closed: fixed
Reopen Issue

Request for enhancement

As an IdM administrator, I want clear and consolidated documentation for configuring external agents to perform privileged password resets so that third-party tools (e.g., CyberArk) can integrate securely with FreeIPA.

Issue

Currently, FreeIPA supports password synchronization from Active Directory using the Passsync plugin. This plugin leverages the ipa_pwd_extop feature, which treats specific LDAP bind DNs as Directory Manager equivalents, allowing password resets without forcing users to change passwords upon next login.

However, there is no clear, consolidated documentation detailing how to configure external agents to perform such privileged password resets. This gap prevents third-party vendors, such as CyberArk, from integrating their own secure password reset solutions with FreeIPA.

The goal of this request is to create comprehensive, user-friendly documentation that describes the setup and configuration steps required for external password reset agents to leverage this mechanism safely and effectively.

Something more than this?
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_idm_users_groups_hosts_and_access_control_rules/managing-user-passwords-in-idm_managing-users-groups-hosts#enabling-password-reset-in-idm-without-prompting-the-user-for-a-password-change-at-the-next-login_managing-user-passwords-in-idm

@rcritten yes, I implemented sysaccounts as an IPA object, see https://github.com/freeipa/freeipa/pull/7908 for more details.

Metadata Update from @abbra:
- Issue assigned to abbra

Design document: https://freeipa--7908.org.readthedocs.build/en/7908/designs/sysaccounts.html

master:

  • f17fba0adc91f9ecacfdb4cd975dc20ce051b80f ipa-pwd-extop: add SysAcctManagersDNs support
  • 24e4fd5c0c346b316845e3eea2ff437222fe0823 Add system accounts (sysaccounts)
  • 8c7427a2bae5f88e1ef3aa1fd267b7dddbe09605 sysaccounts: add integration test

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-110204

ipa-4-12:

  • 5550efd2c4fe9e71544747ca23a99544b0f43274 ipa-pwd-extop: add SysAcctManagersDNs support
  • a3e044b7bff6e47d848c2b840d68737c1cfa735c Add system accounts (sysaccounts)
  • ce907c2d805632e7d1aeb46363e37efd81b6ad04 sysaccounts: add integration test

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • f2fc104f067221f7621537a2daa40c13239522e3 sysaccount: make sure nsaccountlock is always present

ipa-4-12:

  • 517fe4cfee29da7531728b0a508c6162935e5597 sysaccount: make sure nsaccountlock is always present

master:

  • 0034c83b20be903dc60a5da5e7ca85a428b27979 sysaccount_mod: Use object.setattr to set allow_empty_update in exception handler
  • a87ab6bf2c9893f96ca34c19c029fe5f82ea06a3 ipatests: sysaccounts: add missing integration/webui/xmlrpc tests

ipa-4-12:

  • c9c2f3337d2e404915f95d9f3545c7850411afd7 sysaccount_mod: Use object.setattr to set allow_empty_update in exception handler
  • f71947d29cd5e6d520f0bea87db248ec8ec88d87 ipatests: sysaccounts: add missing integration/webui/xmlrpc tests

ipa-4-13:

  • f580f12e5bcace2dbbee493f093bd62937cc2e3a sysaccount_mod: Use object.setattr to set allow_empty_update in exception handler
  • 386e9f37af484fc018b174ffcbe5f2e59a783cb4 ipatests: sysaccounts: add missing integration/webui/xmlrpc tests
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.