On Fri, Jun 06, 2014 at 06:38:10AM -0400, James wrote:
> I've just announced the first sane implementation for secret handling
> in puppet. Since everyone does this wrong, I thought I'd do it right,
> by pioneering a new technique. You can read about it here:
> In short, the dm_password and admin_password never get touched by
> puppet, and are generated locally on the freeipa server. What this
> means is that puppet doesn't know what they are, and as a result,
> can't use them to accomplish admin tasks.
Could we make this functionality part of the ipa-server-install script
itself? It could be useful outside of puppet as well?
Do you have any proposal how to go about ipa-client-install in puppet,
without having the password stored/exposed there?
Principal Software Engineer, Identity Management Engineering, Red Hat
Freeipa-devel mailing list