On 24/10/16 19:26, Gilbert Wilson wrote:
On Oct 24, 2016, at 5:51 AM, David Kupka <[email protected]> wrote:
On 22/10/16 00:15, Gilbert Wilson wrote:
We have a lot of FreeBSD systems that I would like to streamline certificate
issuance and renewal. Ideally, we could leverage our FreeIPA system's CA to do
this. But, certmonger doesn't run on FreeBSD (or does it?). What other means
have other people tried, or would you recommend investigating, to enable
automated certificate issuance and renewal for FreeBSD FreeIPA clients?
Any pointers are appreciated!
Gil
Hello Gil!
I've very limited experiences with *BSD systems so the question may be
completely off.
Have you tried to install and run certmonger using FreeBSD's Linux Binary
Compatibility [1]? Though I don't know what are the limitations or possible
issues it could be a way.
[1] http://www.freebsd.cz/doc/handbook/linuxemu.html
--
David Kupka
You know… I haven’t ever tried LBC! I suppose it’s worth a sacrificial virtual
machine to see if it works. It also occurred to me that FreeIPA might have some
sort of API given the web interface, and sure enough that made the Google-fu
turn up more useful results.
* https://vda.li/en/posts/2015/05/28/talking-to-freeipa-api-with-sessions/
* https://adam.younglogic.com/2010/07/talking-to-freeipa-json-web-api-via-curl/
* http://www.admin-magazine.com/Archive/2016/34/A-REST-interface-for-FreeIPA
There doesn’t appear to be a manual for the API but those examples seem to
“show the way”. My initial thought is to create a script that uses kinit with a
keytab to authenticate against FreeIPA and then create/renew permissible
certificates for the system before they expire. This seems reasonable since the
certificate creation/renewal is the scope of what I’m interested in doing. Do
you see any reason not to do it this way or have any other alternative
suggestions? Another way to think about it, perhaps, is what would you do on a
Linux system if you didn’t have access to the FreeIPA client or certmonger?
Thanks for the pointer/reminder about LBC!
Gil
You're right, FreeIPA has JSON RPC API. It's used in WebUI and also in
'ipa' CLI. If you've FreeIPA server 4.2 and above there's API Browser in
WebUI (IPA Server - API Browser). There you can find all commands and
their parameters.
Just obligatory disclaimer, talking directly to the API is not
officially supported. This means that the API can change in future versions.
Good luck!
--
David Kupka
--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
