Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-19 Thread Martin Kosek
On 08/18/2014 09:35 PM, Michael Lasevich wrote: I wanted to use the python ipalib directly, but like you mentioned, I found very little documentation and what I found indicated I was going to just pass cli arguments to it, it seemed to be not much better than calling the wrapper directly :-(

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-18 Thread Rob Crittenden
Michael Lasevich wrote: Thanks, that was actually very helpful. Host Enrollment privilege does not actually allow you to enroll hosts, not sure what that is about. But Host Administrators worked just fine. I'd be curious to know how it was failing. It should be enough to do just an

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-18 Thread Michael Lasevich
I wanted to use the python ipalib directly, but like you mentioned, I found very little documentation and what I found indicated I was going to just pass cli arguments to it, it seemed to be not much better than calling the wrapper directly :-( I will clean up my salt reactor of things specific

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Martin Kosek
On 08/14/2014 10:23 PM, Michael Lasevich wrote: Is there somewhere a documented minimum set of permissions required to create a special role/account/principal to auto-join machines to the domain? I am not all too comfortable to run this as admin user and not quite ready to set up the

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Michael Lasevich
Sorry, I did not intend to belittle your efforts - just misread the code (saw you pass in $admin and $password and made wrong assumption that $admin was admin username) as well as trying to avoid puppet as I find Salt much quicker and much simpler (and already established in my setup) I sat down

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Michael Lasevich
Thanks, that was actually very helpful. Host Enrollment privilege does not actually allow you to enroll hosts, not sure what that is about. But Host Administrators worked just fine. -M On Fri, Aug 15, 2014 at 1:18 AM, Martin Kosek mko...@redhat.com wrote: On 08/14/2014 10:23 PM, Michael

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Martin Kosek
This may also be a bug. Host Enrollment privilege should be enough to join FreeIPA. We did many access control related fixes in FreeIPA 4.0 (like https://fedorahosted.org/freeipa/ticket/4252), it may got fixed there. If Host Enrollment permission is still failing for you in 4.0+, we would be

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Dmitri Pal
On 08/15/2014 11:25 AM, Michael Lasevich wrote: Sorry, I did not intend to belittle your efforts - just misread the code (saw you pass in $admin and $password and made wrong assumption that $admin was admin username) as well as trying to avoid puppet as I find Salt much quicker and much

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Martin Kosek
On 08/15/2014 11:25 AM, Michael Lasevich wrote: ... The only thing that bugs me is that I am calling IPA python code from my salt reactor python code via subprocess - there has got to be a better, more direct way - but I found documentation too confusing to follow at 1 am - will be a project

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Petr Spacek
On 15.8.2014 12:51, Martin Kosek wrote: On 08/15/2014 11:25 AM, Michael Lasevich wrote: ... The only thing that bugs me is that I am calling IPA python code from my salt reactor python code via subprocess - there has got to be a better, more direct way - but I found documentation too confusing

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread James
On Fri, Aug 15, 2014 at 5:25 AM, Michael Lasevich mlasev...@lasevich.net wrote: Sorry, I did not intend to belittle your efforts - just misread the code Didn't take it that way, no worries :) (saw you pass in $admin and $password and made wrong assumption that $admin was admin username) as

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-15 Thread Petr Viktorin
On 08/15/2014 06:02 PM, James wrote: On Fri, Aug 15, 2014 at 5:25 AM, Michael Lasevich mlasev...@lasevich.net wrote: Sorry, I did not intend to belittle your efforts - just misread the code Didn't take it that way, no worries :) (saw you pass in $admin and $password and made wrong assumption

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-14 Thread James
On Thu, Aug 14, 2014 at 4:23 PM, Michael Lasevich mlasev...@lasevich.net wrote: I am not all too comfortable to run this as admin user and not quite ready to set up the orchestration needed to pre-join the host. Re: orchestration, https://github.com/purpleidea/puppet-ipa Does this help? --

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-14 Thread Michael Lasevich
Not that much. For one, I am using Salt instead if Puppet, but more importantly, if I am reading this correctly it seems to be just using full admin account. I can already do that. By orchestration I meant setting up the OTP for client join on the server, then passing that OTP to the client to

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-14 Thread James
On Thu, Aug 14, 2014 at 7:29 PM, Michael Lasevich mlasev...@lasevich.net wrote: Not that much. For one, I am using Salt instead if Puppet, but more importantly, if I am reading this correctly it seems to be just using full admin account. I can already do that. By orchestration I meant setting

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-14 Thread Michael Lasevich
I appreciate it. Maybe I did not read it close enough, but it seemed to send the admin password to every client, which is what I am trying to avoid. I will take a closer look, maybe I can bite the bullet and implement the few lines of code that are required to make this work in Salt (it would

Re: [Freeipa-users] Minimal permissions for joiner account?

2014-08-14 Thread James
On Thu, Aug 14, 2014 at 8:29 PM, Michael Lasevich mlasev...@lasevich.net wrote: I appreciate it. Maybe I did not read it close enough, but it seemed to send the admin password to every client, which is what I am trying to avoid. Oh no!! Definitely not :) I went to great pains to specifically