--- title: FreeIPA support_level: community --- ## Preparation The following placeholders are used in this guide: - `svc_authentik` is the name of the bind account. - `freeipa.company` is the Name of the domain. - `ipa1.freeipa.company` is the Name of the FreeIPA server. ## FreeIPA Setup 1. Log in to FreeIPA. 2. Create a user in FreeIPA, matching your naming scheme. Provide a strong password, example generation methods: `pwgen 64 1` or `openssl rand 36 | base64 -w 0`. After you are done click **Add and Edit**. ![](./user_create.png) 3. In the user management screen, select the Roles tab. ![](./user_roles.png) 4. Add a role that has privileges to change user passwords, the default `User Administrators` role is sufficient. This is needed to support password resets from within authentik. ![](./add_user_role.png) 5. By default, if an administrator account resets a user's password in FreeIPA the user's password expires after the first use and must be reset again. This is a security feature to ensure password complexity and history policies are enforced. To bypass this feature for a more seamless experience, you can make the following modification on each of your FreeIPA servers: ``` $ ldapmodify -x -D "cn=Directory Manager" -W -h ipa1.freeipa.company -p 389 dn: cn=ipa_pwd_extop,cn=plugins,cn=config changetype: modify add: passSyncManagersDNs passSyncManagersDNs: uid=svc_authentik,cn=users,cn=accounts,dc=freeipa,dc=company ``` :::info Additional info: [22.1.2. Enabling Password Reset Without Prompting for a Password Change at the Next Login](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/user-authentication#user-passwords-no-expiry) ::: ## authentik Setup :::note This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues. See the [LDAP Source documentation](../../protocols/ldap) for more information on these settings. ::: To create a new LDAP Source in authentik: 1. Log in to authentik as an administrator, and open the authentik Admin interface. 2. Navigate to **Directory** > **Federation and Social Login**, click **New Source**, select **LDAP Source**, and click **Next**. 3. Configure the following settings: - **Name**: Provide a descriptive name for the LDAP source. - **Slug**: Provide a slug for the LDAP source. - **Update internal password on login**: Enable this if you want users to still be able to log in when FreeIPA is unavailable. - **Delete not found object**: Enable to delete users from authentik when they are deleted in FreeIPA. - Under **Connection settings**: - **Server URI**: `ldaps://ipa1.freeipa.company` :::tip You can specify multiple server URIs separated by commas (e.g. `ldap://ipa1.freeipa.company,ldap://ipa2.freeipa.company`); if using a DNS record with multiple entries, authentik will pick one at random on first connection. ::: - **Enable StartTLS**: Enable for `ldap://` protocol, disable for `ldaps://`. - **TLS Verification Certificate**: Optionally select the certificate used to validate the remote certificate. - **Bind CN**: `uid=svc_authentik,cn=users,cn=accounts,dc=freeipa,dc=company` - **Bind Password**: The password for the above user account. - **Base DN**: `dc=freeipa,dc=company` - Under **LDAP Attribute mapping**: - **User Property Mappings**: Select all Mappings whose names begin with `authentik default LDAP` and `authentik default OpenLDAP`. Deselect any other Mappings that are selected by default. - **Group property mappings**: Select `authentik default OpenLDAP Mapping: cn` - Under **Additional settings**: - **Parent Group**: If selected, all synchronized groups will be given this authentik group as a parent. - **User Path**: The path that users will be saved under in authentik. - **Addition User/Group DN**: `cn=users,cn=accounts` - **Addition Group DN**: `cn=groups,cn=accounts` - **User object filter**: `(objectClass=person)` - **Group object filter**: `(objectClass=groupofnames)` - **Group membership field**: `memberOf` - **User membership attribute**: `distinguishedName` - **Lookup using user attribute**: Enabled. - **Object uniqueness field**: `ipaUniqueID` :::caution FreeIPA groups can contain nested groups. The `memberOf` user attribute lists all group memberships, direct and indirect. If you want to sync only direct group memberships, use the following settings: - **Group membership field**: `member` - **User membership attribute**: `distinguishedName` - **Lookup using user attribute**: Disabled. ::: 4. Click **Finish**. ### Manual synchronization After saving the source, start a synchronization by opening the source, going to the **Sync** tab, and clicking **Run sync again**. Finally, confirm that the **User database + LDAP password** backend is selected in **Flows and Stages** > **Stages** > **Password Stage**. ![](./password_stage.png) ### Blueprints You can also configure the LDAP source with a blueprint: :::note You must set the username (dn) and password in the environment variables `FREEIPA_DN` and `FREEIPA_PASSWORD`. ::: ```yaml # yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json version: 1 metadata: name: FreeIPA LDAP Source labels: blueprints.goauthentik.io/description: "LDAP Source configuration for FreeIPA" entries: - model: authentik_sources_ldap.ldapsource identifiers: slug: ldap-source-freeipa attrs: enabled: true base_dn: dc=freeipa,dc=company additional_user_dn: cn=users,cn=accounts additional_group_dn: cn=groups,cn=accounts bind_cn: !Env FREEIPA_DN bind_password: !Env FREEIPA_PASSWORD delete_not_found_objects: true group_membership_field: memberOf group_object_filter: (objectClass=groupofnames) lookup_groups_from_user: true object_uniqueness_field: ipaUniqueID server_uri: ldaps://ipa1.freeipa.company,ldaps://ipa2.freeipa.company sni: true sync_groups: true sync_users: true sync_users_password: true user_membership_attribute: distinguishedName user_object_filter: (objectClass=person) user_property_mappings: - !Find [ authentik_sources_ldap.ldapsourcepropertymapping, [managed, goauthentik.io/sources/ldap/openldap-cn], ] - !Find [ authentik_sources_ldap.ldapsourcepropertymapping, [managed, goauthentik.io/sources/ldap/openldap-uid], ] - !Find [ authentik_sources_ldap.ldapsourcepropertymapping, [managed, goauthentik.io/sources/ldap/default-mail], ] - !Find [ authentik_sources_ldap.ldapsourcepropertymapping, [managed, goauthentik.io/sources/ldap/default-dn-path], ] - !Find [ authentik_sources_ldap.ldapsourcepropertymapping, [managed, goauthentik.io/sources/ldap/default-name], ] group_property_mappings: - !Find [ authentik_sources_ldap.ldapsourcepropertymapping, [managed, goauthentik.io/sources/ldap/openldap-cn], ] ``` :::note If using LDAP, prepend the server URI with `ldap://` and include `start_tls: true`. :::