From a728a8d43e537bb40b96a6746721619024944afa Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Wed, 19 Jul 2023 16:06:26 +0200 Subject: [PATCH 1/4] README-config.md: Add choices pkinit, hardened and idp to user_auth_type The parameter user_auth_type has been updated in FreeIPA. The choices pkinit, hardened and idp have been missing and are now added. --- README-config.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-config.md b/README-config.md index a1d6117f..b2615df2 100644 --- a/README-config.md +++ b/README-config.md @@ -145,7 +145,7 @@ Variable | Description | Required `selinuxusermaporder` \| `ipaselinuxusermaporder`| Set ordered list in increasing priority of SELinux users | no `selinuxusermapdefault`\| `ipaselinuxusermapdefault` | Set default SELinux user when no match is found in SELinux map rule | no `pac_type` \| `ipakrbauthzdata` | set default types of PAC supported for services (choices: `MS-PAC`, `PAD`, `nfs:NONE`). Use `""` to clear this variable. | no -`user_auth_type` \| `ipauserauthtype` | set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`). Use `""` to clear this variable. | no +`user_auth_type` \| `ipauserauthtype` | set default types of supported user authentication (choices: `password`, `radius`, `otp`, `pkinit`, `hardened`, `idp`, `disabled`, `""`). An additional check ensures that only types can be used that are supported by the IPA version. Use `""` to clear this variable. | no `domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | no `ca_renewal_master_server` \| `ipacarenewalmasterserver`| Renewal master for IPA certificate authority. | no `enable_sid` | New users and groups automatically get a SID assigned. Cannot be deactivated once activated. Requires IPA 4.9.8+. (bool) | no From 42c07d63360c3aee02200f28ed9208dc8aa17ddc Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Wed, 19 Jul 2023 16:07:27 +0200 Subject: [PATCH 2/4] README-host.md: Add choice idp to auth_ind The parameter auth_ind has been updated in FreeIPA. The choice idp have been missing and is now added. --- README-host.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-host.md b/README-host.md index 6fea346c..e0c10ccf 100644 --- a/README-host.md +++ b/README-host.md @@ -354,7 +354,7 @@ Variable | Description | Required `mac_address` \| `macaddress` | List of hardware MAC addresses. | no `sshpubkey` \| `ipasshpubkey` | List of SSH public keys | no `userclass` \| `class` | Host category (semantics placed on this attribute are for local interpretation) | no -`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Use empty string to reset auth_ind to the initial value. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened", ""] | no +`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Use empty string to reset auth_ind to the initial value. Other values may be used for custom configurations. An additional check ensures that only types can be used that are supported by the IPA version. Choices: ["radius", "otp", "pkinit", "hardened", "idp", ""] | no `requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service (bool) | no `ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service (bool) | no `ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client (bool) | no From 9cbccdade9c2d81c03900ead7ba877d6e9e47aeb Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Wed, 19 Jul 2023 16:07:50 +0200 Subject: [PATCH 3/4] README-service.md: Add choice idp to auth_ind The parameter auth_ind has been updated in FreeIPA. The choice idp have been missing and is now added. --- README-service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-service.md b/README-service.md index c0cd3272..0047dfaa 100644 --- a/README-service.md +++ b/README-service.md @@ -294,7 +294,7 @@ Variable | Description | Required `name` \| `service` | The list of service name strings. | yes `certificate` \| `usercertificate` | Base-64 encoded service certificate. | no `pac_type` \| `ipakrbauthzdata` | Supported PAC type. It can be one of `MS-PAC`, `PAD`, or `NONE`. Use empty string to reset pac_type to the initial value. | no -`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. It can be any of `otp`, `radius`, `pkinit` or `hardened`. Use empty string to reset auth_ind to the initial value. | no +`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. It can be any of `otp`, `radius`, `pkinit`, `hardened`, `idp` or `""`. An additional check ensures that only types can be used that are supported by the IPA version. Use empty string to reset auth_ind to the initial value. | no `requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service. Default to true. (bool) | no `ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service. Default to false. (bool) | no `ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client. Default to false. (bool) | no From a791c6a0ca4ccf8d4489632eb9bda9cb03fe515f Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Wed, 19 Jul 2023 16:08:13 +0200 Subject: [PATCH 4/4] README-user.md: Add choices pkinit, hardened and idp to user_auth_type The parameter user_auth_type has been updated in FreeIPA. The choices pkinit, hardened and idp have been missing and are now added. --- README-user.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-user.md b/README-user.md index c822a426..da04fc3d 100644 --- a/README-user.md +++ b/README-user.md @@ -437,7 +437,7 @@ Variable | Description | Required `manager` | List of manager user names. | no `carlicense` | List of car licenses. | no `sshpubkey` \| `ipasshpubkey` | List of SSH public keys. | no -`userauthtype` | List of supported user authentication types. Choices: `password`, `radius`, `otp` and ``. Use empty string to reset userauthtype to the initial value. | no +`userauthtype` \| `ipauserauthtype` | List of supported user authentication types. Choices: `password`, `radius`, `otp`, `pkinit`, `hardened`, `idp` and `""`. An additional check ensures that only types can be used that are supported by the IPA version. Use empty string to reset userauthtype to the initial value. | no `userclass` | User category. (semantics placed on this attribute are for local interpretation). | no `radius` | RADIUS proxy configuration | no `radiususer` | RADIUS proxy username | no