Security benefits of FreeIPA/IDM
summary
FreeIPA bundles 389-ds LDAP, MIT Kerberos and Dogtag CA with a web UI to provide LDAP storage, Kerberos auth and certificate issuance; one replica can handle up to 20k clients. Demonstrated features: AD trust for sharing Linux resources, HBAC for per-host SSH/sudo rules, three certificate types (host/service/user), central sudo/RBAC (permission → privilege → rule), Ansible modules for automation, HOTP/TOTP tokens, encrypted backups via ipa-backup-gpg, FIPS compatibility, and planned work on USBGuard and global catalog support.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:00What is FreeIPA
- 1:36FreeIPA Components
- 3:03Use Cases
- 8:20Integration with VMware
- 8:48Integration with Open Stack
- 9:16Integration with Openshift
- 11:11Multiple Users
- 12:06Host Based Access Control
- 13:04Certificates
- 13:46Password Policy
- 14:40Fips
- 16:54RBack
- 18:46sudo
- 19:20ansible
- 20:30OTP
- 22:33Identity Management
related talks
38mFreeIPA
33mFIDO2 authentication for centrally managed users
54mState of authentication and identity in Fedora
35mAutomatic joining cloud VMs to FreeIPA identity domain
50mAd Hoc Mutable Infrastructure for Security Management
01h 09mLife beyond FIPS 140-3: identity tales
45mLife Amongst the Authentica-ceans 🦀
33mPractical Federated Identity