FreeIPA migration: NixOS consumers and cutover (users, Keycloak, hosts, mail, retirement) #317

New issue

Open

opened 2026-08-10 14:07:54 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-10 14:07:54 +02:00

Owner

Scope

Everything the FreeIPA transition needs outside the IPA server itself. Depends on #316 (ADR-0024 + IPA-side ansible). This is deliberately one umbrella issue for triage — it will likely be split into per-phase issues; the phases below are the natural cut lines.

Phases

P1 — users into IPA (additive, nothing consumes it): ipa migrate-ds from all OpenLDAP suffixes (crypt hashes survive; Kerberos keys generated on first auth), re-add SSH keys as ipasshpubkey, populate the group memberships, set quota attributes for exceptions.
P2 — Keycloak federates IPA (decision gate): second LDAP federation provider in cloonar-realm.json beside the existing one, new HTTP/sso.cloonar.com keytab issued from IPA, flip web-arm's pinned kdc=. Prove SPNEGO and password login against IPA before anything else moves. Later in this phase: per-client access gates on svc-* groups (app-side where possible, restrict-client-auth extension as backstop), Nextcloud user_ldap re-point (internal username = uid, quota field = cloudQuota) with oidc_login proxy mode.
P3 — hosts: SSSD with IPA provider (security.ipa, fallback plain SSSD + krb5 against IPA), access_provider = ipa so HBAC enforces, sss_ssh_authorizedkeys replaces the ldapsearch AuthorizedKeysCommand, sudo via security.sudo.extraRules for %adm-* groups, pam_group hardware-group grants on nb/dev*. Risk item: prove enrolment on one NixOS host early. Per-host verification: a hosted-domain test user is refused SSH.
P4 — mail: routing to Nix-generated Postfix maps (fixes the two-label-domain limit), Dovecot single IPA passdb/userdb (auth_bind = yes, mail=%u, mailQuota in user_attrs), Dovecot/Postfix keytabs re-issued from IPA. Cut over one domain at a time; per-domain gate: IMAP login works via IPA before that domain's old LDAP passdb path is removed.
P5 — retirement: OpenLDAP module + all nine databases, mail's KDC module (hosts/mail/modules/kerberos.nix), Authelia (ADR-0022 M6), phpldapadmin, utils/modules/ldap-auth.nix + linuxbind machinery. Home Assistant LDAP auth re-pointed at IPA (or moved local) before slapd dies.
P6 — optional, later: first external-org IPA via the per-customer playbook.

Constraints to carry through

Two KDCs serve CLOONAR.COM during the transition — every keytab re-issue and its consumers' kdc= flip must land together; never leave a service keyed in one KDC while its clients pin the other.
Per-user password migration is silent only while OpenLDAP userPassword is live — do not implement ADR-0023's {CRYPT}! partition in the meantime.
No username in NixOS config: Nix references IPA group names only.

## Scope Everything the FreeIPA transition needs *outside* the IPA server itself. Depends on #316 (ADR-0024 + IPA-side ansible). This is deliberately one umbrella issue for triage — it will likely be split into per-phase issues; the phases below are the natural cut lines. ## Phases - **P1 — users into IPA** (additive, nothing consumes it): `ipa migrate-ds` from all OpenLDAP suffixes (crypt hashes survive; Kerberos keys generated on first auth), re-add SSH keys as `ipasshpubkey`, populate the group memberships, set quota attributes for exceptions. - **P2 — Keycloak federates IPA (decision gate)**: second LDAP federation provider in `cloonar-realm.json` beside the existing one, new `HTTP/sso.cloonar.com` keytab issued from IPA, flip web-arm's pinned `kdc=`. Prove SPNEGO and password login against IPA before anything else moves. Later in this phase: per-client access gates on `svc-*` groups (app-side where possible, restrict-client-auth extension as backstop), Nextcloud `user_ldap` re-point (internal username = `uid`, quota field = `cloudQuota`) with `oidc_login` proxy mode. - **P3 — hosts**: SSSD with IPA provider (`security.ipa`, fallback plain SSSD + krb5 against IPA), `access_provider = ipa` so HBAC enforces, `sss_ssh_authorizedkeys` replaces the ldapsearch `AuthorizedKeysCommand`, sudo via `security.sudo.extraRules` for `%adm-*` groups, `pam_group` hardware-group grants on `nb`/`dev*`. **Risk item: prove enrolment on one NixOS host early.** Per-host verification: a hosted-domain test user is *refused* SSH. - **P4 — mail**: routing to Nix-generated Postfix maps (fixes the two-label-domain limit), Dovecot single IPA passdb/userdb (`auth_bind = yes`, `mail=%u`, `mailQuota` in `user_attrs`), Dovecot/Postfix keytabs re-issued from IPA. Cut over one domain at a time; per-domain gate: IMAP login works via IPA before that domain's old LDAP passdb path is removed. - **P5 — retirement**: OpenLDAP module + all nine databases, mail's KDC module (`hosts/mail/modules/kerberos.nix`), Authelia (ADR-0022 M6), phpldapadmin, `utils/modules/ldap-auth.nix` + `linuxbind` machinery. Home Assistant LDAP auth re-pointed at IPA (or moved local) before slapd dies. - **P6 — optional, later**: first external-org IPA via the per-customer playbook. ## Constraints to carry through - Two KDCs serve `CLOONAR.COM` during the transition — every keytab re-issue and its consumers' `kdc=` flip must land together; never leave a service keyed in one KDC while its clients pin the other. - Per-user password migration is silent only while OpenLDAP `userPassword` is live — do not implement ADR-0023's `{CRYPT}!` partition in the meantime. - No username in NixOS config: Nix references IPA group names only.

dominik.polakovics added the

needs-triage

label

2026-08-10 14:07:54 +02:00

dominik.polakovics referenced this issue from a commit

2026-08-10 15:43:43 +02:00

feat(ansible): ADR-0024 and the ipa_structure role

dominik.polakovics referenced this issue

2026-08-10 15:44:24 +02:00

feat(ansible): ADR-0024 — one FreeIPA replaces OpenLDAP, and the ipa_structure role that implements the IPA side #318