Sign inSign up

swissmakers/fipam

By swissmakers

•Updated 7 months ago

FreeIPA Account Manager (FIPAM) - A tool for managing user-based identities from FreeIPA.

Image
Integration & delivery
0

565

swissmakers/fipam repository overview

⁠FreeIPA Account Manager (FIPAM)

This is a web application built with Go (Golang) and Gin framework that allows users to update their public SSH keys and change their passwords in a FreeIPA environment. The application authenticates users via LDAP and provides a secure and user-friendly interface for managing their credentials.

⁠Features

  • User authentication via LDAP
  • Update or generate new SSH public keys
  • Change user passwords
  • Secure session handling with cookies
  • Responsive design using Bootstrap

⁠Configuration notes

⁠LDAP Protocol
  • Set ldapProtocol to ldap for unencrypted connections.
  • Set ldapProtocol to ldaps for encrypted connections.
⁠CA Fingerprint

If you are using ldaps, you need to get the CA trusted fingerprint from your FreeIPA server. Here is how you can retrieve it:

  1. Replace your_ldap_server.corp with your ldaps-FQDN or IP and extract the fingerprint using openssl:

    echo | openssl s_client -connect your_ldap_server.corp:636 -showcerts 2>/dev/null | openssl x509 -fingerprint -noout -sha256 | sed 's/://g'

  2. Copy the SHA256 fingerprint and add it to your env-variables:

    -e CA_FINGERPRINT="your_ca_fingerprint"

⁠Run the Project

podman run -d -p 8080:8080 --name fipam \
  -e LDAP_SERVER="your_ldap_server.corp" \
  -e LDAP_PORT=636 \
  -e LDAP_BASE_DN="dc=example,dc=corp" \
  -e LDAP_USER_DN="cn=users,cn=accounts,dc=example,dc=corp" \
  -e LDAP_BIND_USER="uid=ldap_bind,cn=sysaccounts,cn=etc,dc=example,dc=corp" \
  -e LDAP_BIND_PASS="**************************" \
  -e LDAP_PROTOCOL="ldaps" \
  -e CA_FINGERPRINT="your_ca_fingerprint" \
  -e SERVER_PORT=8080 \
  -e SUBDIRECTORY_PREFIX="/your_custom_subdirectory_if_needed" \
  -e DEBUG=false \
  swissmakers/fipam:latest
⁠Run is as systemd service
vim /etc/systemd/system/freeipa-account-manager.service
  • Paste and mod according to your needs:
[Unit]
Description=FreeIPA Account Manager
Wants=network.target
After=network.target
Requires=podman.service

[Service]
Environment="SERVICE=Prod-FIPAM"
Type=simple
TimeoutStartSec=30s

ExecStartPre=-/usr/bin/podman rm -f ${SERVICE}
ExecStart=/usr/bin/podman run --name ${SERVICE} \
  -p 3030:8080 \
  --dns=172.16.10.xx \
  --dns=172.16.10.xx \
  -e "TZ=Europe/Zurich" \
  -e LDAP_SERVER="your_ldap_server.corp" \
  -e LDAP_PORT=636 \
  -e LDAP_BASE_DN="dc=example,dc=corp" \
  -e LDAP_USER_DN="cn=users,cn=accounts,dc=example,dc=corp" \
  -e LDAP_BIND_USER="uid=ldap_bind,cn=sysaccounts,cn=etc,dc=example,dc=corp" \
  -e LDAP_BIND_PASS="**************************" \
  -e LDAP_PROTOCOL="ldaps" \
  -e CA_FINGERPRINT="your_ca_fingerprint" \
  -e SERVER_PORT=8080 \
  -e SUBDIRECTORY_PREFIX="/your_custom_subdirectory_if_needed" \
  -e DEBUG=false \
  -v /etc/localtime:/etc/localtime:ro \
  registry.swissmakers.ch/infra/fipam:latest

ExecReload=-/usr/bin/podman stop ${SERVICE}
ExecReload=-/usr/bin/podman rm ${SERVICE}
ExecStop=-/usr/bin/podman stop ${SERVICE}

Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now freeipa-account-manager.service

⁠Usage

  • Access the application at http://localhost:8080.
  • Login using your LDAP credentials.
  • Update your public SSH key or generate a new one.
  • Change your password.

⁠License

This project is licensed under the MIT License.

⁠Acknowledgments

Tag summary

Content type

Image

Digest

sha256:ea2ec786a…

Size

92.2 MB

Last updated

7 months ago

docker pull swissmakers/fipam