Allow users from trusted Active Directory forests to manage FreeIPA resources if they are part of appropriate roles in FreeIPA. For example, adding an Active Directory user as a member of ‘admins’ group would make it equivalent to built-in FreeIPA ‘admin’ user.
As an Administrator in AD I want to also be able to fully administer FreeIPA as if I am an FreeIPA admin so that I do not have to have two different accounts and passwords.
As an AD user I want to be able to use self service features of FreeIPA Web UI for example to upload my SSH keys or change other related to me data that is managed in FreeIPA on my behalf.
As an AD user or Admin I want to be able to access FreeIPA Web UI with SSO if I have a valid kerberos ticket
As an AD user or Admin I want to be able to access FreeIPA Web UI and be prompted for user name and password
As an AD user who is assigned appropriate privileges in FreeIPA, I’d like to be able enroll FreeIPA hosts.
As an AD user who is assigned appropriate privileges in FreeIPA, I’d like to be able to promote FreeIPA hosts to replicas.
Metadata Update from @abbra: - Issue assigned to abbra
PR: https://github.com/freeipa/freeipa/pull/4728
Design document: https://github.com/abbra/freeipa/blob/merge-adusers-webui/doc/designs/adtrust/admin-ipa-as-trusted-user.md
master:
ipa-4-8:
Metadata Update from @rcritten: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Metadata Update from @abbra: - Custom field changelog adjusted to A 3rd-party plugin to provide management of IPA resources as users from trusted Active Directory domains was merged into FreeIPA core. ID user overrides can now be added to IPA management groups and roles and thus allow AD users to manage IPA.
Login to comment on this ticket.