Whoa …… thanks for this. Now I think I am on the right path now. Thanks for the help.
R > On 12 Sep 2018, at 13:44, Alexander Bokovoy via FreeIPA-users > <freeipa-users@lists.fedorahosted.org> wrote: > > On ke, 12 syys 2018, Ryan via FreeIPA-users wrote: >> >> >>> On 12 Sep 2018, at 13:07, Alexander Bokovoy via FreeIPA-users >>> <freeipa-users@lists.fedorahosted.org> wrote: >>> >>> On ke, 12 syys 2018, Ryan via FreeIPA-users wrote: >>>> Hi, All >>>> >>>> Off the bat I would like to say being new to freeIPA and rolling out >>>> successful deployment to manage our servers has been amazing, very few >>>> hiccups. >>>> >>>> Which brings me to my next question, I have been asked if FreeIPA can >>>> be uses with Samba4 as a Domain Controller in our environment. After >>>> much reading its not as simple as it might sound. >>>> >>>> In saying that, my question is simple. >>>> >>>> How or what would be the best way to keep the AD users and FreeIPA >>>> users in sync. All I am really looking for is to Auth Users on the new >>>> Samba4 AD server. Can this be done or not. >>> It currently cannot be done. Requires functionality not available in >>> FreeIPA. >>> >> >> Yeah thats what I thought, just need to confirm. >> >> What would you suggest the best way to dump users from ldap and the >> populate samba with users and random passwords? I understand this is >> out of scope of freeIPA. > You can use Python bindings to IPA to generate list of user entries in python > and > then feed some properties of that to samba-tool. > > Something like this, using ipa console to simplify use of the API: > > # ipa console > (Custom IPA interactive Python console) > api: IPA API object > pp: pretty printer >>>> result = api.Command.user_find(all=True, raw=True)['result'] >>>> len(result) > 7 >>>> pp(result) > ({'cn': ('Alexander Bokovoy',), > 'displayName': ('Alexander Bokovoy',), > 'dn': 'uid=ab,cn=users,cn=accounts,dc=example,dc=com', > 'gecos': ('Alexander Bokovoy',), > 'gidnumber': ('1536000001',), > 'givenname': ('Alexander',), > 'homedirectory': ('/home/ab',), > 'initials': ('AB',), > 'ipaNTHash': (b'some-value',), > 'ipaNTSecurityIdentifier': ('<DOMAIN-SID>-1001',), > 'ipaUniqueID': ('<UNIQUE-ID>',), > 'ipaUserAuthType': ('otp',), > 'krbLastPwdChange': ('20180531111544Z',), > 'krbPasswordExpiration': ('20180829111544Z',), > 'krbcanonicalname': ('a...@example.com <mailto:a...@example.com>',), > 'krbprincipalname': ('a...@example.com <mailto:a...@example.com>',), > 'loginshell': ('/bin/sh',), > 'mail': ('a...@example.com <mailto:a...@example.com>',), > 'memberOf': (<list of DNs>), > 'nsaccountlock': ('FALSE',), > 'objectClass': ('ipaobject', > 'person', > 'top', > 'ipasshuser', > 'inetorgperson', > 'organizationalperson', > 'krbticketpolicyaux', > 'krbprincipalaux', > 'inetuser', > 'posixaccount', > 'ipaSshGroupOfPubKeys', > 'mepOriginEntry', > 'ipantuserattrs', > 'ipauserauthtypeclass'), > 'sn': ('Bokovoy',), > 'uid': ('ab',), > 'uidnumber': ('1536000001',) > <more data> > }, > <more entries> > ) > >>>> for x in filter(lambda x: 'givenname' in x, result): > ... print("samba-tool user create {uid[0]} t4mp-P-A-S-S-W-O-R-D > --given-name={givenname[0]} --surname={sn[0]} > --must-change-at-next-login".format(**x)) > ... samba-tool user create ab t4mp-P-A-S-S-W-O-R-D --given-name=Alexander > --surname=Bokovoy --must-change-at-next-login > samba-tool user create mbar t4mp-P-A-S-S-W-O-R-D --given-name=M --surname=Bar > --must-change-at-next-login > samba-tool user create new-user t4mp-P-A-S-S-W-O-R-D --given-name=New > --surname=User --must-change-at-next-login > samba-tool user create a-user t4mp-P-A-S-S-W-O-R-D --given-name=A > --surname=User --must-change-at-next-login > samba-tool user create some-user t4mp-P-A-S-S-W-O-R-D --given-name=Some > --surname=User --must-change-at-next-login > samba-tool user create user-mode t4mp-P-A-S-S-W-O-R-D --given-name=User > --surname=Mode --must-change-at-next-login > > > -- > / Alexander Bokovoy > Sr. Principal Software Engineer > Security / Identity Management Engineering > Red Hat Limited, Finland > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
_______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org