FreeIPA / Red Hat IdM

kinit alice                                # password prompt; TGT valid for the policy lifetime
kinit -kt /etc/krb5.keytab host/web-01.example.test   # from a keytab, no password, for services and cron
kinit -R                                   # renew the current TGT without re-authenticating, up to the renew lifetime
klist -f                                   # flags: F forwardable, R renewable, and the renew-until time
klist -e                                   # encryption types; aes256-cts-hmac-sha1-96 or aes256-cts-hmac-sha384-192 expected, never RC4 (arcfour)
klist -kt /etc/krb5.keytab                 # principals and key version numbers (KVNO) held in a keytab
kdestroy                                   # discard the current ccache
kswitch -p alice@EXAMPLE.TEST              # switch between cached principals when a collection cache holds several

kvno HTTP/web-01.example.test              # request a service ticket; fails if the SPN is missing
ipa krbtpolicy-mod --maxlife=8h --maxrenew=$((7*24))h   # tighten the default ticket lifetime domain-wide
ipa krbtpolicy-mod alice --maxlife=1h      # per-user override for a privileged account
KRB5_TRACE=/dev/stderr kvno HTTP/web-01.example.test    # every step, for diagnosing "no support for encryption type"

ipa user-add alice --first=Alice --last=Bloggs --email=alice@example.test --shell=/bin/bash
ipa user-mod alice --title='Platform Engineer' --sshpubkey="$(cat ~/.ssh/id_ed25519.pub)"
ipa user-find --all --raw alice        # --raw shows LDAP attribute names, useful for scripting
ipa user-disable alice                 # blocks authentication; keeps the object and memberships
ipa user-del alice --preserve          # moves to the deleted-users container, recoverable with user-undel
ipa passwd alice                       # sets a one-time password the user must change at next login

ipa group-add ops --desc='Platform on-call'
ipa group-add-member ops --users=alice --groups=contractors   # groups can nest
ipa group-show ops --all

ipa pwpolicy-add ops --maxlife=90 --minlength=14 --history=10 --priority=1
ipa pwpolicy-show ops

ipa group-add app-owners --nonposix                       # RBAC only, no GID
ipa group-add-member ops --external='EXAMPLE\\ad-admins'  # AD group via a trust; needs --external on a group created with --external
ipa group-add ops-posix --posix                           # allocates a GID from the ID range
ipa idrange-find                                          # the UID/GID ranges IdM assigns from

ipa automember-add ops --type=group
ipa automember-add-condition ops --type=group --key=title --inclusive-regex='Platform'
ipa automember-rebuild --type=group                       # apply to existing users; can be heavy on a large directory

ipa host-add web-01.example.test --ip-address=192.0.2.5
ipa-client-install --domain=example.test --realm=EXAMPLE.TEST \
  --principal=admin --mkhomedir --enable-dns-updates   # run on the client; needs root

ipa service-add HTTP/web-01.example.test
ipa service-allow-retrieve-keytab HTTP/web-01.example.test --hosts=web-01.example.test
ipa-getkeytab -s ipa-01.example.test -p HTTP/web-01.example.test -k /etc/httpd.keytab
klist -kt /etc/httpd.keytab                            # list principals and key versions in the keytab

ipa-client-install --uninstall         # clean removal on the client before re-enrolment
ipa host-del web-01.example.test       # then remove the stale host entry on a server

ipa dnszone-add example.test --dynamic-update=TRUE            # allow enrolled hosts to update their records
ipa dnsrecord-add example.test web --a-rec=192.0.2.5
ipa dnsrecord-add 2.0.192.in-addr.arpa 5 --ptr-rec=web.example.test.   # note the trailing dot
ipa dnsrecord-find example.test
ipa dnsconfig-mod --forwarder=192.0.2.53 --forward-policy=only
dig +short SRV _kerberos._udp.example.test                   # what a client resolves to find the KDC

ipa-getcert request -f /etc/pki/tls/certs/web.crt -k /etc/pki/tls/private/web.key \
  -K HTTP/web-01.example.test -D web-01.example.test        # -K principal, -D SAN dNSName
getcert list                      # tracked certificates: expiry, state, and the post-save command
getcert resubmit -i <request-id>  # force renewal now instead of waiting for the auto-renewal window
ipa cert-find --subject=web-01
ipa cert-show 12 --out=cert.pem
ipa cert-revoke 12 --revocation-reason=4    # reason 4 = superseded

ipa-cacert-manage renew            # renew the CA certificate; run on the CA renewal master only
ipa-certupdate                     # refresh the local trust store on every host after a CA change

ipa hbacrule-add ops-ssh
ipa hbacrule-add-user ops-ssh --groups=ops
ipa hbacrule-add-host ops-ssh --hostgroups=web-servers
ipa hbacrule-add-service ops-ssh --hbacsvcs=sshd
ipa hbactest --user=alice --host=web-01.example.test --service=sshd   # simulate before you rely on it

ipa sudorule-add ops-restart
ipa sudorule-add-user ops-restart --groups=ops
ipa sudorule-add-host ops-restart --hostgroups=web-servers
ipa sudorule-add-allow-command ops-restart --sudocmds='/bin/systemctl restart nginx'
ipa sudorule-mod ops-restart --sudoopt='!authenticate'    # no re-prompt for the password

ipa hbacrule-disable allow_all

ipa hbacsvcgroup-add remote-access
ipa hbacsvcgroup-add-member remote-access --hbacsvcs=sshd,cockpit
ipa hbacrule-add-service ops-ssh --hbacsvcgroups=remote-access
ipa hbacrule-find --all | grep -A3 'Rule name: ops-ssh'

ipa sudocmd-add '/usr/bin/systemctl restart nginx'
ipa sudocmdgroup-add web-restart
ipa sudocmdgroup-add-member web-restart --sudocmds='/usr/bin/systemctl restart nginx'
ipa sudorule-add-allow-command ops-restart --sudocmdgroups=web-restart
ipa sudorule-mod ops-restart --runasusers=root --runasgroups=root
ipa sudorule-add-option ops-restart --sudooption='!authenticate'
ipa sudorule-add-option ops-restart --sudooption='logfile=/var/log/sudo-ops.log'
ssh alice@web-01 sudo -l                 # confirm from the client after sss_cache -E; the client compiles the rules, not the server

sssctl user-checks alice -s sudo         # what SSSD returns for sudo for this user
sudo -l -U alice                          # the compiled sudo policy, run as root on the client

ipa role-add 'Helpdesk'
ipa privilege-add 'Password Reset'
ipa permission-add 'Reset user password' --type=user --right=write --attrs=userPassword
ipa privilege-add-permission 'Password Reset' --permissions='Reset user password'
ipa role-add-privilege 'Helpdesk' --privileges='Password Reset'
ipa role-add-member 'Helpdesk' --groups=helpdesk

ipa-replica-manage list -v ipa-01.example.test   # agreements and last-update time per peer
ipa-replica-manage force-sync --from ipa-01.example.test
ipa-csreplica-manage list                        # certificate-server (Dogtag) replication
ipa-healthcheck --failures-only                  # run on each server; the fastest triage

ldapsearch -Y GSSAPI -b "dc=example,dc=test" "(nsds5ReplConflict=*)" \* nsds5ReplConflict

# Discovery document: every endpoint, supported grant types and signing keys
curl -s https://sso.example.com/realms/example/.well-known/openid-configuration | jq '{authorization_endpoint, token_endpoint, userinfo_endpoint, end_session_endpoint, jwks_uri, grant_types_supported}'

# Client credentials: a service getting its own token
curl -s -X POST https://sso.example.com/realms/example/protocol/openid-connect/token \
  -d grant_type=client_credentials -d client_id=my-service -d client_secret="$CLIENT_SECRET" | jq -r .access_token

# Inspect a token you already hold (header and claims; does not verify the signature)
jq -R 'split(".") | .[1] | @base64d | fromjson' <<< "$ACCESS_TOKEN"

# Verify and introspect a token server-side (needs a confidential client's credentials)
curl -s -X POST https://sso.example.com/realms/example/protocol/openid-connect/token/introspect \
  -u "my-service:$CLIENT_SECRET" -d token="$ACCESS_TOKEN" | jq '{active, sub, preferred_username, realm_access}'

kcadm.sh config credentials --server https://sso.example.com --realm master --user admin --password-stdin <<< "$KC_ADMIN_PASSWORD"
kcadm.sh create realms -s realm=example -s enabled=true
kcadm.sh create clients -r example -s clientId=my-app -s 'redirectUris=["https://my-app.example.com/*"]' \
  -s publicClient=false -s standardFlowEnabled=true -s directAccessGrantsEnabled=false -s 'attributes."pkce.code.challenge.method"=S256'
kcadm.sh get clients -r example --fields id,clientId | jq -r '.[] | [.clientId, .id] | @tsv'
kcadm.sh create clients/<client-id>/client-secret -r example        # generate a secret
kcadm.sh get clients/<client-id>/client-secret -r example -F value
kcadm.sh create users -r example -s username=alice -s enabled=true -s email=alice@example.test
kcadm.sh set-password -r example --username alice --temporary   # prompts; user must reset at first login
kcadm.sh add-roles -r example --uusername alice --rolename platform-admin

klist -e                                   # current tickets and their encryption types
kinit -V alice                             # verbose ticket request
KRB5_TRACE=/dev/stderr kinit alice         # every step of the AS/TGS exchange
id alice                                   # does the client resolve the user through SSSD at all
getent passwd alice
sss_cache -E && systemctl restart sssd     # clear the SSSD cache after a policy change
journalctl -u sssd -f                      # follow SSSD while you reproduce the failure
realm list                                 # domain membership from the client's point of view
chronyc tracking                           # clock offset; skew over five minutes breaks Kerberos

# Last successful Kerberos authentication per user
ipa user-find --all --raw | awk '/^ *uid:/ {u=$2} /^ *krbLastSuccessfulAuth:/ {print u, $2}'

# Every member of a group, flattened
ipa group-show ops --all --raw | grep -E '^ *member(user|group):'

# Hosts that exist but were never enrolled (no keytab)
ipa host-find | awk '/Host name:/ {h=$3} /Keytab: False/ {print h}'

# Tracked certificates with their expiry and status
getcert list | grep -E 'Request ID|status:|expires:|certificate:'

# All HBAC rules and who they apply to
ipa hbacrule-find --all --raw | grep -E '^ *(cn|memberuser|memberhost|memberservice):'

# Test access for a user before telling them it works
ipa hbactest --user=alice --host=web-01.example.test --service=sshd

# Replication agreements and their last update
ipa-replica-manage list -v ipa-01.example.test | grep -E 'last update|status'

# Confirm the DNS SRV records a client will use to find servers
dig +short SRV _ldap._tcp.example.test _kerberos._tcp.example.test

# Force a full client refresh after policy changes
sss_cache -E && systemctl restart sssd && id alice

# Users whose password expires in the next 14 days
ipa user-find --all --raw | awk '/^ *uid:/ {u=$2} /^ *krbPasswordExpiration:/ {print $2, u}' | awk -v d="$(date -u -d '+14 days' +%Y%m%d)" '$1 < d""000000Z'

# Disabled but not yet deleted accounts (offboarding follow-up)
ipa user-find --disabled --raw | grep -E '^ *uid:'

# Accounts that have never logged in
ipa user-find --all --raw | awk '/^ *uid:/ {u=$2; s=0} /^ *krbLastSuccessfulAuth:/ {s=1} /^$/ {if (u && !s) print u; u=""}'

# Every host and whether it is enrolled, one per line
ipa host-find --raw | awk '/^ *fqdn:/ {h=$2} /^ *has_keytab: True/ {print h, "enrolled"} /^ *has_keytab: False/ {print h, "NOT enrolled"}'

# Hosts that have not contacted the domain recently (stale enrolments)
ipa host-find --all --raw | awk '/^ *fqdn:/ {h=$2} /^ *krbLastSuccessfulAuth:/ {print $2, h}' | sort

# Tracked certificates expiring within 30 days on this host
getcert list | awk '/Request ID/ {id=$0} /expires:/ {print id, $0}' | grep -v "$(date -d '+30 days' +%Y-%m-%d)"

# Which principals a keytab holds and their key versions
klist -kt /etc/krb5.keytab | awk 'NR>3 {print $4, $1}' | sort -u

# Request a fresh service ticket to confirm an SPN resolves and the keytab is current
for s in HTTP ldap host; do printf '%-6s ' "$s"; kvno "$s/$(hostname -f)" 2>&1 | tail -1; done

# All group memberships for one user, resolved through SSSD (indirect groups included)
id -Gn alice | tr ' ' '\n' | sort

# HBAC rules that apply to a given host group
ipa hbacrule-find --all --raw | awk '/^ *cn:/ {r=$2} /web-servers/ {print r}'

# Members of the admins group (the accounts to watch most closely)
ipa group-show admins --all --raw | grep -E '^ *member' | sed 's/^ *//'

# Confirm every server is healthy in one pass
for s in ipa-01 ipa-02; do echo "== $s =="; ssh "$s" ipa-healthcheck --failures-only 2>/dev/null || echo 'healthcheck reported failures'; done

# Kerberos ticket lifetime remaining, in minutes
klist | awk '/krbtgt/ {print $3, $4}' | while read -r d t; do echo $(( ( $(date -d "$d $t" +%s) - $(date +%s) ) / 60 )) min left; done

# Decode a Keycloak access token's claims without verifying
jq -R 'split(".")[1] | @base64d | fromjson | {sub, preferred_username, exp, realm_access}' <<< "$ACCESS_TOKEN"

# Keycloak: list clients that still allow the password grant (an MFA gap)
kcadm.sh get clients -r example --fields clientId,directAccessGrantsEnabled | jq -r '.[] | select(.directAccessGrantsEnabled) | .clientId'

# Keycloak: users who have not set OTP but are in an MFA-required group
kcadm.sh get users -r example -q briefRepresentation=true --fields id,username | jq -r '.[] | [.id, .username] | @tsv'

# Verify the SRV records a joining client depends on, both protocols
for r in _ldap._tcp _kerberos._tcp _kerberos._udp; do printf '%-16s ' "$r"; dig +short SRV "$r.example.test" | head -1; done

# Confirm client clock is within Kerberos tolerance of a server
offset=$(chronyc tracking | awk '/Last offset/ {print $4}'); echo "offset ${offset}s (must be under 300)"

#!/usr/bin/env bash
# usage: offboard.sh USERNAME   (disables the account and strips privileged group membership)
set -euo pipefail
user=${1:?username required}
klist -s || { echo 'no valid ticket; run kinit admin first' >&2; exit 1; }
ipa user-show "$user" >/dev/null || { echo "no such user: $user" >&2; exit 1; }

printf '== before ==\n'
ipa user-show "$user" --all --raw | grep -E '^ *(uid|nsaccountlock|memberof_group):' || true

# Remove from privileged groups; ignore "not a member" errors
for g in admins ops platform-admins helpdesk; do
  ipa group-remove-member "$g" --users="$user" 2>/dev/null && printf 'removed from %s\n' "$g" || true
done

ipa user-disable "$user"
# Expire the password so cached credentials and any keytab-less access stop working
ipa user-mod "$user" --setattr=krbPasswordExpiration=19700101000000Z >/dev/null

printf '\n== after ==\n'
ipa user-show "$user" --all --raw | grep -E '^ *(uid|nsaccountlock|memberof_group):' || true
printf '\nDisabled %s at %s. Object preserved; delete with `ipa user-del --preserve` only after confirming no host references the UID.\n' "$user" "$(date -u +%FT%TZ)"

#!/usr/bin/env bash
# usage: cert-report.sh hosts.txt [WARN_DAYS]   (one host per line; needs SSH and getcert on each)
set -euo pipefail
hosts=${1:?hosts file}; warn=${2:-21}
rc=0
while IFS= read -r h; do
  [[ $h =~ ^[[:space:]]*(#|$) ]] && continue
  # getcert prints "expires: 2026-12-01 ..." lines; compute days for each
  out=$(ssh -o ConnectTimeout=10 -o BatchMode=yes "$h" 'getcert list 2>/dev/null | grep -E "status:|expires:|certificate:"' 2>/dev/null) \
    || { printf 'FAIL %-30s unreachable\n' "$h"; rc=1; continue; }
  awk -v host="$h" -v warn="$warn" '
    /status:/   { status=$2 }
    /expires:/  { exp=$2 " " $3 }
    /certificate:/ {
      cmd="date -d \"" exp "\" +%s"; cmd | getline e; close(cmd)
      days=int((e - systime())/86400)
      if (status != "MONITORING" || days < warn)
        printf "%-4s %-30s %4d days  %s\n", (days<warn?"WARN":"ok"), host, days, status
    }' <<< "$out" || true
  grep -q 'WARN' <<< "$out" && rc=1 || true
done < "$hosts"
exit "$rc"

#!/usr/bin/env bash
# usage: import-users.sh users.csv   (header: uid,first,last,email,group)
set -euo pipefail
csv=${1:?csv file}
klist -s || { echo 'run kinit admin first' >&2; exit 1; }

tail -n +2 "$csv" | while IFS=, read -r uid first last email group; do
  [[ -n $uid ]] || continue
  if ipa user-show "$uid" >/dev/null 2>&1; then
    ipa user-mod "$uid" --first="$first" --last="$last" --email="$email" >/dev/null
    printf 'updated %s\n' "$uid"
  else
    ipa user-add "$uid" --first="$first" --last="$last" --email="$email" --random >/dev/null
    printf 'created %s (random password set; user must reset)\n' "$uid"
  fi
  if [[ -n ${group:-} ]]; then
    ipa group-show "$group" >/dev/null 2>&1 || ipa group-add "$group" --desc="imported" >/dev/null
    ipa group-add-member "$group" --users="$uid" >/dev/null 2>&1 || true
  fi
done