[Freeipa-users] Re: Azure AD / Azure AD Connect / FreeIPA sync

On ti, 26 huhti 2022, Mike Mercier wrote: As I said, we did not test MIM at all. If you have any success or failure with it in your experiments, please report back here. I should note that LDAP sync as described above is for import from LDAP server to Azure AD, not the other way around. At least, that's what documentation above tells about. For pushing changes from Azure AD to an LDAP server they have recently unveiled a different service that requires premium licensing in Azure: https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/... In either case, I have no first hands experience. I am particularly interested in how one can define mapping between classes, attributes, and tree layouts. IPA uses its own directory information tree layout, own object classes and attributes. It is not enough to simply push AD objects directly to IPA, they will not be usable. Judging by the on-premises LDAP connector documentation above, some way to translate attribute values is present. Obviously, there is a need to define one for IPA case as there would be no ready-made template. A simplest way is to make use of a user lifecycle feature in FreeIPA that allows to keep minimal LDAP objects in a staged user area and transition them to IPA users from there with IPA commands that know how to change those LDAP objects into full features IPA users. We are working on a pair of extensions to FreeIPA to handle somewhat similar cases to integrate with OAuth 2.0 world. One is to be able to authenticate IPA users against OAuth 2.0 device authorization grant endpoint of an external IdP. This works well, SSSD 2.7.0 includes base part for the Kerberos integration. FreeIPA integration will be submitted as a pull request upstream in coming weeks. We tested it with Azure, Google, Keycloak, Okta, Github already. It needs manual creation of users and association of them with the external IdP but the overall approach is similar to the existing RADIUS proxy authentication feature. Another extension is a separate SCIMv2 server and a new plugin to Keycloak to present it as a user federation store. This one is not yet ready for production, though. It needs a lot more work, though. Once it is there, one might try to investigate how to connect Azure AD to it with https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/... This one, it seems, follows the same logic as the on-premises LDAP connector and requires premium licensing in Azure. Btw, even without SCIMv2 part, once we get authentication to external IdP merged in FreeIPA, I would assume you'd be able to just connect that IPA setup to Azure AD as an OAuth 2.0 end-point and use it. You'd need to solve sync path more or less the same way but you only need to create a user account in IPA and set its IdP properties, no need to run any kind of sophisticated LDAP connector. So, may be Azure AD already has means to trigger these events to a script or an OAuth 2.0-based app? Then you can built that to run an equivalent of 'ipa user-add' / 'ipa user-del'. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland