{"id":2859,"date":"2018-11-01T19:25:53","date_gmt":"2018-11-02T00:25:53","guid":{"rendered":"http:\/\/osric.com\/chris\/accidental-developer\/?p=2859"},"modified":"2018-11-01T19:25:53","modified_gmt":"2018-11-02T00:25:53","slug":"integrating-freeipa-authentication-with-github-enterprise","status":"publish","type":"post","link":"https:\/\/osric.com\/chris\/accidental-developer\/2018\/11\/integrating-freeipa-authentication-with-github-enterprise\/","title":{"rendered":"Integrating FreeIPA authentication with GitHub Enterprise"},"content":{"rendered":"<p>The <a href=\"https:\/\/help.github.com\/enterprise\/2.15\/admin\/guides\/user-management\/using-ldap\/#supported-ldap-services\">GitHub Enterprise &#8211; Using LDAP documentation<\/a> lists FreeIPA as a supported LDAP service.<\/p>\n<p>Although I was able to successfully test a basic LDAP connection, the test failed after I specified the <em>Email<\/em> (using value &#8220;mail&#8221;) and <em>SSH key<\/em> (using value &#8220;ipaSshPubKey&#8221;) fields. I received the following error:<!--more--><\/p>\n<pre><code>Field `mail` is not an attribute in the user entry.\r\nField `ipaSshPubKey` is not an attribute in the user entry.<\/code><\/pre>\n<p>For the <em>Domain base<\/em>, I had specified the following (which had worked for integrating FreeIPA&#8217;s LDAP with other services):<\/p>\n<pre><code>dc=freeipa,dc=osric,dc=net<\/code><\/pre>\n<p>The problem, as far as I can tell, is that searching <code>dc=freeipa,dc=osric,dc=net<\/code> for a username returns multiple entries.<\/p>\n<p>The first entry, from <code>cn=users,cn=compat,dc=freeipa,dc=osric,dc=net<\/code>, contains just 9 attributes and does not include <code>mail<\/code> or <code>ipaSshPubKey<\/code>.<\/p>\n<p>The second entry, from <code>cn=users,cn=accounts,dc=freeipa,dc=osric,dc=net<\/code> contains 34 attributes and includes <code>mail<\/code> and <code>ipaSshPubKey<\/code>.<\/p>\n<p>I changed the value of <em>Domain base<\/em> to:<\/p>\n<pre><code>cn=accounts,dc=freeipa,dc=osric,dc=net<\/code><\/pre>\n<p>This solved the problem for me.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I followed the steps to use FreeIPA&#8217;s LDAP service for my GitHub Enterprise authentication, but I encountered errors when attempting to query the email and SSH key data from LDAP. I discovered that LDAP was returning multiple objects for my query, one with the requested attributes and one without. Once I narrowed the scope of the LDAP query, only the desired object, with the additional attributes, was returned.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[417,482,521],"class_list":["post-2859","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-freeipa","tag-github","tag-ldap"],"_links":{"self":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/comments?post=2859"}],"version-history":[{"count":2,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2859\/revisions"}],"predecessor-version":[{"id":2861,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2859\/revisions\/2861"}],"wp:attachment":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/media?parent=2859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/categories?post=2859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/tags?post=2859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}