Identity

Title card: A Role With Nothing but a Name: Seeding OneLogin

A Role With Nothing but a Name: Seeding OneLogin

OneLogin gives a role, a group and a policy nothing but a name, and a Smart Hook not even that. Teardown still has to delete only what my seed made, so each object is proved by what it holds.

Title card: A Directory Full of Question Marks: Seeding PingOne

A Directory Full of Question Marks: Seeding PingOne

The first PingOne seed I ran from Windows PowerShell 5.1 turned every accented and Han name into question marks. The fault was in how 5.1 encodes a request body, and all six providers in the module had it.

Title card: Seeding FreeIPA, Where Teardown Starts Revoking

Seeding FreeIPA, Where Teardown Starts Revoking

My seed asks the FreeIPA realm’s own CA for ten real certificates, and a CA has no delete. Teardown revokes them, so every seeded realm keeps a record of the run, next to HBAC and sudo rules built to be misread.

Title card: Seeding Authentik, Where the Directory Is Only the Floor

Seeding Authentik, Where the Directory Is Only the Floor

Authentik was already in my homelab doing single sign-on, so there was no license cap to design around. Of everything the provider seeds, the three hundred users are the least interesting.

Title card: Eight Okta Users, and Everything That Changed Around Them

Eight Okta Users, and Everything That Changed Around Them

I opened the Okta provider expecting to write the ten-user post again with better numbers. The eight users are the same eight users. Nearly everything around them has been replaced.

Title card: Test Data That Breaks Scripts on Purpose

Test Data That Breaks Scripts on Purpose

I built a lab by hand to test an RC4 migration script, and every run came back clean. The two accounts it should have caught were invisible, because my fixture held the same wrong assumption as the filter.

Title card: Adding a FreeIPA Replica When the Only Spare Host Runs Ubuntu

Adding a FreeIPA Replica When the Only Spare Host Runs Ubuntu

Every login in the house resolved against one thin client, and the only spare machine ran Ubuntu. The second server became a container, and a bad image tag left me a replica that looked healthy.

Title card: Hardening FreeIPA Before the First Client Joins

Hardening FreeIPA Before the First Client Joins

The rule a fresh FreeIPA install ships lets every account reach every service on every host, and it is on. That set my order: harden first, enroll second, then argue with each distro about sudo.

Title card: Standing Up FreeIPA When Everything in the Lab Is Linux

Standing Up FreeIPA When Everything in the Lab Is Linux

My lab has no Windows in it, and a directory should not be the reason to add some. FreeIPA gave me a Kerberos realm and an internal CA on a thin client, and a DNS migration that took the longest.

Title card: Proxmox Can Do This Itself

Proxmox Can Do This Itself

Six posts of proxying applications that cannot do SSO. Proxmox speaks OpenID Connect natively, so the right move was to get out of the way, and small disagreements made that harder.