Enroll Mac in Kerberos - Revision history

Thexa4 at 13:36, 21 January 2026

2026-01-21T13:36:04Z

← Older revision		Revision as of 06:36, 21 January 2026
Line 16:		Line 16:
	# Request the certificate		# Request the certificate
	# Store the resulting certificate in ~/Library/IPA/user.crt		# Store the resulting certificate in ~/Library/IPA/user.crt
	# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!		# Add the following lines to your ~/.bash_profile - Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!
			## alias ds_pkinit="/usr/bin/kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>"
			## ds_pkinit & disown
			# Add the following lines to your ~/.zshrc - Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!
	## alias ds_pkinit="/usr/bin/kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>"		## alias ds_pkinit="/usr/bin/kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>"
	## ds_pkinit & disown		## ds_pkinit & disown

Thexa4 at 14:56, 12 February 2025

2025-02-12T14:56:50Z

← Older revision		Revision as of 07:56, 12 February 2025
Line 17:		Line 17:
	# Store the resulting certificate in ~/Library/IPA/user.crt		# Store the resulting certificate in ~/Library/IPA/user.crt
	# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!		# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!
	## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>"		## alias ds_pkinit="/usr/bin/kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>"
	## ds_pkinit & disown		## ds_pkinit & disown

Thexa4 at 15:01, 21 January 2025

2025-01-21T15:01:53Z

← Older revision		Revision as of 08:01, 21 January 2025
Line 1:		Line 1:
	This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!		This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!

			# Set bash as your default shell: [[New_Mac_Setup#Use_Bash_as_Shell]]
	# Create host on IPA		# Create host on IPA
	# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";		# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";

Thexa4 at 14:22, 21 January 2025

2025-01-21T14:22:25Z

Thexa4 at 14:12, 21 January 2025

2025-01-21T14:12:56Z

← Older revision		Revision as of 07:12, 21 January 2025
Line 4:		Line 4:
	# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";		# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";
	# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022		# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022
	# Ensure /etc/krb5.conf file has the correct contents. ~~Make sure to replace <username> with your actual username!~~		# Ensure /etc/krb5.conf file has the correct contents.
	# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt		# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt
	# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA		# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA
Line 15:		Line 15:
	# Request the certificate		# Request the certificate
	# Store the resulting certificate in ~/Library/IPA/laptop.crt		# Store the resulting certificate in ~/Library/IPA/laptop.crt
			# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!
			## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/laptop.crt,/Users/<mac_username>/Library/IPA/laptop.key --keychain <ipa_username>"
			## ds_pkinit & disown

	== krb5.conf ==		== krb5.conf ==

Thexa4 at 14:02, 21 January 2025

2025-01-21T14:02:39Z

← Older revision		Revision as of 07:02, 21 January 2025
Line 1:		Line 1:
			This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!

	# Create host on IPA		# Create host on IPA
	# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";		# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";
	# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022		# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022
	# Ensure /etc/krb5.conf file has the correct contents		# Ensure /etc/krb5.conf file has the correct contents. Make sure to replace <username> with your actual username!
	# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt		# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt
	# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA		# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA
Line 9:		Line 11:
	# Click on Actions > New Certificate		# Click on Actions > New Certificate
	# CA = ipa		# CA = ipa
	# Profile ID = ~~KDCs_PKINIT_Certs~~		# Profile ID = caIPAserviceCert
	# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr		# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr
	# Request the certificate		# Request the certificate
Line 31:		Line 33:
	DELFTSOLUTIONS.NL = {		DELFTSOLUTIONS.NL = {
	default_domain = delftsolutions.nl		default_domain = delftsolutions.nl
	~~pkinit_identity = FILE:/Users/<username>/Library/IPA/laptop.crt,/Users/<username>/Library/IPA/laptop.key~~
	}		}

Thexa4 at 12:37, 20 June 2024

2024-06-20T12:37:16Z

← Older revision		Revision as of 05:37, 20 June 2024
Line 31:		Line 31:
	DELFTSOLUTIONS.NL = {		DELFTSOLUTIONS.NL = {
	default_domain = delftsolutions.nl		default_domain = delftsolutions.nl
	pkinit_identity = FILE:/~~etc~~/~~ipa~~/~~pkinit~~.crt,/~~etc~~/~~ipa~~/~~pkinit~~.key		pkinit_identity = FILE:/Users/<username>/Library/IPA/laptop.crt,/Users/<username>/Library/IPA/laptop.key
	}		}

Thexa4 at 12:36, 20 June 2024

2024-06-20T12:36:27Z

← Older revision		Revision as of 05:36, 20 June 2024
Line 3:		Line 3:
	# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022		# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022
	# Ensure /etc/krb5.conf file has the correct contents		# Ensure /etc/krb5.conf file has the correct contents
			# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt
			# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA
			# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/laptop.key -out ~/Library/IPA/laptop.csr
			# Go to your user in IPA
			# Click on Actions > New Certificate
			# CA = ipa
			# Profile ID = KDCs_PKINIT_Certs
			# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr
			# Request the certificate
			# Store the resulting certificate in ~/Library/IPA/laptop.crt

	== krb5.conf ==		== krb5.conf ==
Line 22:		Line 31:
	DELFTSOLUTIONS.NL = {		DELFTSOLUTIONS.NL = {
	default_domain = delftsolutions.nl		default_domain = delftsolutions.nl
	pkinit_identity = FILE:/etc/ipa/~~max~~.crt,/etc/ipa/~~max~~.key		pkinit_identity = FILE:/etc/ipa/pkinit.crt,/etc/ipa/pkinit.key
	}		}

Thexa4: /* krb5.conf */

2024-06-20T11:58:48Z

krb5.conf

← Older revision		Revision as of 04:58, 20 June 2024
Line 17:		Line 17:

	[appdefaults]		[appdefaults]
	pkinit_anchors = FILE:/etc/ipa/ca.crt		pkinit_anchors = FILE:/etc/ipa/ca.crt

	[realms]		[realms]
	DELFTSOLUTIONS.NL = {		DELFTSOLUTIONS.NL = {
	default_domain = delftsolutions.nl		default_domain = delftsolutions.nl
	pkinit_identity = FILE:/etc/ipa/max.crt,/etc/ipa/max.key		pkinit_identity = FILE:/etc/ipa/max.crt,/etc/ipa/max.key
	}		}

Thexa4 at 11:58, 20 June 2024

2024-06-20T11:58:04Z

← Older revision		Revision as of 04:58, 20 June 2024
Line 2:		Line 2:
	# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";		# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE";
	# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022		# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022
			# Ensure /etc/krb5.conf file has the correct contents


			== krb5.conf ==
			<pre>
			[libdefaults]
			default_realm = DELFTSOLUTIONS.NL
			kdc_timesync = 1
			ccache_type = 4
			forwardable = true
			proxiable = true
			fcc-mit-ticketflags = true
			ticket_lifetime = 24h

			[appdefaults]
			pkinit_anchors = FILE:/etc/ipa/ca.crt

			[realms]
			DELFTSOLUTIONS.NL = {
			default_domain = delftsolutions.nl
			pkinit_identity = FILE:/etc/ipa/max.crt,/etc/ipa/max.key
			}

			[domain_realm]
			.delftsolutions.nl = DELFTSOLUTIONS.NL
			delftsolutions.nl = DELFTSOLUTIONS.NL
			</pre>

← Older revision		Revision as of 07:22, 21 January 2025
Line 7:		Line 7:
	# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt		# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt
	# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA		# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA
	# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/~~laptop~~.key -out ~/Library/IPA/~~laptop~~.csr		# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/user.key -out ~/Library/IPA/user.csr
	# Go to your user in IPA		# Go to your user in IPA
	# Click on Actions > New Certificate		# Click on Actions > New Certificate
	# CA = ipa		# CA = ipa
	# Profile ID = caIPAserviceCert		# Profile ID = caIPAserviceCert
	# Paste the contents of this command into the big textfield: cat ~/Library/IPA/~~laptop~~.csr		# Paste the contents of this command into the big textfield: cat ~/Library/IPA/user.csr
	# Request the certificate		# Request the certificate
	# Store the resulting certificate in ~/Library/IPA/~~laptop~~.crt		# Store the resulting certificate in ~/Library/IPA/user.crt
	# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!		# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username!
	## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/~~laptop~~.crt,/Users/<mac_username>/Library/IPA/~~laptop~~.key --keychain <ipa_username>"		## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/user.crt,/Users/<mac_username>/Library/IPA/user.key --keychain <ipa_username>"
	## ds_pkinit & disown		## ds_pkinit & disown