Back to the main page

Automount and FreeIPA (IdM)


FreeIPA (or RedHat IdM, for Identity Management ) is tool for managing Identity, Policy and Audit (IPA). It's something like Microsoft Active Directory, only it's for Linux/Unix systems.
This page is the evaluation of Automount feature. As per IdM docs, for automount to work within the IdM domain, the NFS server must be configured as an IdM client (member of IdM domain).
In this evaluation I use Oracle Linux 6 (OL6) and ZS3-2 (ZFS appliance) as a NFS Server.
The VM (OL6) is the member of IdM domain and it exports its /home (it's just directory in root file system).
The ZS3 has share "home" that's accessible via NFS protocol.
Evaluated clients are OL6 and Solaris 11, yes Solaris can be FreeIPA client. see Solaris as FreeIPA client

NFS Server


A Virtual Machine (VM) running OL6 is the NFS server, exporting its /home (it's just the directory in root filesystem). The VM is member of IdM domain.

[root@nfs-server ~]$ df -h /home
Filesystem                        Size  Used Avail Use% Mounted on
/dev/mapper/vg_nfsserver-lv_root   11G  2.8G  6.8G  30%   /

[root@nfs-server ~]# cat /etc/exports
/home   *,root_squash)

The view from potential client:

[root@nfs-client ~]# showmount -e nfs-server
Export list for nfs-server:
/home *


The home share has been created on ZS3-2 (ca-sastor1), it doesn't accept any Kerberos setting in Share - Protocol - Security Mode, but looks that this doesn't affect automount. Users' home directories have been manually created under /home.

FreeIPA Server

NFS Server: OL6

The VM is member of IdM domain, via Web see Identity - Hosts - Enrolled = True.
The "default" automount location already exist, but let's create new one and name it "userdirs" (this is only for OL clients).

[root@freeipa-server ~]# kinit admin
Password for admin@KOMPANIJA.COM:

[root@freeipa-server ~]# ipa automountlocation-add userdirs
Added automount location "userdirs"
  Location: userdirs

Maps auto.master and will be created under this location. The auto.master doesn't need any change, but we need to add key in map.

[root@freeipa-server ~]# ipa automountkey-add userdirs --key=/home --info="-rw,bg,intr,hard,"
Added automount key "/home"
  Key: /home
  Mount information: -rw,bg,intr,hard,nobrowse,

NOTE: The showmount may not show clients that user nfs version 4, so if needed, version 3 can be specified in previous ipa command ( -rw,bg,intr,hard,nobrowse,nfsvers=3, )
If you prefer, this can be done via web interface.

To verify configuration:

[root@freeipa-server ~]# ipa automountlocation-tofiles userdirs
/-      /etc/
/home   -rw,bg,intr,hard,
maps not connected to /etc/auto.master:

As said, this setup works only for OL clients, for Solaris we'll have to create different location "solaris-userdirs". The location has configuration:

[root@freeipa-server ~]# ipa automountlocation-tofiles solaris-userdirs
/-      /etc/

NFS Server: ZS3-2

The ZFS appliance (zfs-app) has been added to Identity - Hosts, but Enrolled is not True, so seems that storage is not really member of IdM domain. This is the same behavior as with Solaris system.
I also believe that if even ZS3-2 and Solaris system are not added to IdM domain, a user should be able to SSH and automount home directory.

Two new automount locations have been created (via Web interface), for OL and Solaris (same as we did with a VM as NFS server).
This is verification.

[root@freeipa-server ~]# ipa automountlocation-tofiles zs3-2-ol
/-      /etc/
/home   -rw,bg,intr,hard,nobrowse,nfsvers=3,

[root@freeipa-server ~]# ipa automountlocation-tofiles zs3-2_solaris
/-      /etc/

Here are all 4 automount locations.

NFS Client

* OL6

** NFS Server: OL6

Note that client is already member of IdM domain. Run this command for automatic autofs configuration.

[root@ol6-client ~]# ipa-client-automount
Searching for IPA server...
IPA server: [u'']
Location: default
Continue to configure the system with these values? [no]: yes
Configured /etc/nsswitch.conf
Configured /etc/sysconfig/nfs
Configured /etc/idmapd.conf
Started rpcidmapd
Started rpcgssd
Restarting sssd, waiting for it to become available.
Started autofs

You may need to verify automount location in /etc/sssd/sssd.conf file, just in case it's not "default".

[root@ol6-client ~]# cat /etc/sssd/sssd.conf  
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain =
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname =
chpass_provider = ipa
ipa_server = _srv_,
ldap_tls_cacert = /etc/ipa/ca.crt
autofs_provider = ipa
ipa_automount_location = userdirs  <---- it is "userdirs"
services = nss, sudo, pam, autofs, ssh
domains =
homedir_substring = /home

The ldapsearch can be done, for curiosity.

[root@ol6-client ~]# ldapsearch -LLL -x -h freeipa-server -b "dc=kompanija,dc=com" objectclass="automount"
dn: description=/-,automountmapname=auto.master,cn=default,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /-
description: /-

dn: description=/home,,cn=default,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /home
automountInformation: -rw,bg,intr,hard,
description: /home

dn: description=/-,automountmapname=auto.master,cn=userdirs,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /-
description: /-

dn: description=/home,,cn=userdirs,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /home
automountInformation: -rw,bg,intr,hard,
description: /home

This may also be needed if you want to enable creation of home directory:

[root@ol6-client ~]# authconfig --enablemkhomedir --update

Make sure that this service is running, it's essential for automount to work.

[root@ol6-client ~]# chkconfig  oddjobd on
[root@ol6-client ~]# service oddjobd status
oddjobd (pid  15958) is running...

And finally login as LDAP/FreeIPA user that doesn't have local account on machine.

login as: zarko1
Authenticating with public key "rsa-key-20150217" from agent
Last login: Fri Jul 22 17:54:23 2016 from 10.x.x.x

[zarko1@ol6-client ~]$ pwd

[zarko1@ol6-client ~]$ df -h .
Filesystem                      Size  Used Avail Use% Mounted on   11G  2.8G  6.8G  30% /home

** NFS Server: ZS3-2

All it's needed is to change automount location in /etc/sssd/sssd.conf and restart services : autofs, sssd and oddjobd.

[root@ol6-client /]# grep location /etc/sssd/sssd.conf
ipa_automount_location = zs3-2-ol

Another verification can be:

[root@ol6-client /]# automount -m 
autofs dump map information
global options: none configured
Mount point: /-
  instance type(s): sss
  /home | -rw,bg,intr,hard,nobrowse,nfsvers=3,

Let's test and login as FreeIPA user:

login as: zarko1
Authenticating with public key "rsa-key-20150217" from agent
Last login: Thu Jul 28 15:07:30 2016 from 10.x.x.x

-bash-4.1$ pwd

-bash-4.1$ df -h .
Filesystem                         Size  Used Avail Use% Mounted on 1.0G     0  1.0G   0% /home

* Solaris 11

** NFS Server: OL6

If the NFS server is running on OL, then the max supported NFS version on Solaris has to be 3.

root@sol-x86:~# sharectl status
autofs  disabled client
smb     disabled
nfs     disabled

See the NFS properties.

root@sol-x86:~# sharectl get nfs
client_versmax=4 <--- need to change to v3

Change max version for client to ve 3.

root@sol-x86:~# sharectl set -p client_versmax=3 nfs 

root@sol-x86:~# sharectl get nfs | grep versmax 

When configuring automount, it looks that manual configuration of ldap client is needed. Use proper automount location which is solaris-userdirs.

root@sol-x86:~# ldapclient -v manual -a authenticationMethod=none \
-a defaultSearchBase=dc=kompanija,dc=com \
-a \
-a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=kompanija,dc=com \
-a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=us,dc=oracle,dc=com \
-a serviceSearchDescriptor=auto_master:automountMapName=auto.master,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one \
-a,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one \
-a objectClassMap=shadow:shadowAccount=posixAccount \
-a searchTimelimit=15 -a bindTimeLimit=5 

root@sol-x86:/var/ldap# ldapclient list
NS_LDAP_SEARCH_BASEDN= dc=kompanija,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=accounts,dc=kompanija,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=kompanija,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= auto_master:automountMapName=auto.master,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one
NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount

Verify NSS config file (automount must have both files and ldap, the order is not important).

dudic@sol-x86:~$ grep automount /etc/nsswitch.conf
automount:      files ldap

Verify /etc/auto_master file, it needs to have +auto_master (this file must exist, other auto_* files can be omitted).

root@sol-x86:/etc# cat /etc/auto_master | grep auto_master

In case LDAP user can SSH but cannot mount home directory, the first troubleshoot step would be to restart below services on LDAP Solaris client.

root@sol-x86:/# svcadm restart nfs/client autofs ldap/client

Now a LDAP user can SSH and have mounted home directory.

login as: dudic
Using keyboard-interactive authentication.
Using keyboard-interactive authentication.
Your Kerberos account/password will expire in 89 days.

Last login: Mon Jul 25 14:34:24 2016 from some-box
Oracle Corporation   SunOS 5.11   11.3  September 2015

dudic@ca-sunstor2old:~$ pwd

dudic@sol-x86:~$ df -h .
Filesystem                           Size  Used  Available Capacity  Mounted on 10G   2.8G    6.7G    30%      /home/dudic

** NFS Server: ZS3-2

The ldapclient has to be modified by changing automount location.

root@sol-x86:/etc# ldapclient -v mod \
-a serviceSearchDescriptor=auto_master:automountMapName=auto.master,cn=zs3-2_solaris,cn=automount,dc=kompanija,dc=com?one \

Run "ldapclient list" to confirm changes and restart three services with the command :

root@sol-x86:/#  svcadm restart nfs/client autofs ldap/client 

Let's test user login:

login as: zarko1
Using keyboard-interactive authentication.
Your Kerberos account/password will expire in 73 days.
Last login: Thu Jul 28 15:07:45 2016 from some-machine
Oracle Corporation   SunOS 5.11      11.3    September 2015

-bash-4.1$ pwd

-bash-4.1$ df -h .
Filesystem                                Size   Used  Available Capacity  Mounted on  1.0G   104K     1.0G     1%    /home/zarko1

Back to the main page