Identity Domain - Combiner for domain enrollment¶

The combiner detects enrollment into identity domains such as IPA, Active Directory, generic Kerberos realm, and generic LDAP. It parses domains and realms from SSSD, KRB5, IPA, and Samba configuration.

Supported domain types¶

IPA (RHEL IdM, FreeIPA)
Active Directory (SSSD)
Active Directory (Samba winbind)
generic LDAP domain (SSSD)
generic LDAP domain with Kerberos authentication (SSSD)
generic Kerberos realm (from krb5.conf)

The combiner cannot detect generic Kerberos realms that solely rely upon DNS realm lookup (dns_lookup_realm).

Examples:

DomainInfo(
    name="ipa.test",
    domain_type="IPA",
    server_software="IPA",
    client_software="SSSD",
    domain="ipa.test",
    realm="IPA.TEST",
    workgroup=None,
    ipa_mode="client",
)

DomainInfo(
    name="ad-winbind.test",
    domain_type="Active Directory (winbind)",
    server_software="Active Directory",
    client_software="winbind",
    domain="ad-winbind.test",
    realm="AD-WINBIND.TEST",
    workgroup="AD-WINBIND",
    ipa_mode=None,
)

class insights.combiners.identity_domain.DomainInfo(name, domain_type, server_software, client_software, domain, realm, workgroup, ipa_mode)¶

Identity domain information

name¶

user-friendly name either SSSD’s domain name, domain name, or lower-case realm name

Type:	str

domain_type¶

domain type, e.g. IPA or Active Directory (SSSD)

Type:	str

server_software¶

name of the server software, e.g. Active Directory

Type:	str

client_software¶

name of the client software, e.g. SSSD or winbind

Type:	str

domain¶

name of the identity domain, not set for generic Kerberos or LDAP

Type:	str, None

realm¶

Kerberos realm name, not set for generic LDAP

Type:	str, None

workgroup¶

workgroup name, only set for AD with winbind

Type:	str, None

ipa_mode¶

IPA mode (server or client), only set for IPA

Type:	str, None

class insights.combiners.identity_domain.IdentityDomain(sssd=None, krb5=None, ipa=None, smb=None)[source]¶

Bases: object

A combiner for identity domains.

Raises:	`SkipComponent` -- When no identity domains are detected.

domains¶

List of the namedtuple DomainInfo

Type:	list

default_realm¶

default realm name (if configured)

Type:	str, None

dns_lookup_realm¶

is Kerberos realm DNS lookup enabled?

Type:	bool

dns_lookup_kdc¶

is Kerberos KDC DNS lookup enabled?

Type:	bool